Data Protection

A data protection engagement combines five parts. Three of them put the records in order: an inventory, a classification and DLP rules watching the exit channels. Two guard the content itself: cryptography together with key handling, plus pseudonymisation of records used outside production. Many providers sell only some of those, most often the DLP product alone or the cryptography design alone. Spell the scope out in your request, otherwise quotes describe different work under one name.

GDPR mandates neither encryption nor DLP outright, and names encryption as an example of a measure appropriate to the risk. The practical effect is narrower than an exemption: whether a breach reaches the supervisory authority turns on the risk to people's rights, while records unreadable to an unauthorised person can remove the duty to inform the individuals themselves. For special category data and mobile devices, missing encryption is hard to defend.

The soundest test is a limited pilot on one department and one channel, priced separately from the main deployment. Judge it by what classification actually found in your own repositories, not by a demonstration on sample data. Ask which engineer will lead the delivery and how much of their time the schedule reserves for you.

Four things stay behind and stay useful: the classification report, the rule set with each rule explained in writing, the key management policy, and the breach handling procedure. The classification report earns its keep beyond DLP, since it points at records worth deleting and at permissions granted far too broadly. Wire the rules into your change process, so a new system or a new share never appears outside classification.

Failed rollouts usually start with blocking switched on across every channel at once, before any rule tuning. The consequence is predictable: false positives climb, teams press for more rules to be disabled, and disabled rules rarely come back. Buying licences ahead of classification belongs in the same group, because then the product price list defines the scope instead of how sensitive the records really are.

Classification and permission clean up are within reach of an internal team, while cryptography design and DLP rule tuning rarely land well without earlier deployments behind you. Switching on disk and mail encryption in tools you already own also stays in house. The line runs where a mistake costs access to your own records: the key model, the recovery procedure, and exceptions to the rules.

A staged deployment does not stop work, because the monitoring phase records events without blocking anything. Users only feel enforcement, which is why it goes live channel by channel and after the change has been announced. The real load on your side is handling exceptions right after each switch, so somebody needs time reserved for those requests. Scans of large repositories are scheduled away from peak hours to spare the file servers.

Four roles are needed: the administrator of mail and workstations, the owners of business processes, a data protection officer or whoever answers for compliance, and a decision maker who signs off on blocking. Process owners carry the most weight and get left out most often, because only they can say which outbound file is ordinary work. Without them the rules describe file structure instead of document flow.

Classification and rule tuning need access to content, so the provider will see document samples and, while triaging alerts, specific files and recipients. That access is bounded by a processing agreement, a named list of people on their side, and a rule that data never leaves your systems. Settle where the DLP console logs are kept and who reads them, since those logs alone reveal who sends what.

Liability towards the supervisory authority and towards affected individuals stays with the controller, which in this arrangement is usually your company, whichever tool failed. A contract can allocate financial consequences and describe the provider duties, but it does not transfer the controller role. That is why the commitments weigh more than penalty clauses: response time on an alert, the scope of rule maintenance, and help with scoping the breach.