Data Loss Prevention (DLP) Policy Template: Free Word + PDF

A data loss prevention (DLP) policy says which data needs protecting, how each kind may be stored and shared, which channels are allowed, what your DLP tools check, and what happens when data gets out. This free template gives you that policy as an editable Word document with 17 sections, written for a company of 50 to 1,000 people.

Every decision sits in [brackets], with a default you can keep or change. The download also includes a PDF guide with worked examples and an Excel tracker for your data inventory, DLP rules, incidents with a notification clock, exceptions, device controls and training, mapped to NIST SP 800-53, ISO/IEC 27001, CIS Controls, PCI DSS and GDPR.

Download the DLP policy template

What Is a Data Loss Prevention Policy?

A data loss prevention policy, or DLP policy, is a document approved by management that sets the rules for keeping sensitive data inside the company. It names the data that matters, gives each data set an owner and a class, lists the approved ways to store and share it, sets the endpoint controls, and says what the DLP tools do when a rule matches. The tool settings and rule details change often, so they live in runbooks and in the tracker.

Data leakage and data loss are close but not the same: leakage is data reaching someone who should not have it, while loss also covers data you can no longer reach, such as a lost laptop. That is why some teams call it a data leakage prevention policy. This template covers both.

"DLP policies" can also mean the individual rules inside a DLP tool, such as "block emails with card numbers to outside addresses". The policy document sets the rules for those rules: who owns them, how they go live and how false positives are handled. Appendix B of the template gives you nine starter rules.

What a DLP Policy Template Should Cover: 17 Sections

The template has 17 sections in four parts: setting the rules, knowing your data, controlling each channel, and watching and responding.

1. Purpose: what the policy protects against, and leakage versus loss.
2. Scope: endpoints, email, chat, cloud and SaaS, removable media, printing and network egress.
3. Roles and responsibilities: policy owner, DLP lead, data owners, privacy lead, IT, managers and users.
4. Data classification and handling: four classes, labels, the data inventory and retention.
5. Approved channels and storage: which tools are approved for files, email, chat, transfers and AI, and which are not.
6. Endpoint controls: enrollment, disk encryption, USB storage blocks, screen lock, updates, app control and lost devices.
7. Personal devices and remote work: what personal devices may reach, managed apps, and working in public places.
8. Email and web: outside email by class, auto-forwarding, email DLP and uploads to personal services.
9. Cloud and SaaS sharing: internal-by-default sharing, expiring links, sharing reviews and third-party app consent.
10. Printing and physical copies: printing Restricted data, clear desks, shredding and device disposal.
11. Monitoring and DLP tooling: what a DLP tool does, the Monitor, Warn and Block modes, false positives and privacy.
12. Incident handling and breach notification: containment steps, severity levels and the hand-off to the privacy lead.
13. Exceptions: who can accept risk, for how long and with which compensating controls.
14. Training and awareness: training on hire and every year, policy acknowledgement and role-based training.
15. Enforcement: what happens when someone breaks the policy, and why honest mistakes get reported.
16. Review: a yearly review and the events that trigger an early one.
17. Definitions: DLP, leakage, detector, false positive, managed app, personal data breach and more.

Appendices add a classification and handling matrix, a DLP rule-set starter, an exception request form and a framework mapping table.

Where Data Leaves, and Which Control Covers It

Most data leaves through ordinary channels: an attachment to the wrong address, a sharing link set to "anyone", a file copied to a USB drive, a lost laptop. No single tool covers all of them. Content inspection, the part that recognises a card number in an email or a spreadsheet of customer data in a shared folder, needs a DLP tool or the DLP features in your email and cloud suite. Both Microsoft Purview and Google Workspace include DLP rules in some plans, so check your licence before you buy a separate product.

Device management covers the endpoint: disk encryption, USB storage blocks, screen lock, managed apps on phones, and lock or wipe when a device goes missing. People and process cover the rest, such as printing, sharing reviews and reporting a misdirected email at once. If you don't have a DLP tool yet, do sections 4 to 10 first and add content rules when a tool is in place.

Data Classification and Handling Rules

Four classes are enough for most companies: Restricted (card numbers, national IDs, health records, keys, core source code), Confidential (personal data, contracts, customer lists), Internal and Public. Every data set gets an owner and one class, and a file with mixed data takes the highest class.

The class only matters if it changes what people may do. Appendix A of the template turns the classes into a handling matrix. Here are five of its ten rows:

Record each Restricted and Confidential data set in the tracker's Data inventory tab, with the systems it lives in and the DLP rules that protect it. The Dashboard counts the sensitive data sets that have no rule yet.

DLP Rules: Monitor, Warn and Block

A DLP rule pairs a detector (a pattern, keyword list, sensitivity label or document fingerprint) with a channel and an action. Turning every rule on in Block mode on day one stops real work and teaches people to work around the tool. Microsoft's own guidance is to run new policies in simulation mode first and use policy tips to warn users before moving to more restrictive modes. The template uses three vendor-neutral modes:

• Monitor: the match is logged and the user sees nothing. Every new rule starts here for at least [30] days.
• Warn: the user sees a notice and can go on with a reason, which is logged. Good for Confidential data and for rules that still match some harmless content.
• Block: the action is stopped, and only an approved exception lets it through. Use it for tuned rules on Restricted data.

False positives decide when a rule moves up. Review new matches every week, record matches and false positives per rule, and tune (add nearby keywords, raise the count, exclude test data). A rule moves up only when its false-positive rate stays below [10%] for two reviews. The tracker's DLP rules tab calculates the rate and flags each rule as Tuning, Ready to move up, At target or Too noisy.

These are the nine starter rules in Appendix B:

Tell staff that DLP checks company email, files and devices, limit who can read alert content, and check local law and any works council agreements before you monitor.

DLP Policy Example: Sample Clauses and Two Incidents

A clause that says "sensitive data must be protected" gives an auditor nothing to test. Each clause should name the data, the channel, the action and a number. Six from the template:

• Email: "Restricted data is not sent by email outside the company, except encrypted to recipients the data owner approves."
• Cloud sharing: "Sharing outside the company is to named people, with an expiry date. Public links are for Public data only."
• USB: "Company devices block USB storage and other removable media, except company encrypted drives for approved users."
• Lost devices: "Lost or stolen devices are reported within [1 hour] of noticing. IT locks the device or wipes it remotely, and records whether it was encrypted."
• Rules: "A rule moves from Monitor to Warn or Block only after its false-positive rate is below [10%] for [two] reviews in a row."
• Training: "New starters complete data handling and DLP training within [30 days] and acknowledge this policy before they get access to Restricted data."

Two worked examples show how the policy plays out. In the first, a sales rep leaves a company laptop on a train and reports it within the hour. The device inventory shows BitLocker and screen lock on. IT sends a remote wipe and logs a High incident, and the privacy lead records it as a personal data breach that is unlikely to result in a risk, because the data was encrypted. The EDPB's breach examples include a similar case: stolen encrypted tablets, no notification needed, but the breach is still documented. With encryption off, the same laptop could mean notifying the regulator within 72 hours and telling every customer on it.

In the second, a spreadsheet with 300 customer email addresses goes to the wrong outside address. Rule DLP-07 is still in Monitor mode, so it only logs the match. The sender reports it, the recipient confirms deletion in writing, and the incident is logged as Medium. The review moves DLP-07 to Warn, so the next sender sees a notice before the email goes.

Incidents and Breach Notification

Section 12 of the template sets the response: contain (remove the link, recall the message, disable the account, lock or wipe the device), assess (what data, which class, how many people, was it encrypted), grade the severity and log it. If personal data is involved, the privacy lead takes over the notification decision at once.

Under GDPR Art. 33, the supervisory authority must be notified without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to people. Art. 34 requires telling the people affected when the risk to them is high, unless measures such as encryption made the data unintelligible. Every breach is recorded, notified or not. Card data, health data and other laws have their own notice rules; the template leaves them in brackets for you to fill in. The tracker's Incidents tab calculates the deadline from the time you became aware and shows the hours left.

How to Create a DLP Policy: A Seven-Step Project Plan

A small team can get from nothing to working DLP in about a quarter if it goes in this order:

1. Build the data inventory. List each sensitive data set, its owner, its class and the systems it lives in. Start with finance, HR, customer data and source code.
2. Fill in the brackets. Tools, approved channels, deadlines and review cycles.
3. Turn on the endpoint basics. Disk encryption, screen lock and USB storage blocks on every company device. The tracker's Device controls tab tracks coverage per platform.
4. Fix sharing defaults. Internal-only sharing by default in cloud storage, expiring outside links, and auto-forwarding to outside addresses turned off.
5. Load the starter rules in Monitor mode. Use your DLP tool's built-in detectors where they exist, and tune for 30 days.
6. Approve, train and publish. Staff need three rules above all: handle data by its class, use approved channels only, and report mistakes at once.
7. Move tuned rules up and run the calendar. Rule reviews, sharing reviews, device checks, training and the yearly policy review each have a row in the Review calendar tab.

If you also need a policy for the cloud services your data sits in, our cloud security policy template covers vendor approval, identity and logging. For a wider look at DLP strategy on mobile devices, see data loss prevention with MDM.

Framework Mapping: NIST, ISO 27001, CIS Controls, PCI DSS and GDPR

Each section of the template maps to five frameworks by ID, so you can show an auditor where a control lives in your policy:

• NIST SP 800-53 Rev. 5: AC-4 (information flow enforcement), SC-7(10) (prevent exfiltration), SI-4 (system monitoring), the media protection family MP-2 to MP-7, and AC-19 for mobile devices.
• ISO/IEC 27001:2022: Annex A control 8.12, data leakage prevention, was new in the 2022 edition. Controls 5.12 to 5.14 cover classification, labelling and information transfer, 7.10 storage media and 8.1 user endpoint devices.
• CIS Controls v8.1: Control 3, Data Protection, has 14 Safeguards. Safeguard 3.13, deploy a DLP solution, is in Implementation Group 3 only. The six IG1 Safeguards (data management process, data inventory, access lists, retention, disposal and encryption on end-user devices) are the place to start.
• PCI DSS v4.0.1: if you handle card data, 3.4 restricts display and copying of card numbers, 4.2 protects them in transit, 9.4 covers media and 12.10 incident response.
• GDPR: Art. 32 asks for security fit for the risk and names encryption; Arts. 33 and 34 cover breach notification.

The IDs point to the source documents; check the current official text before you rely on a mapping. For framework checklists, see our ISO 27001 checklist and GDPR compliance checklist.

DLP Audit Evidence Checklist

When an auditor or a customer asks how you prevent data leakage, expect to show:

• The approved policy, with its version, owner and last review date
• The data inventory, with owners and classes
• The DLP rule register: rules, modes and false-positive reviews
• Device reports: encryption, screen lock and USB storage blocks
• The incident log, with notification decisions
• A record of every personal data breach
• The exception register, with expiry dates
• Training completion and policy acknowledgements

The Excel tracker keeps all of this in one file, and its Dashboard counts what's missing: sensitive data sets with no rule, rules too noisy to keep, notices overdue, device controls below target and expired exceptions.

Get the DLP policy template (Word, PDF + Excel)

Where trio.so Fits

trio.so is not a DLP tool. It doesn't inspect files or messages, classify your data, block uploads or watch data moving through email, web and cloud apps. A DLP policy needs a DLP tool for that, or the DLP features in your email and cloud suite. trio.so handles the endpoint controls around it, and if you run Forcepoint DLP, it puts Forcepoint's incidents on the device record.

It is device management for Windows, macOS, iOS and Android, from one console. For a DLP policy, it covers:

• A device inventory for Windows, macOS, iOS and Android that lists hardware and installed apps, so you know which devices hold company data (section 2, 6).
• Disk encryption enforcement: BitLocker on Windows, FileVault on Mac and encryption on phones, with encryption status per device (section 6).
• USB storage blocking on Windows and Linux (section 6).
• Passcode and screen lock policies (section 6, 7).
• Managed open-in and managed pasteboard settings on iPhone and iPad, which stop work documents and copied work text moving from managed apps to unmanaged ones (section 7).
• OS update status for each device, with vulnerability findings scored by CVSS, EPSS and CISA's KEV catalog (section 6).
• Remote wipe for lost company-owned devices, and remote lock for a lost Mac, iPhone, iPad or Android device (section 6, 12).
• A Forcepoint DLP integration that imports incidents from Forcepoint Security Manager 8.9 or later on a schedule, links each one to the managed device, lets admins acknowledge, escalate or close it, and alerts on high-severity incidents (section 11, 12).
• A Microsoft Defender for Endpoint integration that shows Defender's devices and open alerts next to each device (section 12).
• Console roles, so each admin gets only the access they need (section 3).
• A compliance engine with templates for SOC 2, ISO 27001, PCI DSS, NIST SP 800-53 and 800-171, CIS, NCA ECC and SAMA CSF. It is off by default; you turn on the frameworks you need and export the evidence for your auditor (section 16).

Plans start at $5 per device.

Start free trial Book a demo

14-day free trial. No credit card required.

Sources. Last reviewed October 2026. Framework names and control IDs identify their publishers' documents; descriptions are our own summaries. trio.so is not affiliated with or endorsed by NIST, ISO, IEC, CIS, PCI SSC, the European Union, Microsoft, Google or Forcepoint. This article is guidance, not legal advice. The bracketed defaults are our recommendation, not a requirement of any framework.

• NIST SP 800-53 Rev. 5, Security and Privacy Controls (release 5.2.0)
• NIST SP 800-53 Rev. 5 OSCAL catalog (control IDs and titles)
• ISO/IEC 27001:2022, Information security management systems: Requirements
• CIS Critical Security Controls v8.1
• PCI DSS v4.0.1, PCI Security Standards Council document library
• Regulation (EU) 2016/679 (GDPR), Articles 4, 32, 33 and 34
• EDPB Guidelines 01/2021 on examples regarding personal data breach notification (v2.0)
• Microsoft Learn, Learn about data loss prevention
• Google Workspace Admin Help, Protect your data with data loss prevention