Data loss prevention at firms: what it is and how to start.

The most common leak at a firm is an email sent to the wrong person. Ireland's Data Protection Commission received 6,521 valid breach notifications in 2025, and almost half were correspondence sent to the wrong recipient. Data loss prevention is mostly about catching ordinary mistakes like that one, made in a hurry by people who meant well.

Where client data leaves a firm

• Email: autocomplete picks the wrong client, a file goes to a personal address to finish at home, a reply-all reaches someone outside the firm.
• Shared links: a folder shared with anyone who has the link, still open years after the work ended.
• AI tools and note takers: a contract pasted into a personal chatbot account, a call recorded by a note taker nobody approved. Our guide to shadow AI covers these.
• Old accounts and devices: a leaver's mailbox still active, a laptop with the shared drive synced to it.
• Backups and archives: copies held by a provider nobody has reviewed in years.

What the software checks

DLP software reads what moves through email, shared drives, chat and devices, and compares it with patterns that mean client data. Microsoft Purview comes with ready-made patterns for things like IBANs, EU passport numbers and Irish PPS numbers, and a firm can add its own, such as the format of its client or account numbers.

When something matches, a policy decides what happens. It can record the match quietly, show the person a tip before they send, let them go ahead with a reason, or block it.

Microsoft 365 Business Premium, E3 and E5 include these features for email, SharePoint and OneDrive, so a firm on one of those plans may already have them, switched off.

Start quietly, then tighten

A policy switched straight to block stops real work on the first day, and people soon find ways around it. Purview lets a new policy run in simulation mode, which shows what it would have caught before anything is enforced. A sensible order:

1. Pick the two or three kinds of data that would hurt most if they leaked, such as identity documents, bank details and anything under a confidentiality agreement.
2. Run a policy for those in simulation mode for a few weeks, and read what it catches.
3. Tune it. Many early matches will be harmless, such as a client's own statement sent back to them.
4. Turn on tips that warn people before they send. A prompt at the moment of sending gives people the second look that catches a wrong address.
5. Block only the narrow cases where a mistake can't be undone, such as identity documents going to a personal address.

Someone has to read the alerts

This is where smaller firms get stuck. The software produces a steady list of matches, and someone has to decide which ones matter, talk to the person involved and fix what allowed it, whether that's a sharing setting or an account that should have been closed. In a firm without a security team, that job tends to land on nobody.

An IT security audit is where to start: it maps where your client data lives, which tools can reach it and how it could leave, and your IT team gets a written list of what to fix first.

Questions firms ask

What does DLP stand for?

Data loss prevention. You'll also see data leakage prevention, which means the same thing.

Is data loss prevention the same as a backup?

A backup protects data you might lose. Data loss prevention protects data from reaching people who shouldn't have it. A firm needs both, and each is set up on its own.

Do we need new software?

Often no. Firms on Microsoft 365 Business Premium, E3 or E5 already have DLP for email, SharePoint and OneDrive. The work is in choosing the policies and reading what they find.

How long does it take to set up?

A first policy can run in simulation mode within days. Getting it to warn and block without getting in the way takes a few weeks of reading and tuning.