Data Protection

Data loss prevention (DLP)

Find the sensitive data you actually hold, decide what may leave and what may not, and deploy DLP that catches real exfiltration without drowning your team in false positives — built to evidence DPDP, GDPR, HIPAA and PCI DSS obligations.

What we typically deliver

Sensitive-data discovery and classification across endpoints, file shares, databases, email and cloud storage — including the copies nobody meant to keep.
Data-flow mapping: where regulated data enters, where it is processed, where it rests and where it crosses a border or a third party.
DLP policy design tied to real business processes, so the rules match how people legitimately work.
Tool selection and phased deployment across endpoint, network, email and cloud channels — starting in monitor mode.
Tuning, incident triage workflow and the evidence your regulator or assessor expects when data does move.

Why most DLP deployments disappoint

DLP has a reputation for being noisy and disliked, and the reasons are consistent enough to plan around:

It is deployed before discovery. Rules are written against assumptions about where regulated data lives. Discovery almost always finds it somewhere nobody listed — an analytics extract, a support attachment, a spreadsheet on a shared drive.
Blocking is switched on too early. Enforcement before tuning breaks a legitimate workflow within days, the exception list grows, and the policy quietly becomes advisory.
Alerts have no owner. A DLP console generating hundreds of daily events that nobody triages is a liability, not a control — you now have documented evidence you were told and did nothing.
Classification is treated as a labelling project. If classification does not change what the tooling does, it is decoration.

We sequence deliberately: discover, map, design, monitor, tune, then enforce. It is slower to switch on and considerably more likely to still be running in a year.

What is driving this for most of our clients

DPDP Act — you cannot honour erasure, retention or a breach assessment without knowing where personal data actually sits. See the DPDP compliance checklist.
GDPR — records of processing, transfers and the ability to answer a subject request at volume.
HIPAA — protected health information across clinical, billing and support systems.
PCI DSS — cardholder data outside the defined environment is the scope problem that inflates assessments. Our PCI data discovery service addresses that specific case.
Customer and contractual pressure — enterprise buyers increasingly ask what stops their data leaving on a laptop or into a personal account.

Why CyberSigma

We do the discovery, the design and the deployment — and we come at it from the assurance side, so the output is built to be evidenced. As a PCI SSC-listed QSA company and CERT-In empanelled auditor, we have spent a lot of time on the receiving end of “show me where this data is and prove it does not leave”, which is a different question from “is the DLP agent installed”.

Start with data discovery DPDP compliance services

Data protection depends on identity and access management — who can reach the data in the first place — and on third-party risk, since a great deal of regulated data now sits with processors rather than with you.

Free tool

PCI DSS Scope Checker

See if you’re in scope and your likely SAQ type or level — free, in under a minute.

Try it free →

DLP — common questions

Do you deploy DLP tooling or only advise on it?

Both. Engagements usually begin with sensitive-data discovery and policy design and continue into tool selection, phased deployment across endpoint, network, email and cloud, tuning and the incident workflow. You can also engage us for discovery and design alone if your team or an existing partner will deploy.

Which DLP products do you work with?

We are vendor-neutral. Selection follows the data, the channels that matter and the platforms you already own — many organisations have meaningful DLP capability inside their existing productivity or cloud suite and do not need a separate purchase to start.

Why start with discovery instead of deploying the tool?

Because policies written against assumptions miss the data that causes incidents. Discovery consistently finds regulated data in places nobody listed — analytics extracts, support ticket attachments, test environments seeded from production, and long-forgotten shared drives. That inventory is also what DPDP, GDPR and PCI scoping depend on, so the work is not DLP-specific effort.

Will DLP block our people from doing their jobs?

Not if it is sequenced properly. We run in monitor mode first to learn genuine business workflows, tune against what we observe, and only then move high-confidence rules to enforcement. Deployments that start in blocking mode are the ones that get switched off.

How does this relate to our DPDP or GDPR programme?

It is the operational half of it. Data inventory and flow mapping are what make erasure, retention, transfer and breach-scoping answerable rather than theoretical, and DLP is one of the controls that demonstrates the data is protected in practice. Most clients run them as one programme rather than two.