Knowledge · IT · Data · DX

DLP · Data Loss Prevention

Data Loss Prevention

📂IT · Data · DX⏱2-min read📊Practical🔗8 related

What is DLP?

In one line
Data Loss Prevention (DLP) is the set of technologies and policies that detect and block sensitive data, such as personal information or trade secrets, from leaving the company through email, USB drives, web uploads, and AI prompt boxes.
Bring this topic in-house📚 Related Course💬 Ask About Training
⚡ Summary in 3 lines
  • It watches data going out, not attacks coming in
  • AI prompt boxes: a new leak path
  • Start with warnings and logging, then narrow the scope of blocking

Many people think of DLP as a shield against outside hackers, but this tool watches in the opposite direction: it monitors data leaving from the inside. And most of what it catches isn't malicious leakage but mistakes made in a hurry, like emailing a participant list to a personal account to work from home, or pasting an entire set of evaluation files into a generative AI prompt box to summarize them. DLP is a safety net for mistakes before it is a surveillance tool.

It works in three steps. First, it identifies what counts as sensitive data, using fixed-format patterns such as national ID or bank account numbers, specific keywords, and classification labels attached to documents. Next, it watches the exit points: PC USB ports, printing, and screen copying, email and web uploads, and cloud storage are the typical ones. Finally, it chooses a response: log only, show a warning, ask for a reason and allow, or block outright.

Generative AI added one more channel: text pasted and files uploaded into browser-based AI prompt boxes. If your internal AI usage guidelines merely state 'do not enter customer information,' there is no way to know whether anyone followed it. DLP makes that sentence actually work. The safer sequence is to start with warnings and logging rather than blocking, watch for a month or two to see what gets flagged in which departments, and then narrow the scope of blocking.

Where it goes wrong in practice is over-blocking. If every channel is blocked on day one, normal work stops, and employees find workarounds like photographing their screens with a phone. The leak risk stays the same, but the logs disappear. Frequent false positives also teach people to close warning pop-ups without reading them. And because the tool looks into employees' email and screen activity, introducing it without a process that explains what is collected and why can escalate into privacy complaints and labor disputes. Legal and labor review and employee notice need to go together before rollout.

Courses that cover this term · AI & DX
Recommended courses · Recommended instructors · Quick quote
📚Digital Literacy2 hours · On-site corporate training · John KimSee course →📚Vibe Coding Security: Safety-Checking Your Own AI Web Apps4 hours · On-site corporate training · John KimSee course →
Instructor Seolyeong ParkSeolyeong ParkGenerative AI and AX training specialist: 17 years of hands-on experience and 200+ sessions, making AI usable right away even for non-technical staffInstructor Jaryong KooJaryong KooMarketing PhD and leading authority on AI, data analysis, and personal branding
🧮 Mini quote · Based on instructor fees
About KRW 1.2 million (≈ US$900)2-hour talk · up to 20 people · Korean
Get a quote for these requirements →
💡 In plain English
Think of the security check at a building exit: it doesn’t look at who is coming in, only at whether the bags going out hold company documents.
Why it matters in practice
Organizations search for this term when employees start pasting company data into generative AI and they find that a guideline document alone doesn't control it.
Origin and sources

The term refers to a family of security products that identify and control sensitive data leaving the organization based on its content. It has no single originator; it became the standard name for a product category in the security industry. The same acronym is also spelled out as Data Leakage Prevention, with the same meaning.

An example

Consider a hypothetical case. Company A, a financial IT firm with 600 employees, distributed internal AI usage guidelines and trained every employee. Three months later, it came to light by chance that an HR staffer had pasted performance feedback for 80 people into an external AI service to summarize it.

  1. The head of information security reported to the executive meeting: "We have guidelines, but no way to check whether they were followed. Right now we can't even tell how many more cases there were."
  2. The company adopted DLP but ran the first two months with logging and warnings only, no blocking. Across three channels (AI prompt boxes, personal email, and USB drives), it flagged 1,400 incidents a month.
  3. On analysis, 900 of the 1,400 alerts were false positives: employee ID numbers misread as resident registration numbers. Once the manager fixed the detection rule, the real count settled at 310 a month.
  4. The HR director said, "If there's no way to summarize evaluation files, people will just paste them in again." The company opened up an approved in-house AI tool and allowed input there.
  5. The labor relations manager sent all employees a notice listing what is collected and why, and the labor-management council agreed to limit access to the logs to two people on the information security team.
  6. From month three, they switched to blocking only for national ID numbers and performance-rating files, and sensitive data heading to external AI tools dropped from 310 incidents a month to 22.
When to use it, and when to avoid it
✅ Good fit when
  • When you have AI usage guidelines but no way to check compliance
  • When a department handles documents where a leak would do serious damage, such as personal data, evaluations, or payroll files
  • When you want to prioritize security training based on leak channels and incident counts
🚫 Use with caution when
  • Jumping to a full block without first classifying what counts as sensitive data
  • Rolling out screen or email logging without telling employees or getting legal and labor review
  • Adding more bans without offering an approved alternative
Related terms
Shadow AIAI tools employees use for work without IT approval or oversight. It is both a blind spot for data leaks and a signal that employees want to work with AI.Internal AI Usage GuidelinesAn internal policy document that sets out what information must never be entered, who is responsible for verification, and how outputs are labeled when employees use generative AI for work.CybersecurityThe overall defensive effort to protect systems, data, and users from digital threats such as hacking, data leaks, and malware.Zero TrustA security principle of 'trust nothing by default'. Every access request is verified every time, whether it comes from inside or outside.Network Separation and Generative AIA security policy that physically and logically separates the work network from the internet to block outside intrusion. In finance and the public sector, it is the biggest practical obstacle to adopting external generative AI.Security Awareness Training · Phishing SimulationTraining that builds the habit of spotting and reporting suspicious emails and requests. It is often paired with phishing simulations that send realistic fake phishing emails to measure how employees respond.IT Asset Management · ITAMITAM (IT Asset Management) is a system that tracks a company’s laptops, servers, software licenses, and cloud accounts in a register from purchase to disposal, so you can see at a glance who is using what and when it needs replacing.Account Lifecycle · Offboarding Account RevocationA system that manages the whole process of issuing, changing, and revoking company system accounts as people join, move, and leave. Known as Joiner-Mover-Leaver (JML), its key is cutting off departing employees’ accounts on time.
Training linked to this term
📚Digital LiteracyNanum Consulting corporate training · On-site or onlineView course →
Need in-house training on this topic?
Get a curriculum and quote tailored to your needs right away.
Ask About Training
📚 View related course🗂 All programs📄 Free resources🔎 Glossary
Last updated 14 Oct 2026 · Reviewed by John Kim

FAQ

It can detect and warn on, or block, browser input and file uploads, but how far it goes depends on the product and configuration. It can't stop personal devices or phone photos, so it works best when you also provide an approved alternative tool.
We don't recommend it. Blocking while false positives are still mixed in halts normal work and creates workarounds. The safer sequence is to run on logging and warnings for a month or two while refining the rules, then move to blocking, starting with the data that carries clear risk.
Depending on what is collected, for what purpose, and who can view it, personal data protection and employee privacy issues can arise. Before rollout, get legal and labor review and put a process in place to inform employees. For specific requirements, check the latest guidance from the competent authority, such as the Personal Information Protection Commission.
Start by inventorying which documents count as sensitive data. Tell IT the classification of what each department handles, such as evaluation files, payroll ledgers, and trainee rosters, so detection rules can be built, and flag the workflows that need exceptions.