Theory: Data Loss Prevention & Privacy by Design
Knowing the law (7.3) does not, by itself, stop violations. Organizations need practical mechanisms that prevent data from leaking and prevent privacy problems from being designed into systems in the first place. This lesson covers two of them: Data Loss Prevention (DLP), which stops sensitive data from leaving, and Privacy by Design, which builds privacy in from the start instead of bolting it on.
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is the set of policies and processes that prevent sensitive data from leaving the organization without authorization.
Why DLP exists: the insider threat
Recall the opening question of this week (see 7.1): a MediCare Plus staff member who is allowed to view patient records sells them. Access control let her in, correctly. Many confidentiality and privacy failures come from people who already have legitimate access: careless staff emailing files to personal accounts, or malicious staff copying data before they leave. DLP covers the gap that access control leaves: it watches what happens to data after access is granted.
Diagram loads as you scroll.
DLP policy examples (MediCare Plus)
- No patient data on personal USB drives.
- No export via personal email or personal LINE.
- Approval required before bulk data export (for example, exporting thousands of patient records to a spreadsheet).
Monitoring, done right
To enforce DLP, organizations may monitor data use (what is copied, sent, uploaded). But employees have privacy too, so monitoring must be balanced against employee privacy:
| Done right | Done wrong |
|---|
| Clear, disclosed policy: staff know what is monitored and why | Covert surveillance: secret monitoring nobody was told about |
| Focused on sensitive data movement | Reading all personal messages “just in case” |
| Proportionate to the risk | Excessive collection about employees (itself a privacy violation) |
Common mistake: “More monitoring is always more secure.” Monitoring is itself processing of employees’ personal data. Hidden or excessive monitoring trades a confidentiality problem for a privacy problem. Monitoring must be disclosed and proportionate.
DLP depends on classification
DLP only works well when classification (see 7.2) is already in place: you cannot monitor what you have not labeled as sensitive.
If the patient spreadsheet carries no “Restricted” label, a DLP rule like “block Restricted data from leaving via personal email” has nothing to match. Classification first, then DLP.
Privacy by Design
Privacy by Design: build privacy in from the start of a system or process, rather than patching it on afterward.
The concept comes from Ann Cavoukian. The lecture’s selected principles:
| Principle | Meaning | MediCare Plus example |
|---|
| Proactive, not reactive | Prevent privacy problems before they happen, rather than responding after a breach | Review the new booking system’s data flows before launch, not after a complaint |
| Privacy as the default setting | The person is protected without having to do anything; the most private option is the default | Marketing messages are off unless the patient opts in |
| Privacy embedded into design | Privacy is part of the system’s core design, not an add-on | The database simply has no field for data the purpose does not need |
| End-to-end security | Data is protected across its whole lifecycle, from collection to destruction | Booking data is encrypted when stored and sent, and deleted when no longer needed |
Example: a new online booking system for MediCare Plus should collect only what is needed for the appointment (name, contact details, preferred time, reason for visit), not require a national ID number “just in case”. This one design decision applies data minimization (PDPA, 7.3) automatically: data never collected can never leak.
Exam tip: DLP and Privacy by Design work at different times. Privacy by Design acts at design time (don’t collect or expose data needlessly). DLP acts at run time (stop sensitive data that exists from leaving). A strong answer usually recommends both.
Week 7 at a Glance
Diagram loads as you scroll.
Classification tells us what is sensitive; the lifecycle tells us where it is at risk; PDPA/GDPR tell us what is legally required; DLP and Privacy by Design are how we prevent violations in practice.
Worked Examples
Exercise 1
Revisit the opening question: a MediCare Plus staff member who is allowed to view patient records copies them to a personal USB drive and sells them. Explain why this is an insider threat, and list three DLP measures that could have prevented or detected it.
Show solution ↓Hide solution ↑
Solution
Step 1: Why insider threat? The person had legitimate access through her role. The threat came from inside the trust boundary, so access control (which only checks who gets in) could not stop it.
Step 2: DLP measures, which act on data after access is granted:
- Block personal USB drives on hospital workstations (policy: no patient data on personal USB drives).
- Require approval before bulk export, so copying a large set of patient records triggers a review.
- Disclosed monitoring of sensitive-data movement, alerting security when Restricted data is copied to removable media or sent to personal email or LINE.
These only work if patient records are labeled Restricted (classification first).
Answer: it is an insider threat because the attacker had legitimate access; DLP measures include blocking personal USB drives, approval for bulk export, and disclosed monitoring/alerting on movement of classified sensitive data.
Exercise 2
MediCare Plus’s IT manager proposes secretly installing software that records every keystroke and screenshot on all staff computers to “catch data leaks”. Evaluate this proposal against the lecture’s guidance on monitoring.
Show solution ↓Hide solution ↑
Solution
Step 1: Is monitoring allowed? Yes, organizations may monitor data use to enforce DLP.
Step 2: Is this monitoring “done right”? No, on two counts:
- It is covert: staff are not told. The lecture requires a clear, disclosed policy, not covert surveillance.
- It is excessive: keystrokes and screenshots capture staff’s personal messages, passwords and unrelated activity. That is over-collection of employees’ personal data, itself a privacy violation.
Step 3: A better design. Publish a DLP monitoring policy; monitor movement of sensitive (classified) data, such as bulk exports, USB copies and uploads to personal email or LINE, rather than everything staff do.
Answer: reject the proposal as written; monitoring must be disclosed and proportionate. Replace it with a published DLP policy that monitors the movement of classified sensitive data, balancing security with employee privacy.
Exercise 3
MediCare Plus buys an expensive DLP product, but it fails to flag a spreadsheet of 4,000 patients that is emailed to an outside address. Investigation shows no hospital file carries any classification label. What is the underlying problem, and what should be done first?
Show solution ↓Hide solution ↑
Solution
Step 1: How does DLP decide what to block? By matching rules against data identified as sensitive, for example “block Restricted data leaving via external email”.
Step 2: Why it failed. Nothing was labeled, so the spreadsheet looked like any other file. You cannot monitor what you have not labeled as sensitive.
Step 3: What to do first. Put data classification in place: define levels (Public, Internal, Confidential, Restricted), label patient data Restricted, then write DLP rules against those labels.
Answer: DLP depends on classification; with no labels it cannot recognize sensitive data. Classify and label data first (patient data as Restricted), then configure DLP rules on those labels.
Exercise 4
MediCare Plus is designing a new online booking system. The draft requires national ID number, home address, religion and occupation, and marketing emails are pre-ticked “Yes”. Apply Privacy by Design: which principles are broken, and how should the design change?
Show solution ↓Hide solution ↑
Solution
Go through the principles:
- Privacy embedded into design / proactive: the form collects data the booking does not need (national ID, religion, occupation; home address is also unnecessary just to book). Fix it in the design now, before launch. Collect only name, contact details, preferred time and reason for visit.
- Privacy as the default: pre-ticked marketing consent means the patient must act to protect their privacy. The default must be off (opt-in).
- End-to-end security: ensure the collected booking data is protected throughout its lifecycle (secure storage and transmission, deletion when no longer needed).
This also satisfies PDPA’s data minimization and consent principles (see 7.3).
Answer: the draft breaks privacy-embedded-into-design (over-collection) and privacy-as-default (pre-ticked marketing); redesign to collect only appointment-necessary fields, make marketing opt-in, and protect booking data end to end.
Exercise 5
For each measure, state whether it is mainly Privacy by Design or DLP:
- A rule that blocks files labeled Restricted from being uploaded to personal cloud storage.
- Designing the patient portal so that test results are hidden from the main screen by default.
- Requiring manager approval before anyone exports more than 500 patient records.
- Removing the “religion” field from the registration form during system design.
Show solution ↓Hide solution ↑
Solution
Ask: does the measure act at design time (shaping what is collected or exposed) or at run time (stopping existing sensitive data from leaving)?
- Stops existing Restricted data leaving via an unauthorized route at run time. DLP.
- Builds protection into the design; privacy is the default setting. Privacy by Design.
- Controls bulk data leaving through export, at run time. DLP.
- Avoids collecting unnecessary data at design time. Privacy by Design.
Answer: 1 = DLP, 2 = Privacy by Design, 3 = DLP, 4 = Privacy by Design.