DriversRecommendedOutdated drivers can make a good PC feel brokenScan driver issues before chasing fixes manually.Scan NowOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsClean PCRecommendedOne scan can reveal what keeps slowing WindowsLook for cleanup and repair opportunities.Run Scan×
Skip to content
World desk6 min

How to Set Up Data Loss Prevention Rules for Sensitive Files

Set DLP policy intent, choose covered locations and detectors, test matches, and apply proportionate controls before enabling blocking.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Set up data loss prevention (DLP) by defining what counts as sensitive, choosing the locations and risky activity to cover, then deciding whether a match should be audited, warned about, restricted, or blocked. The exact controls depend on the platform, workload, subscription, and rule type. Start in a test or monitor-first stage; activate blocking only after checking real matches and ordinary workflows.

Plan the policy before configuring it

A DLP rule is only useful when it connects a specific kind of information to a specific risk and a proportionate response. Write down the policy intent before opening an admin console. For example:

As an Amazon Associate I earn from qualifying purchases.

When [sensitive information or label] is found in [location] and [risky activity or audience] applies, [audit, warn, restrict, or block] and notify [responsible party].

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

This is a planning template, not a vendor-prescribed formula. Microsoft recommends defining control objectives, protected data, and locations before designing policies. Its guidance also notes that workload preparation and prerequisites can differ. See Microsoft’s DLP planning and deployment guidance.

#1 Best Overall
Apricorn 2TB Aegis Padlock USB 3.0 256-Bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-2000)
  • Hardware encrypted drive
  • Simple to use pin access. RPM-5400
  • Administrator password feature
  • Bus powered
  • Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
  • Information: Identify the data or labels the policy should recognize, such as a relevant built-in sensitive information type or an organization-specific detector.
  • Location: Name the repositories, apps, or devices where the files live or are handled.
  • Risky activity: Specify the event that matters, such as external sharing or another covered action.
  • Response: Decide who should be notified and whether the first response should be review, a user warning, a restriction, or a block.

A broad rule can create unnecessary interruptions; a narrowly scoped rule can miss the behavior it was meant to control. The policy statement gives administrators a way to check whether each condition and action is necessary.

Choose the platform and confirm scope

There is no universal DLP setup path. Choose the service that governs the files and activity you need to control, then confirm its covered locations and eligibility before relying on a rule. Microsoft Purview documents DLP across Microsoft services and scenarios including Exchange, SharePoint, OneDrive, Teams, and devices, but preparation requirements vary by workload. Google Drive DLP applies to My Drive and shared drives; the applicable policy depends on ownership. Consult the official platform documentation for current coverage and tenant requirements.

Rank #2
Apricorn 500GB Aegis Padlock USB 3.0 256-bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-500)
  • Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
  • Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
  • Software Free Design - With no admin rights needed
  • Sealed from Physical Attacks by Tough Epoxy Coating
  • Brute Force Self Destruct Feature
Configuration question Microsoft Purview Google Workspace Drive
Covered locations Microsoft lists Exchange, SharePoint, OneDrive, Teams, devices, and other service scenarios; requirements vary by workload. Microsoft Learn My Drive and shared drives. The owner’s policy applies to My Drive; a shared drive is treated as the file owner. Google Workspace Help
Detection options Built-in policy templates, sensitive information types, and labels are documented; custom policies can use sensitive information types and labels. Microsoft Learn Microsoft Learn Rule templates and custom content detectors are documented. Check the Drive DLP feature page for supported file types. Google Workspace Help Google Workspace Help
Responses and rule behavior Documented rule options include actions, user notifications, overrides, incident reports, and rule priority; available behavior depends on the rule and location. Microsoft Learn Drive rules can take actions that prevent specified file actions. The exact options depend on the rule configuration. Google Workspace Help
Eligibility and administration Confirm tenant and workload prerequisites; a particular tenant’s entitlement is not established by the general feature documentation. Microsoft Learn Supported editions are listed on the feature page, and DLP rule viewing and management privileges are required. Confirm that the organization’s edition and administrator role qualify. Google Workspace Help Google Workspace Help
Match review and testing Microsoft recommends thorough testing before enabling blocking; Activity Explorer and reporting can be used to review policy activity. Microsoft Learn Google says eligible files are scanned when a rule is added or changed; a scan completion time is not stated. Google Workspace Help

Set up and roll out a rule in stages

1. Select an appropriate detector

Start with a built-in sensitive information type, label, or rule template when it matches the data and jurisdiction your policy is meant to cover. If available built-in options do not express the policy, consider a custom detector. Microsoft documents templates and custom policies using sensitive information types and labels; Google documents Drive rule templates and custom content detectors. Confirm the detector’s meaning and scope against representative files rather than assuming its name guarantees a match.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

2. Match the conditions to the risk

Conditions determine when a rule matches. Use only conditions needed to express the policy statement: the sensitive content or label, the covered location, and the activity or audience that creates the risk. For instance, Microsoft provides an example of protecting HIPAA-related information in SharePoint and OneDrive when a document is shared externally, with access blocked and a notification sent. That is one example, not a default recommendation for every organization.

Rank #3
WD 2TB My Passport, Portable External Hard Drive, Black, backup software with defense against ransomware, and password protection, USB 3.1/USB 3.0 compatible - WDBYVG0020BBK-WESN
  • Slim durable design to help take your important files with you
  • Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
  • Back up smarter with included device management software[2] with defense against ransomware
  • Help secure your important files with password protection and hardware encryption
  • 3-year limited warranty

3. Choose a proportionate action

Actions determine what happens after a match. Depending on the platform, location, and rule type, options can include recording activity, notifying a user, blocking an action, allowing an override, or sending an incident report to administrators. Use a less disruptive response while learning how the rule behaves if policy goals and risk allow; reserve blocking for cases where a confirmed match should prevent the action. Microsoft explains conditions, actions, notifications, overrides, incident reports, and rule priority in its DLP policy reference; Google documents Drive rule actions in its rule-creation guidance.

4. Test before enabling blocking

Use representative sensitive files and ordinary work patterns to check whether the rule catches intended cases and avoids disrupting legitimate work. Review matches for false positives, missed content, and operational impact. Microsoft advises testing policies thoroughly before activating blocking. Its DLP guidance describes reviewing activity through reporting tools, including Activity Explorer. Google says eligible Drive files are scanned when a rule is added or changed, but does not state a universal completion time.

Rank #4
Sale
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
  • Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
  • Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
  • To get set up, connect the portable hard drive to a computer for automatic recognition no software required
  • This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
  • The available storage capacity may vary.
  • Check known examples that should match, including relevant file types and locations.
  • Check ordinary cases that should not match, especially workflows that resemble the risky activity.
  • Review the resulting matches and alerts, then adjust the detector, scope, conditions, or response as needed.
  • Do not treat a lack of visible matches as proof that every relevant file type or location is covered; verify documented coverage and prerequisites.

5. Activate, assign ownership, and monitor

After validation, activate the rule and make clear who reviews notifications or incidents. In Microsoft Purview, policies are created and maintained in the Purview portal and synchronized to applicable content sources; policy activity and matches can be reviewed through reporting, including Activity Explorer. Rules within a policy execute by priority, so check ordering where rules could overlap. Google notes that active Drive rules can prevent specified file actions; review the actual scope and effects after activation. See Microsoft’s DLP overview and Google’s DLP overview.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Platform-specific setup notes

Microsoft Purview

Microsoft describes rules as the business logic of a DLP policy: conditions identify a match, and actions define the result. Policies are configured in the Purview portal and synchronized to applicable content sources. Because supported locations and preparation requirements differ, verify the current guidance for each workload you intend to cover before creating a production policy. The available sources do not establish a single universal click path or confirm that a particular tenant has the required subscription or configuration.

Google Workspace Drive

Google documents this route in the Admin console: Security > Access and data control > Data protection. From the data-protection area, manage rules and create a new rule or start from a template. DLP rule viewing and management privileges are required. Before relying on the feature, check the supported editions and file types on Google’s About DLP for Drive page.

Keep the policy useful over time

A DLP rule should be treated as an operational control, not a one-time switch. Set a review routine for matches, user or administrator notifications, and changes in the files or workflows covered by the policy. If the rule creates false positives or misses intended cases, revise its scope, detector, conditions, or response, then validate the change before relying on it. Recheck platform documentation when workload coverage, prerequisites, or edition eligibility may affect the rule.

Quick Recap

Bestseller No. 1
Apricorn 2TB Aegis Padlock USB 3.0 256-Bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-2000)
Apricorn 2TB Aegis Padlock USB 3.0 256-Bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-2000)
Hardware encrypted drive; Simple to use pin access. RPM-5400; Administrator password feature
$347.75
Bestseller No. 2
Apricorn 500GB Aegis Padlock USB 3.0 256-bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-500)
Apricorn 500GB Aegis Padlock USB 3.0 256-bit AES XTS Hardware Encrypted Portable External Hard Drive (A25-3PL256-500)
Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm; Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
$199.00
Bestseller No. 3
WD 2TB My Passport, Portable External Hard Drive, Black, backup software with defense against ransomware, and password protection, USB 3.1/USB 3.0 compatible - WDBYVG0020BBK-WESN
WD 2TB My Passport, Portable External Hard Drive, Black, backup software with defense against ransomware, and password protection, USB 3.1/USB 3.0 compatible - WDBYVG0020BBK-WESN
Slim durable design to help take your important files with you; Help secure your important files with password protection and hardware encryption
$132.50
SaleBestseller No. 4
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
Seagate 2TB Portable Hard Drive | USB 3.0 (STGX2000400)
This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable; The available storage capacity may vary.
$129.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.