Email DLP: stopping data loss and misdirected email

What is email DLP?

Email DLP applies rules to mail as it is sent or received. Each rule has two parts: what to look for and what to do when it finds it.

What it looks for usually combines:

• Predefined detectors for common data types such as payment card numbers, passport numbers and national identifiers, which vendors build and maintain
• Keywords and patterns (regular expressions) for your own data, such as client reference formats or project names
• Attachment checks on file types, names and contents, including archives
• Images, where the product supports optical character recognition to read text in a scanned document or screenshot
• Context, such as whether the recipient is outside the organisation or how many records the message contains

What it does ranges from gentle to strict: show the sender a warning or policy tip, ask for a business justification, encrypt the message automatically, send it for review or quarantine, block it, or notify an administrator. Every match is logged, which gives you evidence of how sensitive data moves.

Email DLP is one part of a wider data protection programme. For DLP across files, devices and cloud apps, see our sister site's guide to data loss prevention.

The problems email DLP solves

Email DLP is most valuable against everyday mistakes rather than deliberate theft:

• Sending personal data unprotected: a payroll file or patient letter sent in the clear when it should have been encrypted
• Misdirected email: autocomplete picks the wrong "Sarah", or a reply goes to the whole thread instead of one person
• Oversharing: a full client list attached when only one record was needed
• Sending work data to personal accounts: staff forwarding files to a personal webmail address to work from home
• Regulated data in the wrong place: card details or health information in an ordinary email body

It is honest to say what DLP is not. It works on patterns and context, so it will not catch everything, and Google itself notes that predefined content matching is not 100% accurate. It is also weak against a determined insider who renames or password-protects files: Gmail's DLP, for example, cannot scan the contents of password-protected files, so Google suggests attachment rules to block or quarantine them. Treat email DLP as a safety net that catches common errors and creates an audit trail, not a promise that nothing sensitive leaves.

Email DLP in Microsoft 365

Microsoft's DLP is Microsoft Purview Data Loss Prevention. For email, the relevant part is DLP for Exchange Online, which Microsoft's service description lists in Microsoft 365 Business Premium, Microsoft 365 E3 and E5, Office 365 E3 and E5 and Exchange Online Plan 2, among others. Exchange Online is an enabled location by default for licensed tenants.

When a policy matches, Purview DLP can:

• Show the sender a policy tip in Outlook warning that the message contains sensitive information
• Block the message, with or without letting the sender override and record a justification
• Notify administrators and record the activity in the audit log and Activity explorer

DLP pairs naturally with Microsoft Purview Message Encryption: Exchange mail flow rules can encrypt matching messages automatically, so protection does not depend on the sender remembering. Endpoint DLP and Teams DLP need higher-tier licences such as Microsoft 365 E5. Our sister site covers Microsoft Purview labelling and DLP across Microsoft 365 in more depth, and Forever Group's Microsoft licensing team can check what your plan includes.

Email DLP in Google Workspace

Google Workspace treats Gmail as a first-class DLP location. DLP for Gmail lets admins create data protection rules that scan messages and attachments sent or received, inside and outside the organisation. Google lists it for Frontline Standard and Plus, Enterprise Standard and Plus, and Education editions.

According to Google's admin help:

• Rules are triggered by message sent or message received, and matching events are logged in Rule log events for review
• Attachments in common document formats (Word, Excel, PowerPoint, PDF, CSV and more), compressed files (ZIP, RAR, TAR) and, with OCR switched on, images are scanned
• Contents of password-protected files are not scanned, so use attachment compliance rules to block or quarantine them
• Where rules conflict, the stricter action wins
• Predefined content detectors for card numbers, passport numbers and other data types can also be used in content compliance rules to quarantine, reject or modify messages

On Business editions, which are not in Google's list for DLP for Gmail or predefined detectors, the practical controls are Gmail's compliance rules for content and attachments, external recipient warnings, which Google turns on by default and which flag external addresses that are not in your directory or the user's contacts, and a third-party product. Our Gmail security settings guide covers the Admin console side.

Email DLP in the email security products we supply

If you already run, or are choosing, an email security platform, its DLP may be enough on its own or a useful complement to Microsoft's or Google's:

Exact package contents change over time, so we confirm which DLP features are included at quote. Our email security platforms page compares these products on more than DLP.

Misdirected email: the DLP problem people forget

Content rules catch sensitive data, but they do not know whether "j.smith@" was the right J Smith. Misdirected email needs its own controls:

• External recipient warnings: Gmail's are on by default, and in Microsoft 365 DLP policy tips can warn the sender when sensitive content is going outside the organisation
• Encryption with revocation: a portal-based service, Microsoft Purview Advanced Message Encryption or Gmail confidential mode lets you withdraw access after a mistake, which plain email cannot
• Restricting forwarding: blocking automatic external forwarding and using Do Not Forward or confidential mode for sensitive threads
• Thresholds: rules that ask for confirmation when a message contains many records or goes to many external recipients

Under UK GDPR, sending personal data to the wrong person can be a personal data breach. You have to assess it and, where it is likely to result in a risk to people's rights and freedoms, report it to the ICO within 72 hours of becoming aware of it. Being able to show that DLP warned the sender, or that the message was encrypted and access was revoked, helps that assessment.

Rolling out email DLP without stopping the business

The quickest way to make staff hate DLP is to switch on blocking rules on day one. A staged rollout works better:

1. Find out what you send. List the sensitive data types you handle and which teams send them externally.
2. Start by auditing. Run rules in a test, monitor or audit-only mode where the product offers one, and review what they would have caught.
3. Warn before you block. Policy tips and justifications teach staff without stopping legitimate work.
4. Encrypt rather than block where the data is allowed to leave but must be protected, using send secure email options.
5. Tune exceptions for known partners, internal systems and automated mail such as payroll or invoicing.
6. Review logs regularly and adjust rules as the business changes.

How we help with email DLP

Forever Systems supplies and supports several email security and encryption products, and works with Microsoft 365 and Google Workspace, so we can start with what you already own. We can:

1. Check whether your Microsoft 365 plan or Google Workspace edition already includes email DLP, and what it covers
2. Map the sensitive data you handle and the rules that should apply to it
3. Configure Microsoft Purview DLP, DLP for Gmail or your email security product's DLP in audit mode first
4. Connect DLP to encryption so sensitive mail is protected automatically
5. Recommend a third-party product only where your existing licences fall short

Pricing depends on the product and user count: ask us for a quote. Contact us to talk about email DLP.