How to set up data loss prevention (DLP) policies in Microsoft Purview

On a Tuesday afternoon in September, a leasing coordinator at a 20-person property management company in Queens emailed a building owner the applications for a vacant two-bedroom, so he could choose a tenant. She typed “Dan” in the To line and Outlook offered two addresses. She picked the first one. It belonged to a painting contractor the company had hired that summer, who had the same first name and also used Gmail.

The attachment was a 31-page PDF with five applications in it. Each one had the applicant’s Social Security number, date of birth, employer, and bank details, and most ended with a phone photo of a driver’s license. The painter called the office the next morning to say he’d gotten something he probably shouldn’t have, and that he’d deleted it.

The company’s lawyer took the owner through New York’s breach notification law. Someone whose job involved those applications had sent them to the wrong person by accident, and the painter had deleted them, so the lawyer thought the company could reasonably conclude the five applicants weren’t likely to be harmed. That meant no letters to the applicants, but a written record of the decision, kept for five years. The owner’s next call was to the company’s IT provider, to ask whether Microsoft 365 could have caught the email before it went.

Partly. Microsoft Purview DLP can’t tell one Dan from another. What it can do is notice that an email is leaving the company with Social Security numbers in it, warn the sender while the message is still open, encrypt it on the way out, or hold it until the sender gives a reason. For a mistake like this one, the warning helps most, because it makes the sender look at the To line again.

DLP at a glance

Question	Answer
What does a DLP policy do?	It looks for sensitive information, like Social Security, credit card, and bank account numbers, in email and files, and warns, encrypts, or blocks before that information leaves in a way you haven’t allowed.
Which plans include it?	Business Premium and the E3 and E5 plans cover email, SharePoint, and OneDrive, including files shared in Teams. Business Basic and Business Standard don’t include DLP.
Does it need sensitivity labels?	No. It reads the content itself, so it works on files and email nobody labeled. It can act on a label too, when there is one.
Can people get past a block?	Only if the rule allows it. A rule can let people override a block and ask them for a reason, which is saved with the event.
How do I test a policy without disrupting anyone?	Run it in simulation mode. It records what it would have done, and nobody sees a thing unless you also turn on policy tips.
Does it read scanned documents and photos?	Not until you turn on optical character recognition, which is billed per image through an Azure subscription.
How long does setup take?	A first policy takes an afternoon to build, then two to four weeks of simulation and adjusting before it blocks anything.

What a DLP policy is

A DLP policy has three parts: where it looks, what it looks for, and what it does when it finds something. Where it looks is the policy’s locations, like Exchange email, SharePoint sites, and OneDrive accounts. The rest lives in rules. Each rule pairs conditions, such as “contains at least one Social Security number” and “is going to someone outside the organization,” with actions, such as showing a warning, encrypting the message, or blocking it. One policy can hold several rules, so it can warn about a single Social Security number and block a message carrying fifty.

In email, DLP checks the subject, the body, and the attachments, including Word, Excel, PowerPoint, and PDF files. The check runs in Microsoft’s mail service after someone clicks Send, so it applies whatever app or phone they send from. In SharePoint and OneDrive, DLP checks files when they’re uploaded, changed, or shared, and it also works through files already stored there. Files shared in Teams chats and channels are stored in SharePoint and OneDrive, so those are covered too.

DLP is the part of Purview that works on data nobody has labeled. A client list exported from another system a minute ago has no sensitivity label, but it still has Social Security numbers in it, and DLP reads those. Where labels are in place, a rule can use them as well, for example to block anything labeled Highly confidential from leaving. The Purview overview shows where DLP sits next to labels, audit, and retention, and the sensitivity labels guide covers the labeling side.

What your Microsoft 365 plan includes

Capability	Business Premium or E3	Microsoft 365 E5
DLP for Exchange email, SharePoint, and OneDrive, including files shared in Teams	Yes	Yes
Policy tips, email notifications, and overrides with a reason	Yes	Yes
Simulation mode	Yes	Yes
Custom sensitive information types	Yes	Yes
An alert each time a rule matches	Yes	Yes
Alerts on a threshold, like 10 matching emails in 48 hours	No	Yes
DLP for Teams chat and channel messages	No	Yes
DLP on Windows and Mac computers, like copying to a USB drive, printing, or pasting into a website	No	Yes
Activity explorer, which lists DLP events alongside other activity on sensitive data	No	Yes
Keeping Copilot from using files and email with certain sensitivity labels	No	Yes
Reading text in images and scanned PDFs	Pay as you go	Pay as you go

The Purview add-on for Business Premium, at a list price of $10 per user per month, adds DLP for Teams chat and for computers. Business Basic and Business Standard don’t include DLP, and our licensing guide compares the plans.

One newer feature isn’t limited to E5. Microsoft lets DLP check what people type into Copilot prompts for sensitive information on Business Premium and E3 as well, for anyone using Microsoft 365 Copilot or Copilot Chat. The Copilot guide covers what else to configure before a rollout.

Plan the policy before you open the portal

Write the rule down in one sentence

Microsoft calls this a policy intent statement, and it’s the quickest way to find out whether everyone in the room wants the same thing. For example: “Email with Social Security or driver’s license numbers is encrypted whenever it leaves the company, and a message with ten or more Social Security numbers can’t go to a personal email address at all.” Most of the policy’s settings come straight out of a sentence like that, so it’s worth arguing over the wording before anyone opens the portal.

List who already receives that data for good reasons

Before you block anything, find out where sensitive information goes today for legitimate reasons. In most small businesses it’s a short list: a payroll service, an outside accountant, a benefits broker, a bank or lender, a background screening company, and clients who send and receive their own records. The owner and the office manager can usually name most of them, and the simulation run finds the others.

Decide what each rule should do

DLP gives you a range of responses, from invisible to strict:

• Audit only. Nothing changes for the person, and the match is recorded.
• Show a policy tip. A warning appears in Outlook while the email is being written, or on the file in SharePoint and OneDrive. The person can still send or share.
• Encrypt the email. The message leaves encrypted. People outside the business read it in Microsoft’s secure viewer after signing in or entering a one-time code.
• Block with override. The email or file is stopped unless the person overrides the block, and the rule can require a reason.
• Block. Nobody gets past it.

In a typical small business, most rules encrypt or warn, and only a few block.

The sensitive information types that do the detecting

Purview finds sensitive data with sensitive information types, Microsoft’s built-in detectors for things like U.S. Social Security numbers, credit card numbers, U.S. bank account numbers, ABA routing numbers, U.S. driver’s license numbers, and passport numbers. There are hundreds of them, most for other countries. Each pairs a pattern, like nine digits, with checks that make a match more likely to be real, such as nearby keywords or a checksum.

The Social Security number type is the one most small businesses start with, and it’s stricter than people expect. It only counts a nine-digit number when a word like SSN, Soc Sec, or social security number appears within 300 characters of it. Dashes or spaces in the number raise the confidence. A number typed into an email on its own, with no label near it, isn’t detected.

The keyword rule is usually fine for application forms, W-2s, and W-9s, which label the field. Long spreadsheets are where it falls down. If the only “SSN” in a file is the column heading in the first row, Microsoft’s own troubleshooting guidance points out that only the first few rows are likely to fall within the 300 characters, so a list of 400 people can count as a handful of matches, or none. Before you trust a threshold, open Information Protection, then Classifiers, then Sensitive info types, select the type, and use Test to upload one of your own files. Use a copy with the real numbers replaced by made-up ones in the same format.

Each type comes with a recommended confidence level, usually medium, and lowering it catches more and gets more wrong. For Social Security numbers the trade is often worth it. Since mid-2011, the Social Security Administration has assigned numbers at random, and many of those fail Microsoft’s older checks and match only at low confidence, so a rule left at medium can miss them. For a rule that has to catch every applicant or employee, set the type to low and expect a few more false matches.

The instance count decides how many unique matches it takes for a rule to fire, so a rule can act on one Social Security number or only on ten or more. The same number in several attachments of one email counts once.

Templates are a starting point

When you create a policy, Purview offers templates grouped under Financial, Medical and health, and Privacy. For a business holding personal information, U.S. State Breach Notification Laws is a reasonable start. It looks for credit card, bank account, driver’s license, Social Security, and passport numbers, plus medical terms, in content shared outside the organization. It comes with two rules: one to nine matches sends a notification, and ten or more blocks the content with an override, asks for a reason, and sends an incident report. If Social Security numbers are your only concern, U.S. State Social Security Number Confidentiality Laws has the same two rules for that type alone. Healthcare businesses usually start with the HIPAA template.

Expect to edit the rules. Remove types you don’t hold, change the actions to match your one-sentence rule, and add the exceptions simulation turns up.

When to build a custom sensitive information type

Build your own type when the data you care about has a format Microsoft doesn’t know, like an insurance agency’s policy numbers, a law firm’s matter numbers, a staffing agency’s candidate IDs, or a billing company’s patient account numbers. A keyword list works too, for documents defined by their words more than by any number.

1. In the Purview portal, open Information Protection, then Classifiers, then Sensitive info types, and select Create sensitive info type.
2. Enter a name and a description your staff would recognize, then select Create pattern.
3. Choose the primary element. It can be a regular expression, a keyword list, a keyword dictionary, or one of Microsoft’s built-in functions.
4. Set the character proximity, and add supporting elements, like a keyword list of “policy no”, “policy number”, and “pol #”, that have to appear nearby for a higher-confidence match.
5. Choose a confidence level for the pattern and for the type, then save.

If you write a regular expression, leave out the ^ and $ anchors and keep to a single capturing group, which is what Purview’s validation expects. Microsoft’s support team won’t write the expression for you, so run it through Test with real samples before a policy depends on it.

You can also copy a built-in type and edit the copy, for instance to add the label your own forms use, like “SS No.” Most types can be copied, but the U.S. driver’s license number type can’t. A new or changed type is used for new email and files, but files already in SharePoint and OneDrive are only checked against it once they’re crawled again, which you can request for a site or a library.

Create the policy in the Purview portal

You’ll need an admin role such as Compliance Administrator or Information Protection Admin. Sign in at purview.microsoft.com and open Data loss prevention.

1. Start the policy. Go to Policies, select Create policy, and choose Enterprise applications & devices. The other choice, Inline web traffic, is for browser and network controls most small businesses don’t start with.
2. Pick a template or Custom. Choose a category and a template, or Custom for both if you’d rather build the rules yourself.
3. Name it. Use the one-sentence rule as the description, and pick a name you’ll still understand in a year, like “Personal ID numbers leaving the company.” Renaming a policy later is limited.
4. Leave the admin units at the default, which applies the policy to everyone.
5. Choose the locations. Select Exchange email, SharePoint sites, and OneDrive accounts. Leave Teams chat and channel messages and Devices off unless you’re licensed for them. Each location can include or exclude specific mailboxes, groups, or sites. A policy with several locations only offers the conditions they share, and some useful email conditions, like Recipient domain is and Sender is a member of, don’t exist for SharePoint or OneDrive. Put email rules that need them in an email-only policy.
6. Choose the rule settings. On Define policy settings, keep Create or customize advanced DLP rules selected.
7. Set the conditions. Edit a template rule or select Create rule. Under Conditions, add Content contains, then Sensitive info types, choose the types, and set the instance count and confidence. Add a second condition, Content is shared from Microsoft 365, with people outside my organization, so internal email is left alone.
8. Set the action. Add Restrict access or encrypt the content in Microsoft 365 locations. For email, that’s where you choose to encrypt the message, or to block it for everyone or only for people outside your organization. An email-only policy also offers mail-handling actions, like forwarding the message to the sender’s manager for approval, adding a recipient on Bcc, or adding text to the subject line.
9. Turn on user notifications. Set the toggle on, choose to notify the person who sent or shared the content, and turn on policy tips with your own wording.
10. Decide on overrides. Under User overrides, allow overrides from Microsoft 365 apps and services if the rule blocks, and require a business justification.
11. Set up incident reports. Choose a severity and who gets an alert. Leave matched content out of incident report emails, for the reason covered under policy tips below.
12. Put the rules in order. Rules run in the order they were created, and you can move them. When an email matches more than one rule, the first one with the most restrictive action is the one enforced, and a block stops Purview from checking the rest. Put your strictest rule first.
13. Choose the mode. Select Run the policy in simulation mode. Leave Show policy tips while in simulation mode off for now, and leave Turn the policy on if it’s not edited within fifteen days of simulation unticked, so nothing starts enforcing on a day nobody picked. Submit.

A policy you turn on starts working within about an hour. Alerts can take up to three hours to appear after you set them up or change them.

Test it in simulation mode

Simulation mode runs the policy as if it were enforced, records every match, and does nothing to anyone. It replaced the older Test modes.

To see the results, go to Data loss prevention, then Policies, select the policy (its status reads In simulation), and choose View simulation. There are three tabs:

• Simulation overview shows how many items were scanned and matched in each location.
• Items for review lists the matched items, and you can open each one to see what matched. For SharePoint and OneDrive it shows up to 100 items per site for each rule, so it may not list every match.
• Alerts shows the alerts the policy would have raised. These stay on this tab and don’t appear in the main DLP alerts or the Microsoft Defender portal.

Simulation treats the locations differently. In SharePoint and OneDrive it checks files already stored there as well as new ones, so you’ll find old folders full of personal data you’d forgotten about. In email it only sees messages sent while the simulation runs. Results are kept for 30 days.

Run the simulation long enough to cover a payroll run and a month-end, which usually means two to four weeks. Then go through the matches with whoever knows the work:

• Legitimate email to outside recipients. Decide whether encryption is enough for it, or whether a recipient’s domain needs its own exception.
• Things that shouldn’t have matched. Raise the instance count or the confidence, or remove a type you don’t need.
• Things that should have matched and didn’t. Send a test message with a made-up application, including a number in the post-2011 range, and try a long spreadsheet.
• Files sitting in the wrong place. Fix the sharing on old folders the scan finds.

When the matches look right, switch the policy to Run the policy in simulation mode and show policy tips while in simulation mode, and narrow it to a pilot group of three or four people. Exchange and OneDrive can be limited to specific people with the include option, while SharePoint is limited by site, so pick one or two sites the pilot group works in. They’ll see the warnings while nothing is enforced, and they’ll tell you which ones make no sense. After a week or two, choose Turn it on right away and widen the locations to everyone again.

Policy tips and overrides

A policy tip is the warning people see before anything happens. Outlook on the web and the desktop Outlook app show it above the recipients while the email is being written, whether the sensitive data is in the subject, the body, or an attachment. In SharePoint and OneDrive, a warning icon appears on the file, with details in the file’s information pane. Word, Excel, and PowerPoint show tips in the message bar for files stored in SharePoint or OneDrive. Outlook on phones and on Macs can show tips too, but that’s off by default and turned on with a separate admin setting, so test on the devices your staff use. The rule itself runs in the mail service either way, so a block holds on every device.

If an email or file matches several rules, people only see the tip from the most restrictive one, so they don’t get three warnings in a row.

Write tips the way you’d say them across the desk, in plain text of up to 256 characters. For example: “This email has Social Security or driver’s license numbers in it and is going outside the company. Check every address in the To line before you send. It’ll be sent encrypted.”

Overrides only exist on a rule that blocks. You can let people override with no questions, require a business justification, or let them report a false positive. In Outlook, they select Show Details, then Override, enter the reason, and send. The reason is saved in the audit log and shown on the alert, along with the fact that they overrode the policy. Microsoft notes that Outlook on the web only offers the override once the policy is turned on, so a pilot in simulation won’t show it.

Overriding the most restrictive rule also overrides every other rule the email matched. If the same message matched a rule that encrypts, it goes out unencrypted. Where data should never leave without encryption, give the blocking rule no override and tell people in the tip who can send it, the way the worked example below does.

Notification and alert emails are sent unprotected, so don’t attach the matching message to them or include the matched content in incident reports. An alert that quotes ten Social Security numbers puts them in a plain email to whoever reads the alerts.

If your Exchange admin center still has old mail flow rules with policy tips, Outlook keeps showing those and won’t show the Purview tips until the old ones are turned off.

How DLP works in each location

Exchange email. Encryption uses Microsoft Purview Message Encryption, which Business Premium includes. A block for everyone stops the whole message. A block for only people outside your organization behaves differently once policy tips are on: Outlook won’t send the message at all while external recipients are on it, so the sender has to remove them before it can go to anyone inside.

SharePoint and OneDrive. Blocking restricts who can open the file. Block everyone leaves access only to the file’s owner, the person who last changed it, and the site admin. Blocking only people outside your organization keeps it open to staff and stops guests and outside sharing links. When a file already holds the sensitive data on upload, sharing it outside is blocked from the start. For a file that picks up the data after it was shared, there can be a short gap before the block takes hold. The guest access guide covers the sharing settings to review alongside it.

Teams. Files shared in Teams fall under the SharePoint and OneDrive locations. Chat and channel messages are a separate location, and DLP can’t send email notifications for them.

Computers. Endpoint DLP covers Windows and Mac computers you’ve onboarded, and can stop a sensitive file from being copied to a USB drive or a network share, printed, or pasted into a website.

Scanned documents and photos

DLP only reads text, so a scanned form, a phone photo of a driver’s license, or an image of a pay stub looks empty until you turn on optical character recognition (OCR). Once it’s on, the same sensitive information types check images in Exchange, SharePoint, OneDrive, Teams, and computers.

OCR is billed pay as you go, through an Azure subscription in your tenant:

1. A Global or SharePoint admin connects the subscription in the Microsoft 365 admin center, under Setup, Activate pay-as-you-go services, and Document processing services.
2. A compliance admin then opens Settings in the Purview portal, selects Optical character recognition (OCR), and chooses the locations and the groups to scan.

Each image counts as one scan and each page of a scanned PDF counts separately, so a 30-page scanned PDF is 30 scans. Microsoft lists the price at $0.001 per scan, or $1 per 1,000, and has an OCR cost estimator on Microsoft Learn. Only images that arrive after you turn it on are scanned, and settings take about an hour to apply. For Exchange, an advanced setting limits OCR to email going outside the organization, which keeps the count down for most small businesses. Policy tips don’t appear for images in email, so the encryption or block still happens, but the sender gets no warning first.

Common DLP rules for small businesses

Situation	Rule	Action
Email leaving with Social Security or driver’s license numbers	One or more, shared with people outside the organization	Encrypt the message and show a tip
Large batches going to personal email	In an email-only policy, ten or more Social Security numbers, and the recipient domain is gmail.com, yahoo.com, outlook.com, hotmail.com, icloud.com, or aol.com	Block, with a tip saying who can send it encrypted
Card numbers in email	Any credit card number, inside or outside	Block, with a tip telling people where card details go instead
Health information in email	The HIPAA template’s types, shared with people outside the organization	Encrypt the message and alert the privacy officer
Files with personal data shared with guests	SharePoint and OneDrive, one or more Social Security numbers, shared with people outside	Block only people outside your organization
Files labeled Highly confidential	Sensitivity label is Highly confidential, shared with people outside	Block

Medical practices and other covered entities should read HIPAA cybersecurity requirements alongside the health information rule, since DLP is one part of what the Security Rule asks for.

A worked example

The property management company from the start is a composite, and the figures are illustrative.

The licenses. Twenty people on Business Premium. The only new cost was OCR.

The rule in one sentence. “Email with Social Security or driver’s license numbers is encrypted whenever it leaves the company, and only the office manager can send ten or more Social Security numbers to a personal email address.” The owner and the office manager went back and forth over five or ten before settling on ten, because building owners often ask to see every applicant for a unit.

The policies. Two, because the personal email rule needs conditions that only exist for email. The email policy covers Exchange only and has two rules, in this order:

1. Large batches to personal email. Ten or more Social Security numbers, a recipient domain on a list of consumer email services, and a sender who isn’t the office manager. The message is blocked with no override, and the tip asks the sender to pass it to the office manager.
2. Anything going outside. One or more Social Security or U.S. driver’s license numbers, sent to people outside the organization. The message is encrypted, with a policy tip.

When the office manager sends a large batch, the first rule doesn’t apply to her, so the second one encrypts it. The files policy covers SharePoint and OneDrive, and blocks people outside the organization from any file with a Social Security number in it that’s been shared outside.

The simulation. It ran for three weeks, which covered a payroll run and the first of the month. The email policy matched 54 messages. Twenty-three were application packets to building owners, most of whom use Gmail. Twenty-one went to the tenant screening company, which has an upload portal the leasing team had stopped using. Three were payroll files to the payroll service, and four were vendor W-9s to the outside accountant, carrying contractors’ Social Security numbers. The last three were coordinators replying to applicants who’d asked for a copy of their own application. The files policy found a folder of 2023 applications still shared with an owner who had sold his building two years earlier.

What changed. The IT provider’s test applications showed that a made-up number in the post-2011 range only matched at low confidence, so both email rules were set to low. The old folder’s sharing was removed the same day. Two owners on Gmail were sent encrypted test packets. One opened his without trouble. The other never found the one-time code, so his packets are now printed and handed to him at the building.

What simulation missed. None of the driver’s license photos matched, since they were images. The company turned on OCR for email going outside the organization only. At $0.001 per image, about 40 application packets a month comes to a few dollars at most.

What’s still open. The leasing team was asked to go back to the screening company’s portal. A month later, two of the four coordinators still email it, because the portal signs them out every 15 minutes.

The rollout. Three leasing coordinators had the policy tips for a week while the policies were still in simulation. One asked for the tip to say what “encrypted” means for the owner on the other end, and the text was changed to match. Then the policies were turned on for everyone. Setup took about 14 hours of the IT provider’s time, two hours of the owner’s, and three of the office manager’s.

What it doesn’t cover. The tip appears on every application email, which helps for the first few weeks and less once people are used to it. So the office manager also had each coordinator remove the painter and other one-off contacts from Outlook’s suggested addresses, which takes a click on the X beside each one. Files saved to laptops aren’t covered either, since that needs endpoint DLP, and the owner put it on next year’s list.

In the first month with the policies on, the large-batch rule stopped two emails. One was 14 applications for two units in a new building, which the coordinator forwarded to the office manager, who sent them on encrypted. The other was an old email thread a coordinator forwarded to an owner’s new Gmail address, with the spring’s applications still attached. She hadn’t noticed they were there.

DLP for New York businesses

Sequentur supports businesses across New York City and the surrounding area from our New York office. New York’s breach notification law, section 899-aa of the General Business Law, and the security requirements the SHIELD Act added in section 899-bb both affect how you set DLP up.

Keep the record the inadvertent disclosure exception asks for

New York doesn’t require notice to the people affected when an exposure was an inadvertent disclosure by people authorized to access the information, and the business reasonably determines it isn’t likely to lead to misuse or financial harm. That determination has to be in writing and kept for at least five years. If the incident affects more than 500 New York residents, the written determination goes to the attorney general within ten days.

DLP supplies much of what that record needs. An alert shows who sent the message, the recipients, the subject and attachment names, which sensitive information types matched, what the policy did, and whether the sender overrode a warning and what reason they gave. Save a copy when it happens. Alerts only stay in the portal as long as your audit log keeps its records, which is 180 days on Business Premium, and the law wants the determination kept for five years. Whether the exception applies to a given incident is a question for your lawyer.

What counts as private information

New York’s definition covers a person’s name or other identifying information together with a Social Security number, a driver’s license or non-driver ID number, an account or card number with the code needed to use it (or on its own, where it could be used without one), biometric data, or a username or email address with its password. Since March 2025 it also includes medical information and health insurance policy or subscriber numbers, which reach well past healthcare. An HR file with a doctor’s note counts, and so does a tenant’s request for a disability accommodation. If you hold either, consider a rule for medical terms next to your ID number rules.

Information that’s encrypted is left out of the definition, unless the key was taken too, which is one more reason to encrypt routine email that leaves with personal data. It doesn’t help with the wrong-Dan kind of mistake. The wrong recipient can open an encrypted message as easily as the right one.

When a breach does need notice, the people affected have to hear from you without unreasonable delay and within 30 days of discovery, and the attorney general, the Department of State, and the State Police get notice too. Our article on what a data breach costs a small business breaks down where the money goes once notices are needed.

The SHIELD Act’s security requirements

Section 899-bb asks every business holding New York residents’ private information to keep reasonable administrative, technical, and physical safeguards. A small business, meaning fewer than 50 employees, less than $3 million in gross annual revenue in each of the last three years, or less than $5 million in year-end assets, meets it with safeguards appropriate to its size and complexity, the nature of its work, and how sensitive the information is. The law doesn’t name DLP. A written DLP policy with its simulation results and the changes you made is good evidence of a safeguard chosen for the data you hold and then checked, and the same record helps with the DLP questions on cyber insurance applications. Businesses that comply with HIPAA, the Gramm-Leach-Bliley Act, or the DFS cybersecurity regulation are treated as meeting section 899-bb.

DFS-licensed businesses

If your business holds a license from the Department of Financial Services, as many insurance agencies, mortgage brokers, and money transmitters do, the DFS cybersecurity regulation, 23 NYCRR Part 500, applies as well. Section 500.15 requires encrypting nonpublic information in transit over external networks and at rest. Licensees that qualify for the limited exemption in section 500.19(a), with fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three years, or less than $15 million in year-end assets, are excused from that section. Exempt or not, every covered entity has to notify DFS within 72 hours of determining that a cybersecurity incident happened, and its notices under the state breach law go to DFS too. A DLP rule that encrypts nonpublic information leaving by email is a practical piece of section 500.15 in Microsoft 365. Whether a misdirected email is a reportable incident is a question for counsel.

Common mistakes

1. Leaving “Turn the policy on if it’s not edited within fifteen days” ticked. The policy starts enforcing on a day nobody chose.
2. Putting an override on a rule that sits above an encryption rule. The override skips the encryption too, and the email leaves unencrypted.
3. Keeping every type a template brings. Remove the ones you don’t hold, or most of what simulation shows you is noise.
4. Assuming DLP reads scans and photos. Without OCR, a photo of a driver’s license is invisible to it.
5. Allowing overrides and never reading the reasons. The reasons show which rule is wrong and who needs a conversation. Name who reads them each week, or have managed Microsoft 365 services cover it.

What is next in this series

The next article covers Microsoft Purview Compliance Manager: what it tracks, how the compliance score is worked out, which regulations it has assessments for, how to work through its improvement actions, and how to use its reports when an auditor or a client asks about your controls.

How Sequentur can help

If you’d like help writing your first DLP policy, or reading what a simulation found, schedule a call. For businesses in New York City and the surrounding area, we can run the planning session at your office, and our IT compliance services cover the SHIELD Act and DFS side of the work.