Best Data Loss Prevention Software for Small IT Teams

Microsoft 365 Business Premium and E3 already include DLP for Exchange, SharePoint and OneDrive. The deciding question is whether you need it on the laptop too, because that's a separate license.

Policies live in the Microsoft Purview portal, and you don't need a separate console. You start from a template (financial, medical and health, or privacy data by country) or build conditions yourself from sensitive information types, which combine keywords, regular expressions, checksum validation and nearby supporting evidence, plus sensitivity labels and machine-learning classifiers. You then pick the locations, such as Exchange, SharePoint, OneDrive, Teams or devices, and scope the policy to users, groups or administrative units.

Every policy runs in one of three states. Simulation mode enforces nothing and shows a simulation overview with items scanned and matches per location. Simulation with policy tips lets users see the warning without being blocked. On enforces the actions: audit, a policy tip that warns, block with override and a business justification, or block. Microsoft documents a staged rollout through these states, and a policy takes effect about an hour after you turn it on.

Users like

coverage across many workloads and locations, from endpoints to Exchange, SharePoint and OneDrive, per Gartner Peer Insights reviewers

Users dislike

unclear policy outcomes across Microsoft products and uneven support, per Gartner Peer Insights reviewers

Source: Gartner Peer Insights, 64 reviews

Rules written in the Admin console stop sensitive files from being shared outside the company and sensitive mail from leaving, with no agent to install. The catch is the edition: no Business plan includes it.

An admin goes to Security, then Access and data control, then Data protection, and adds a rule. The rule names the apps and triggers (Drive file changes, Gmail messages sent or received, Chat messages, Chrome events), the action, an alert severity and the scope: the whole domain, organizational units or groups. Conditions use predefined detectors with a likelihood setting and minimum match counts, word lists, regular expressions or file names, nested with AND, OR and NOT. Saving a rule as audit only is the documented way to test it first.

In Drive, actions can block external sharing or disable download, print and copy for viewers. In Gmail, outgoing mail can be blocked, warned about or quarantined, and classification labels can be applied in both directions.

Users like

smooth integration across Gmail, Drive, Docs and Meet, per Capterra reviewers of the whole suite

Users dislike

admin and security controls locked behind higher tiers, per Capterra reviewers of the whole suite

Source: Capterra, 17,742 reviews

The same device and content rules on Windows, macOS and Linux, and they keep working when a laptop leaves the office network.

Endpoint Protector, now sold by Netwrix, has four modules: Device Control for USB and peripheral ports, Content Aware Protection for data in motion, eDiscovery for data at rest, and Enforced Encryption for USB drives. Device Control starts with global rights per device type, such as allow, deny or read-only for USB storage, and you refine them per group, computer, user or a specific device identified by vendor ID, product ID and serial number.

A content policy is built per operating system. You pick the action (report only, block and report, block only, or block and remediate, where the user can override with a justification), the exit points to watch (browsers, email clients, messaging apps, cloud sync clients, storage devices, the clipboard and printers), and what counts as sensitive: file types, source code, predefined personal data such as Social Security, passport and card numbers, regular expressions and custom keywords, with OCR for images.

Users like

cross-platform coverage and granular per-user and per-device policies, per Capterra reviewers

Users dislike

false positives, especially with source-code rules, and a console with many tabs, per Capterra reviewers

Source: Gartner Peer Insights, 77 reviews

Cloud-managed DLP with a price you can read on the website, built around a single policy list that covers about fifteen channels.

The Safetica client runs on Windows and macOS and reports to a cloud console, so there's no server to maintain. You define data classifications (content rules, file origin, templates, user tags or AI classification) and destinations, then add policies that combine classifications, destination types, users or teams, and one action: allow, log, notify, block, or block with override, where the user has to give a reason. Destination types include email, web and cloud drive uploads, USB storage, network shares, print, RDP, instant messaging, git push, the clipboard and screen capture.

Policies are evaluated from the top and the first match wins, and every section of a policy has to match before it applies. New policies start disabled at the top of the list, which makes it easy to stage them. Microsoft 365 and Google Drive connect through their APIs, so email and sharing in the cloud are covered even without the client.

Users like

granular DLP across USB, email, cloud apps and printers at a budget price, per Capterra reviewers

Users dislike

setup takes time and expertise, plus endpoint slowdowns and bugs after major updates, per Capterra reviewers

Source: Capterra, 141 reviews

A self-hosted server, Windows agents and a price list you can read: the most predictable option if your fleet is all Windows.

You install the server on Windows with a PostgreSQL or Microsoft SQL database and push agents to Windows 8 through 11 and Windows Server 2012 through 2022. Agents stay dormant until a policy arrives. Under Data Classification you build data rules from predefined templates for personal data, PCI DSS, HIPAA, finance and source code, with country-specific rules such as IBAN formats, or from your own regular expressions, keyword lists, document matching and file extensions. OCR covers image-based documents, and every password-protected archive can be marked as sensitive.

Under Policy Deployment you pick computer groups and set each channel to audit only, allow only to trusted destinations, or block: application access, Outlook email, USB storage, printers, Bluetooth, web and cloud uploads, screen capture and the clipboard. Users can override a block with a business reason or report a false positive, and both are logged.

Users like

granular policy settings and clear visibility into data movement, per Gartner Peer Insights reviewers

Users dislike

advanced features need tuning, per a Gartner Peer Insights review title (only 5 ratings)

Source: Gartner Peer Insights, 5 reviews

DLP built on top of full user activity monitoring: when a rule fires, you can replay what the person was doing around it.

An agent on Windows, macOS or Linux streams activity to the Teramind console, cloud-hosted or self-hosted. You classify sensitive data with predefined categories (personal, financial and health data, source code) or your own keywords, regular expressions and shared lists, then build behavior rules. Activity rules cover things like uploads to personal cloud drives, content-sharing rules cover the clipboard, file transfers, email and chat, and schedule rules cover off-hours logins.

Each rule has thresholds with their own severity and actions: warn with a custom message, notify, block, lock the session, record the screen, redirect, run a command or switch task. A typical setup warns after two violations and blocks after five. Incidents land in a behavior alerts dashboard and open in a session player.

Users like

deep monitoring with screen recording, live view and flexible alerts that help investigations, per Capterra reviewers

Users dislike

price, a learning curve and a dated interface, plus macOS issues and agent disconnects, per Capterra reviewers

Source: Capterra, 107 reviews

Connects to SaaS apps through their APIs and scans what people post there, then adds an agent and browser extensions for uploads and AI prompts.

You connect apps such as Slack, GitHub, Google Drive, Gmail, Confluence, Jira, OneDrive, Teams, Salesforce, Zendesk and Notion as integrations, with no network changes. Detection is built in layers. Detectors (Nightfall's pretrained ones, or your own regular expressions, dictionaries, file types, fingerprints or Microsoft Purview labels) are grouped into a detection rule, where each gets a scope, a minimum confidence and a minimum number of findings. You test the rule in a playground, then add it to a policy for one integration with its alert recipients and automatic actions.

Violations appear as events. Depending on the app, admins can notify the user in Slack, Teams or email, redact, quarantine, remove access, delete a message or open a Jira ticket.

Users like

quick rollout, configurable policies and a simple admin console, per G2's review summary

Users dislike

limited reporting dashboards and alert customization, and slower support, per G2's review summary

Source: G2, 98 reviews

An add-on to Acronis Cyber Protect Cloud that writes the first policy for you by watching how each client's data actually moves.

The MSP enables the Advanced Data Loss Prevention pack for a client tenant and adds DLP to a protection plan in observation mode. The agent watches outgoing transfers, classifies their sensitivity with built-in categories for personal data, health data, payment card data and documents marked confidential, notes sender and recipient, and builds a data flow policy from what it sees. Nothing's blocked during observation, though. You can allow everything, ask users for a one-time justification on every unmatched transfer, or allow internal transfers and ask for a reason on external ones.

After the observation period, which Acronis puts at about a month in the docs and one to two months in the product FAQ, the admin reviews the learned rules and switches to strict enforcement or adaptive enforcement, which keeps adding newly seen legitimate flows.

Users like

one agent and one multi-tenant console for backup, security and patching, per Capterra reviewers of Cyber Protect Cloud

Users dislike

a busy console, vague alerts, uneven support and complicated per-workload licensing, per Capterra reviewers of Cyber Protect Cloud

Source: Capterra, 78 reviews

The enterprise reference point: one policy engine across endpoint, email, web, network and cloud apps, with predefined policies for many regulations.

In the on-premises product you open the Data Security module of Forcepoint Security Manager and either switch on a predefined policy for your industry and region, configure a quick policy for a single channel (email, web or mobile), or run the policy wizard: general settings, condition (classifiers such as patterns and phrases, file properties or fingerprints of files and database fields), severity and action, source, destination, then deploy. Destinations include network and endpoint email, Office 365 and Box through the cloud API or proxy, web traffic, endpoint printing, the clipboard in applications and removable media. Even so, the documentation recommends starting with a permissive action and tightening after monitoring.

Users like

flexible rules, fingerprinting and pre-built rule sets as a starting point, per Capterra reviewers

Users dislike

cost for small companies, a console that isn't intuitive and hard agent rollout, per Capterra reviewers

Source: Capterra, 17 reviews