Data leaves the company faster than you think – an accidentally externally shared document, an email with customer data sent to the wrong address, an upload to a public Teams channel. Microsoft Purview Data Loss Prevention (DLP) detects sensitive data in real time and prevents its uncontrolled sharing.

What Is Data Loss Prevention?

Definition and Differentiation

DLP is a security mechanism that automatically detects sensitive data and controls its sharing according to defined rules. Unlike Sensitivity Labels, which control access to documents, and Retention Policies, which manage the lifecycle, DLP focuses on data flow:

• Sensitivity Labels = Who may access?
• Retention Policies = How long is it retained?
• DLP = Where may data flow?

Together, these three mechanisms form the Information Protection Triangle of Microsoft Purview.

Why DLP Is Critical for Swiss Companies

The Swiss DSG (Data Protection Act) requires "appropriate technical measures" to protect personal data. Without DLP, you risk:

• Fine risk: DSG violations can result in fines up to CHF 250,000 (personal liability!)
• Reputation damage: Data leaks sustainably destroy customer trust
• Corporate espionage: Confidential business data can fall into the wrong hands
• Regulatory consequences: Industry-specific regulations (FINMA, Swissmedic) further tighten requirements

How DLP Works in SharePoint Online

The Technical Process

1. 1Content analysis: Every document uploaded or edited in SharePoint undergoes content analysis
2. 2Pattern recognition: DLP searches for Sensitive Information Types (SITs) – predefined or custom patterns for sensitive data
3. 3Rule evaluation: Found content is checked against configured DLP rules
4. 4Action: Depending on the rule, the action is executed: warning, blocking, encryption, or notification

Where DLP Takes Effect

DLP policies in Microsoft Purview work across all Microsoft 365 workloads:

• SharePoint Online: Document libraries, lists, pages
• OneDrive for Business: Personal and shared files
• Microsoft Teams: Chat messages, channel messages, shared files
• Exchange Online: Emails and attachments
• Power BI: Dashboards and reports
• Endpoint DLP: Local files on Windows and macOS devices

Setting Up DLP Policies Step by Step

Step 1: Define Sensitive Data Types

Microsoft provides over 300 predefined Sensitive Information Types. Particularly relevant for Swiss companies:

Personal Data (DSG)

• AHV number (756.XXXX.XXXX.XX)
• Passport number and identity card
• IBAN and credit card numbers
• Driver's license number

Health Data

• ICD diagnosis codes
• Medication names
• Health insurance member number

Financial Data

• IBAN numbers (CH format)
• Credit card numbers (Visa, Mastercard, Amex)
• Tax identification numbers

Custom Types Create your own SITs for company-specific data:

• Customer numbers with specific format
• Internal project numbers
• Confidentiality notices in documents
• Industry-specific identifiers

Step 2: Create DLP Policies

In the Microsoft Purview Compliance Portal, create policies with three severity levels:

Policy 1: Low – Monitoring (Inform)

• Trigger: 1–4 instances of sensitive data detected
• Action: Warning to user, logging in audit log
• Example: A document contains a single AHV number
• Result: User sees a policy tip but can proceed

Policy 2: Medium – Restrict (Warn and Restrict)

• Trigger: 5–9 instances of sensitive data or certain combinations
• Action: External sharing blocked, warning to user and compliance officer
• Example: An Excel with multiple customer records is shared externally
• Result: External sharing is blocked, internal sharing remains possible

Policy 3: High – Block (Complete Blockade)

• Trigger: 10+ instances of sensitive data or highly sensitive categories
• Action: Access blocked (except for owner), immediate notification to security team
• Example: A file with 50 AHV numbers is uploaded to a public SharePoint area
• Result: File is immediately locked, security team is alerted

Step 3: Configure Policy Tips

Policy Tips are the visible side of DLP – they appear directly in SharePoint, Word, Excel, or Outlook and inform users:

• Explanation: Why was the action restricted?
• Options: What can the user do?
• Escalation: Who can they contact if the restriction isn't justified?
• Override: Can authorized users override the rule (with justification)?

Formulate Policy Tips clearly and understandably – nobody reads a legal text block. Our recommendation:

"This document contains sensitive personal data (AHV number). External sharing is therefore blocked. If you still need to share the document externally, please contact your compliance officer."

Step 4: Define Exceptions and Overrides

Not every DLP restriction makes sense in every situation. Configure overrides:

• Business Justification Override: Users can override the rule but must provide a reason (logged)
• Manager Override: Supervisors can approve exceptions
• False Positive Reporting: Users can report false alarms so policies can be optimized

Advanced DLP Scenarios

Exact Data Match (EDM)

For maximum accuracy, you can use EDM. You upload a table with actual sensitive data (e.g., all AHV numbers of your employees). DLP then recognizes exactly these values – without false positives:

• Upload data as a hashed table (plaintext data never leaves your environment)
• Exact recognition instead of pattern matching
• Ideal for: Employee data, customer master data, contract numbers

Endpoint DLP

DLP works not only in the cloud but also on your employees' endpoints:

• USB Transfer: Warning or block when copying sensitive files to USB drives
• Printing: Prevention of printing confidential documents
• Clipboard: Blocking copy-paste from protected documents to unauthorized applications
• Cloud Upload: Blocking upload to unapproved cloud services (e.g., personal Dropbox)

DLP for Microsoft Teams

Teams is a particularly critical channel since information is shared quickly and informally here:

• Chat messages with sensitive data are automatically blocked or masked
• Shared files in Teams channels are covered by the SharePoint DLP policy
• Policy Tips appear directly in the Teams client

Monitoring and Reporting

DLP Alerts Dashboard

In the Microsoft Purview Compliance Portal, you'll find the DLP Alerts Dashboard:

• Overview: All DLP incidents at a glance
• Severity: Filter by low, medium, and high
• Trend analysis: How are DLP incidents developing over time?
• Top users: Who triggers the most DLP alerts? (Indicates training needs)
• Top policies: Which policies are triggered most frequently?

Activity Explorer

The Activity Explorer provides deep insights into DLP activities:

• Which files were blocked?
• Which users used overrides?
• Which Sensitive Information Types are most frequently detected?
• Which locations (SharePoint sites, OneDrive accounts) are most affected?

Regular Reviews

Schedule monthly DLP reviews:

1. 1Analyze false positives and optimize rules
2. 2Check override justifications for plausibility
3. 3Identify training needs for frequently affected teams
4. 4Adjust thresholds based on experience

The Information Protection Triangle

DLP unfolds its full power only in combination with Sensitivity Labels and Retention Policies:

Sensitivity Labels classify documents and control access. DLP can use label-based rules: "All documents labeled 'Highly Confidential' may not be shared externally."

Retention Policies manage the lifecycle. DLP ensures that data doesn't leave the company uncontrolled during the retention period.

DLP monitors data flow in real time and intervenes when sensitive data crosses defined boundaries.

Together, these three mechanisms form a comprehensive protection shield for your business data.

CNEXT: Your Partner for Information Protection

Implementing an effective DLP strategy requires technical expertise, legal knowledge (particularly regarding the Swiss DSG), and a fine sense for the balance between security and productivity. Too much DLP slows employees down, too little leaves gaps.

CNEXT supports you throughout the entire journey: from analyzing your data landscape through policy development to implementation, training, and ongoing monitoring.

Contact us for a free initial analysis of your current DLP situation.