The DLP rule the security team has been writing has become the rule the privacy team has been asking for, the rule the regulator has been citing, the rule the breach disclosure will describe as the rule the enterprise should have had. The honest framing matters here, because the DLP rule the security team has been treating as the rule that catches the data leak the rule is supposed to catch sits as the DLP rule the employee has been quietly routing around for years.
What follows runs as the working version of the field guide. The shorter version is what the security team and the privacy team actually have time to read.
What the DLP rule actually does
Three things, in roughly that order of how much each one matters. The first runs as the content inspection, where the inspection the DLP performs on the data the user is sending, the inspection that looks for the credit card number, the social security number, the customer record, the source code, the inspection the DLP can run at the email gateway, the cloud upload, the endpoint. The second runs as the policy enforcement, where the enforcement the DLP applies when the rule fires, the block, the encrypt, the quarantine, the notify, the enforcement the DLP can apply based on the policy the security team has been writing. The third runs as the audit trail, where the trail the DLP produces for every action, the trail the auditor can use to demonstrate the control, the trail the regulator will accept as the evidence of due diligence, the trail the DLP produces for every block, every alert, every exception.
What it does not
Three things, in roughly that order of how much each one matters. The first runs as the encrypted channel, where the channel the user has been using, the personal Gmail, the personal Dropbox, the personal Slack, the channel the DLP cannot inspect because the channel sits outside the enterprise visibility, the channel the employee has been using to route around the DLP. The second runs as the screenshot, where the screenshot the user has been taking of the sensitive data, the screenshot the user has been pasting into the personal chat, the data the DLP cannot catch because the data is now an image, the data the DLP the security team has been deploying cannot inspect. The third runs as the verbal disclosure, where the disclosure the user has been making in the conversation the DLP cannot hear, the meeting room, the phone call, the personal conversation, the disclosure the DLP cannot catch because the disclosure does not produce the data the DLP looks for.
How to make the DLP rule actually catch the leak
Three moves if you are the security or privacy team that wants the DLP rule to catch the leak the rule is supposed to catch. Cover the cloud channel, where the channel the enterprise has been using, the Microsoft 365, the Google Workspace, the Slack, the Salesforce, the channel the security team should be inspecting, the channel the DLP the cloud platform provides natively, the channel the security team can configure without the additional DLP appliance. Add the insider risk signal, where the signal the security team should be adding (the user about to leave, the user downloading in bulk, the user accessing outside the working hours), the signal the user behavior analytics the security team has been deploying provides, the signal the DLP can use to focus the rule on the high risk activity rather than the blanket policy the user has been learning to route around. Train the user on the why, where the why the security team should be explaining, the why that says what data the user can share, what channel the user can use, what the consequence is, the why the user will follow when the user understands the why, the why the security team should be teaching in the onboarding and the annual training. The team that covers the cloud, adds the signal, and trains the user serves as the team that has made the DLP rule actually catch the leak.
The bottom line
DLP rule in 2026 sits as the rule the security team has been writing that the employee has been routing around. The content inspection, the policy enforcement, the audit trail, those three are what the rule does. The encrypted channel, the screenshot, the verbal disclosure, those three are what it does not. The cloud channel coverage, the insider risk signal, the user training, those three are the moves. The team that does the three catches the leak. The team that has the rule on the email gateway only does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
