Data Loss Prevention (DLP)
Stops sensitive data from leaving the org.
Overview
DLP discovers, classifies, and blocks exfiltration of regulated and sensitive data across endpoint, network, email, and cloud channels. It supports compliance and insider-risk programs. Endpoint/cloud-native DLP increasingly replaces legacy network DLP. Licensed per user; policy tuning is the main effort.
Protects regulated/sensitive data once detection basics exist.
Advantages
- Purview bundled with Microsoft
- Forcepoint/Proofpoint mature
- covers endpoint/network/email/cloud channels
- supports compliance and insider risk.
Trade-offs
- High false-positive rate and tuning toil
- legacy network DLP fading
- user friction
- full coverage is rarely achieved.
Open-source option
OpenDLP and MyDLP, the area's two listed OSS options, have had no meaningful commits since 2014 and can't be recommended as production DLP today. Microsoft's Presidio (now community-governed under Data Privacy Stack) is a genuinely active open-source PII detection/anonymization engine, but it's a detection building block, not a full policy-enforcement DLP platform — so open source covers classification, not the complete DLP workflow.
Vendors & tools in this area
Insider-risk-focused DLP (formerly Code42); zero-policy setup with AI/agentic activity monitoring.
Visit site →Open-source PII detection, redaction and anonymization engine; a DLP building block, not full DLP.
Visit site →