DLP Policy Explained and Examples

Data Loss Prevention (DLP) plays a critical role in protecting companies’ intellectual property and the sensitive information they store, as well as complying with data privacy laws around the world. At the heart of a great DLP solution is its DLP policies.

A DLP policy, also known as a data security policy, is a set of conditions that governs how users can interact with data. A DLP policy can restrict access to data with risky individuals, and it can educate employees on safe ways to use and share data. DLP policies are also crucial to complying with country or state-specific data privacy regulations.

Creating and maintaining data protection policies used to be a time-intensive activity, taking hours to configure and extend to everywhere data is accessed. Forcepoint DLP includes 1,700+ out-of-the-box classifiers and DLP policy templates that enable organizations to automatically adhere to local privacy laws based on the location they set the policy in.

A DLP policy stops the exfiltration of data and intellectual property to prevent unintentional leaks or data breaches. When configured, they often take into consideration country, industry and devices to comply with the region’s data privacy laws, the unique data risks the company faces, and the myriad of ways data is accessed.

A DLP policy will likely incorporate the following elements:

• Type of information: Personally Identifiable Information (PII), Protected Health Information (PHI), schematics, software code and credit card numbers are a few examples of highly sensitive data.
• Severity and action: Each incident, or count of multiple incidents, is given a severity level that corresponds to how risky it is for the company. A range of actions, from auditing, encrypting, to blocking the interaction, take place depending on the severity level.
• Users and location: A DLP policy can apply to individual users or groups of users. With Forcepoint DLP, it can also be applied to employees on or off the network, allowing for more flexible enforcement.
• Destination: Maintain visibility of data accessed on the web, across multiple clouds or on an endpoint, sent via email or transferred to a USB, attached to an email, and many more destinations.

Data breaches and leaks stem from a variety of cyber-attacks like social engineering, ransomware and insider threats. They can sometimes even be attributed to simple mistakes.

No matter the incident though, organizations will generally see the same results; fines or legal action from non-compliance, costs associated with remediation and upgrading internal systems to stop further incidents, and a loss in customer trust that can cast a dark light on the brand.

It’s easy to see why company data security has become so important in recent years.

With terabytes of data floating around, keeping an eye on every social security number of line of code can be difficult, to say the least. Organizations across the world are moving toward data security platforms that incorporate several key capabilities:

• Discovery: Finding information within the corners and crevices of the organization that needs protection, potentially by using artificial intelligence or machine learning.
• Classification: Accurately and efficiently categorize the data at rest or as it is being produced to maintain visibility.
• Prioritization: Ensure a strong data security posture through robust reporting and dashboards.
• Protection: Enforce data protection policies when users exhibit risky behavior with sensitive information.
• Monitoring: Maintain visibility of data consumption and sharing for both investigative and auditing purposes.

Within all of these key capabilities, data policy creation and enforcement is integral to their success.

Data privacy and protection regulations are constantly changing around the world. Take India, for example: the country of over 1 billion people just introduced the Digital Personal Data Protection Act (DPDPA) in late 2023. A vital part of global commerce now introduces new organizational risk for those that operate there.

Maintaining DLP policies and the resulting compliance requires dedicated focus on satisfying audit requirements on a rolling basis, ensuring the right data is covered by the policies and enforcing tight controls over the data the company owns.

The more countries an organization operates in, then the more difficult this becomes. There is already a laundry list of major data privacy laws to be aware of, with more being enacted every year:

• General Data Protection Regulation (GDPR) in Europe.
• California Consumer Privacy Act (CCPA) and Consumer Data Protection Act (CDPA) in the United States.
• Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada
• Network and Information Security Directive (NIS2) in Europe.
• General Data Protection Law (LGPD) in Brazil
• Personal Data Protection Act (PDPA) in Thailand and Singapore
• Telecommunications and Telemedia Data Protection Act (TTDSG) in Germany
• New Federal Act on Data Protection (nFADP) in Switzerland
• Federal Privacy Act in Australia
• Personal Information Protection Law (PIPL) in China
• Personal Data Protection Law (PDPL) in Egypt
• Protection of Personal Information Act (POPI) in South Korea

Moreover, there are a myriad of industry-specific data protection laws that organizations must also account for. Well-known regulations include:

• Health Insurance Portability and Accountability Act (HIPAA) in the healthcare sector
• Gramm-Leach-Bliley Act (GLBA) in the financial sector
• Payment Card Industry Data Security Standard (PCI DSS) for merchants and vendors
• Sarbanes-Oxley Act (SOX) for publicly owned corporations

Managing the competing priorities for maintaining compliance has grown incredibly difficult when handled manually. It’s why so many businesses turn to Forcepoint DLP, leveraging its pre-defined policy templates for data privacy laws in 80+ countries, including the ones above, to ensure that any DLP policy they implement automatically adheres to local and industry requirements.

DLP policies are easy to build in Forcepoint DLP. With over 1,700 classifiers and pre-defined templates included, companies largely need to focus on discovering the data they want to protect and prioritizing which information deserves the most attention.

Watch a “Day in the Life of a Forcepoint DLP Administrator” video to see data security policy examples in action and how quickly they can be configured.

Here’s a step-by-step guide on how to build a DLP policy in Forcepoint DLP:

1. Discover and classify your data. Data protection policies can only extend to information that is tagged or fingerprinted. Solutions like Forcepoint Data Visibility and Forcepoint Data Classification help companies use AI and ML to get a panoramic view of their data, and then classify it based on sensitivity.
2. Navigate to the correct policy level. Policy levels, found under the Policy Management tab in Forcepoint DLP, allow for a flat or structured hierarchy and give administrators flexibility on how a DLP policy is triggered.
3. Start a new policy from scratch or using a pre-defined template. The DLP policy templates available in Forcepoint DLP let you start with an industry or country in mind, and the rules will auto-propagate based on regulations within that sector or part of the world.
4. Name the policy and add conditions. A DLP policy will trigger if one or more conditions, also known as classifiers, are met. Conditions available in Forcepoint DLP include patterns and phrases, file labeling, file properties, fingerprinting, machine learning, transaction size and email details.
5. Determine severity and resulting action. Each time a condition is met, the DLP policy can create an incident. Administrators can determine the action that should be taken – no action, auditing, blocking, coaching, and more – depending on the severity of the incident. Risk-Adaptive Protection users can set actions that correspond dynamically with the level of risk presented. They can coach a user on a one-off incident, or block and record the screen of a high-risk user.
6. Identify sources to monitor. Administrators can track Active Directory users, custom computers and users, network, business units and domains. Data security policies can also be enforced differently depending on if the user is on or off the network.<
7. Determine destinations to monitor. At a high level these include email, web, endpoint, network and cloud. However, within those sections, administrators have a ton of flexibility in ensuring no stone goes unturned when it comes to protecting data.

Unique to Forcepoint DLP is its integration with the Forcepoint ONE SSE platform.

Securing access to cloud, web and private applications is inseparable from data security these days when you take into consideration all the sensitive information housed within them. This adds complexity to DLP policy management, with teams having to replicate policies across various sources and destinations to achieve comprehensive data security coverage.

Data Security Everywhere from Forcepoint enables security teams to configure policies once and apply them everywhere in just a few simple clicks. This means your endpoint DLP policy can be extended to the cloud, keeping all the conditions in place and making incident management and reporting easier.

Speak to an expert about Forcepoint DLP today and see how it can help your business.