Menu
No data was found
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Guide updated October 2026
If you handle customer details, payroll or financial records, data loss prevention applies to you. This guide covers what DLP is, how Microsoft 365 does it, and what to turn on first.
Data loss prevention is a set of rules that watch for sensitive information leaving your business and step in when it does. The rules look at content, not just file names, so a spreadsheet of card numbers is recognised whatever it is called.
In Microsoft 365 those rules run across Outlook, SharePoint, OneDrive and Teams. They can warn the person, ask them to justify what they are doing, block the action outright, or simply log it for your IT team.
Most small businesses have no rules at all, which means every member of staff is deciding for themselves what can be emailed out, copied to a USB stick or shared with a contractor.
Under UK GDPR you have to show appropriate technical and organisational measures. DLP is one of the clearest ways to evidence that you thought about the risk before something went wrong.
Customer names and addresses, payroll spreadsheets with salary and bank details, credit and debit card numbers, National Insurance numbers, HR files and disciplinary records, and medical or support notes, which count as special category data.
DLP policies rely on data classification to identify this content. Microsoft’s built-in templates detect UK National Insurance numbers, postcodes, card numbers and other personally identifiable information using pattern matching and regular expressions. Data should be categorised by sensitivity so the right level of protection applies: payroll files need stricter rules than marketing brochures.
DLP solutions monitor data in use, in motion, and at rest, which means they watch files while they are being edited, shared, or stored. Under UK GDPR your business must have appropriate technical measures to prevent unauthorised disclosure of personal data, and DLP is one of the main controls regulators expect. If you work with clients in the US it also supports HIPAA requirements.
In Microsoft 365 this is delivered through Microsoft Purview Data Loss Prevention, often called Microsoft DLP, managed from the Microsoft Purview portal. For a typical small business it runs quietly in the background of Outlook, SharePoint, OneDrive and Teams, and with extra licensing, on endpoint devices.
It is not a product you buy but a collection of policies set up across the tools your staff already use.
Most data loss in small businesses is not a hacker. It is an ordinary day going slightly wrong.
Someone sends a spreadsheet of customer records to the wrong address. Autocomplete picks the wrong name and the email is gone before anyone notices.
A staff member copies a client export onto a USB stick to work at home, and the stick is lost on the train.
Staff use personal Gmail, WhatsApp or free Dropbox because it is quicker, and the data leaves your systems entirely.
A project manager shares a whole SharePoint folder with a contractor instead of the one file they needed.
A manager asks Copilot a question and the answer includes HR or finance detail they could already reach but had never thought to look for.
Departing staff emailing customer lists to themselves is one of the most common triggers for an ICO investigation, and it rarely looks malicious at the time.
Insider threats can be accidental or malicious, and insiders include employees, contractors and vendors. Risks from careless or malicious insiders, such as a departing employee emailing customer lists to themselves, often trigger ICO investigations.
Malicious insider attacks can cost organisations millions, even for small firms. The average global cost of a data breach is USD 4.88 million. Data breaches can lead to heavy fines and loss of client trust. Phishing and malware, including ransomware, are major causes of data loss and affect businesses of all sizes. These are the real risks that lead to ICO enforcement, even for organisations with 10 to 50 staff.
Think of DLP as guardrails for your staff rather than surveillance. A typical rule: if a file contains more than one National Insurance number and is emailed outside the business, block it and alert IT.
• Spot sensitive content wherever it is saved
• Warn staff and ask them to justify the action
• Block the action and alert IT when the risk is high
• Log everything for audit and ICO questions
• Stop an attacker who already controls an account
• Replace antivirus, MFA or Microsoft Defender
• Encrypt your data, which is a separate control
• Remove the need for backups and an incident plan
Policies vary by sensitivity. Card numbers and sort codes should trigger a hard block, while basic contact details may only need a warning.
Block. Stop the action so data cannot leave the organisation.
Warn. Show a message explaining the risk and ask the user to confirm or justify what they are doing.
Log. Quietly record the event and alert IT or your support provider.
Email DLP covers sensitive data in emails. Endpoint DLP covers laptops and mobiles. Network DLP covers data moving across networks. Cloud DLP covers data in cloud storage.
Microsoft data loss prevention applies these actions across Outlook email, SharePoint, OneDrive, Teams messages, and endpoints depending on licensing.
It cannot stop a determined attacker who already controls an account, and it does not replace antivirus, strong passwords, or properly configured Microsoft Defender. Data must be encrypted at rest and in transit, and DLP does not provide encryption itself. DLP is one layer of your overall data security: you still need backups, incident response plans, and good access management.
Building a security-aware culture matters just as much. Training helps staff spot phishing and avoid accidental leaks, and DLP works best alongside clear, simple policies and internal processes. Regulators and cyber insurers increasingly expect DLP as part of a sound security posture for UK SMEs.
If you are on Microsoft 365 Business Premium you already have the core of DLP. Here is what is in the box and what needs adding.
Business Premium
Needs more licensing
Email (Exchange Online)
Included
Not needed
SharePoint and OneDrive
Included
Not needed
Sensitivity labels and encryption
Included
Not needed
Defender for Business
Included
Not needed
Endpoint DLP (USB, printing, local saves)
Not included
Purview Suite add-on or E5
Teams chat and channel DLP
Not included
Purview Suite add-on or E5
Advanced classification
Not included
Higher tier licence
For most SMEs, Business Premium plus a targeted add-on for endpoint and Teams coverage is enough without moving to full E5. We configure this through the Cloud Security Pack.
You can create DLP policies to scan emails and attachments in Outlook, monitor and control sensitive files in SharePoint sites, and protect data in OneDrive accounts. You set these up and review the reports in the Microsoft Purview portal.
Business Premium also includes sensitivity labels and message encryption, and Microsoft Defender for Business for device and email threat protection.
Without endpoint DLP you cannot restrict USB copying or control printing of sensitive files on devices. Teams DLP for chat messages also needs additional licensing, typically Microsoft 365 E5 or the Purview Suite add-on, at around £7.70 per user per month in the UK at the time of writing.
Advanced classification using AI and machine learning needs a higher tier licence. Microsoft Defender for Business handles device threats and malware, which complements DLP but is separate from it. If you use a lot of third party SaaS apps, Microsoft Defender for Cloud Apps gives you visibility of data leaving Microsoft 365.
A starter set for any UK SMB on Microsoft 365. Before configuring anything, agree what counts as sensitive in your business, because every rule below depends on it.
Detect names with addresses, NI numbers or sort codes in attachments going outside the business. Warn, allow a justification, block if ignored.
Flag hundreds of files pulled from HR, Finance or Customer Services in a short window. Catches both departing staff and compromised accounts.
Endpoint DLP spots payroll data or CRM exports going to removable drives. Block it, or allow it with logging for specific roles.
Detect one person sharing many files with outside addresses at once, expire new shares and raise an alert for review.
Use the built-in templates for card numbers, sort codes and account numbers. Any attempt to send these out triggers a warning and a log entry.
We run these in audit mode first and tighten them gradually, so staff are guided rather than suddenly blocked.
Set up a rule that detects UK personal data, such as names combined with addresses, NI numbers, NHS numbers or sort codes, in attachments being sent outside your organisation. The policy shows a warning, lets the user give a business justification, and blocks if they ignore it or the volume is high. This directly supports UK GDPR by showing auditors you are actively preventing data leaks.
Flag or block mass downloads, meaning hundreds of files in a short window, from key sites like HR, Finance and Customer Services. This protects against departing staff taking company data and against compromised accounts pulling down whole libraries. Alerts go to your IT team or to our security operations for investigation.
Use endpoint DLP to detect when sensitive files, such as payroll data, customer database exports or HR folders, are copied to USB or external drives. You can block it completely on company devices, or allow it with logging and a justification for certain roles. This needs the endpoint DLP add-on, which we typically configure through the Cloud Security Pack.
Detect when a user shares many files or folders with external email addresses in a short time. The policy sends a clear warning, can auto-expire some new shares, and raises an alert for review. A realistic example: a project manager accidentally shares an entire client folder with a contractor, exposing documents nobody outside the team should see.
Use Microsoft’s built-in financial data templates to detect card numbers, UK bank sort codes and account numbers in emails and documents. Any attempt to send these externally should trigger a strong warning, potential blocking, and detailed logging for audit. This supports regulatory compliance and helps protect against fraud.
Copilot answers using whatever the person asking can already reach. If your SharePoint is overshared, Copilot will find it, and it will do so faster than anyone browsing manually.
A manager asks Copilot for all complaints about Client X and the answer includes historic HR notes containing personal data.
A salesperson asks Copilot to summarise customer details in Bristol and gets names, emails and phone numbers that should be tightly controlled.
DLP is the guardrail underneath. If a Copilot-drafted email contains card details or a large volume of personal data, DLP can still warn or block before it leaves. If someone saves a Copilot output somewhere unsuitable, DLP can step in.
Copilot does not replace DLP. DLP is what stops Copilot-generated content causing new data leaks.
Adam Gillett, Head of Business Partnerships, We Do Your IT Support
The ICO expects organisations using AI tools to show appropriate technical measures, and DLP is one of them. We review where your sensitive data sits and who can reach it before Copilot goes live.
Without strong data classification, access controls and DLP policies, Copilot can help people move critical data around faster than ever. Engage your IT team in planning DLP deployment before rolling Copilot out to all staff.
The ICO expects organisations using AI tools to demonstrate appropriate technical measures, and DLP is one of them. We Do Your IT Support include Copilot-aware DLP configuration in the AI Security Pack, reviewing where your sensitive data resides and who can access it before you switch Copilot on for your team.
We Do Your IT Support works with small and medium businesses across Bristol, Bath, Cheltenham, Swindon, Gloucester and the wider South West. We handle DLP so you do not have to become a Microsoft security specialist.
Agree what counts as sensitive, then find where it actually sits across OneDrive, SharePoint, Teams and email.
Write policies in plain English that match how your teams really work, rather than a generic template.
Start in audit mode, review what it catches, then move to warn and block in stages.
Monthly or quarterly reviews of alerts, plain English reporting, and changes as the business changes.
DLP prevents leaks but does not replace disaster recovery, so encrypted backups and regular restore testing run alongside it.
Data discovery. Identify what counts as sensitive in your business: customer lists, financial information, HR files, health data, intellectual property.
Mapping. Find where that data sits today in Microsoft 365 and across your computer systems. We look at OneDrive accounts, SharePoint sites, Teams channels and email.
Policy design. Agree plain English rules that match how your teams actually work, supported by user behaviour analytics to understand real usage patterns.
Implementation. Start in audit mode, review results, then move to warn and block gradually, configured in the Microsoft Purview portal.
Integration. Combine DLP alerts with Microsoft Defender for Business and, where relevant, Microsoft Defender for Cloud Apps, for joined-up security operations and useful reporting for management.
Ongoing support. Monthly or quarterly reviews of DLP alerts, adjusting rules as the business changes, updating for new tools, and helping with any ICO or regulatory questions about data protection controls.
All of this is presented in plain English dashboards and short summary reports, so owners and office managers see value without learning technical jargon. We limit access to sensitive systems by default and monitor for potential data breaches, insider threats and security incidents.
Automated, encrypted backups of critical data run alongside DLP, because DLP prevents data leaks but does not replace disaster recovery. Regular testing of those backups is part of disaster recovery planning, and we help with that too.
DLP is a set of IT rules that monitor sensitive data being emailed, copied, or shared, then block, warn, or log risky activity. For example, it stops staff from accidentally emailing customer details to the wrong person. In Microsoft 365, built-in DLP policies handle this automatically, covering data leaks and audit logs.
UK GDPR requires all organisations handling personal data to have security measures like DLP to prevent unauthorised disclosure. ICO fines have affected small firms after simple mistakes like misaddressed emails. DLP is now an affordable, sensible control for any small business using Microsoft 365 Business Premium.
A DLP policy sets rules that detect sensitive content (e.g., National Insurance numbers) combined with actions (e.g., sending outside the organisation or copying to USB) and then blocks, warns, requests justification, or logs the event. Multiple policies run together to protect various data types and manage risks.
Business Premium includes core DLP for Exchange Online (email), SharePoint, and OneDrive, letting you enforce policies without extra products. Teams chat DLP, full endpoint DLP (USB/printing controls), and advanced classification need additional licences. Sensitivity labels also encrypt data in transit and at rest.
While Copilot can reuse data a user can access, DLP monitors what leaves your organisation via email, downloads, or sharing. If Copilot drafts an email with sensitive data, DLP can warn or block it. DLP is a key guardrail we include in our AI Security Pack alongside access reviews and data monitoring.
If you have read this far, you already know that protecting sensitive data is not optional… it is a legal requirement and a business necessity. The good news is that getting started with data loss prevention does not have to be complicated.
We Do Your IT Support offer a review designed for business owners and office managers, not IT specialists. The review will:
If you are based in Bristol, Bath, Cheltenham, Swindon, Gloucester, or anywhere in the South West, get in touch with We Do Your IT Support by phone or book online.
With the right Microsoft 365 policies in place, you can embrace tools like Copilot while keeping customer and staff data safe and regulators reassured. Do not wait for a data security incident to find out what you should have had in place. Book your review today.
