Christchurch · Dunedin · Nationwide
Data Loss Prevention Setup and Management
Exodesk sets up and manages data loss prevention in Microsoft 365 for New Zealand businesses. Our Christchurch and Dunedin teams agree which information matters, where it is used and which actions should be allowed, warned about or restricted.
Available to any business, whether or not Exodesk manages your wider IT. The scope sets out covered users, locations, activities, licences and who reviews alerts.
Supporting New Zealand businesses since 1989
The short answer
What is data loss prevention?
Data loss prevention (DLP) uses policies to identify sensitive information and govern how it is handled in covered locations such as email and file storage. Depending on the rule, it can audit, warn or restrict an action.
DLP reduces risky handling of sensitive information within an agreed scope. It does not cover every way data could leave, and it does not replace permissions, malware protection, backup or your decisions about who may receive information. Approved external sharing can remain permitted.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide, with support hours and site attendance agreed for each business.
Information
Start with information and legitimate sharing
We identify the client records, staff information, financial details and commercial documents that need particular handling, then agree owners, approved recipients and working methods before setting restrictions.
Information
What needs protecting
Information types, labels or other conditions that identify sensitive content, checked against real examples from your business.
Owners
Who decides
A business owner for each information category, who decides what may be shared, with whom, and approves exceptions.
Licences
What you already have
Your current Microsoft licences, permissions and sharing settings, so the plan uses capabilities your subscription supports.
Microsoft Purview can recognise patterns such as a New Zealand IRD number from its format, checksum and nearby keywords, but it does not recognise every confidential document automatically. Pricing, contracts and similar material may need labels or custom conditions. Permissions in a SharePoint intranet still decide who can open a document in the first place.
Policies
Configure data loss prevention rules around the work
Policies use recognised information types, sensitivity labels and other conditions. For each match we agree the response: audit only, a warning with an override, or a restriction where the location supports it.
External sharing can be legitimate. Staff need workable ways to send approved information to clients and other authorised people, so each policy has defined exceptions and a named person who can approve them.
Evaluation depends on the location. Email is checked during sending, while SharePoint and OneDrive content is evaluated asynchronously. Detection and restrictions are not immediate in every case. Some content, such as encrypted files or images, cannot be inspected in the same way, so each policy states what happens then.
How it works
Test before enforcing
Each rollout starts with a limited scope and simulation, so you can see what a policy would match before it affects anyone.
Agree the scope
Confirm the information, owners, locations, users, licences and responsibilities in a written quote.
Simulate
Run policies without enforcement, checking known-sensitive examples alongside normal work.
Tune and enforce
Review unexpected matches, adjust conditions and confirm warnings, overrides or restrictions before enforcing.
Hand over and review
Brief staff on warnings, approved sharing and exceptions, record the configured policies and known limits, then review as needs change.
Microsoft’s simulation mode runs a policy as if it were enforced, without blocking anything, and keeps its results separate from live alerts. Tuning reduces false positives but does not remove them, so staff also need an exception contact.
Coverage
Check licences, devices and applications
Coverage depends on the licence, location and activity. We check the entitlements of every user who benefits, not one administrator account.
Microsoft 365 Business Premium includes core DLP for Exchange Online email, SharePoint and OneDrive, according to Microsoft’s Purview service description. Teams chat and channel messages need a separate, higher entitlement. Files shared in Teams are stored in SharePoint or OneDrive and fall under those file policies.
Controls for copying, printing or uploading on Windows and Mac devices need endpoint DLP, an appropriate entitlement and onboarded devices, and supported browsers and file types vary. Personal devices, phones and third-party cloud or messaging services are not covered automatically. Protection against threats on those devices is a separate matter for endpoint security, and our Microsoft 365 guide explains the wider platform.
Responsibilities
Alerts, exceptions and ongoing management
The agreement names who reviews alerts, resolves policy problems and approves changes. Exodesk can review alerts under an ongoing management arrangement; otherwise your nominated owner does.
- Alert review. Alerts are reviewed at the agreed hours and frequency. They are separate from the threat monitoring in our cyber security services unless that coverage is agreed.
- Business decisions. Business owners decide permitted sharing and approve exceptions. Technical management is scoped separately from those decisions.
- Suspected disclosure. The escalation route is agreed in advance. DLP reports show only the activity a policy covers, so they do not prove that no leak occurred.
- Wider protection. Permissions, device security and backup remain part of the wider arrangement. DLP cannot restore lost data; our Microsoft 365 backup service covers agreed recovery needs, and outbound email rules sit alongside email security.
DLP can support the reasonable security safeguards that information privacy principle 5 requires, but it does not establish compliance on its own. Not every leaked file creates a notification duty; our NZ Privacy Act guide explains the serious harm test, and our data security guide covers ownership and safeguards more broadly.
Cost
What affects data loss prevention cost?
Cost depends on current licences, covered users and locations, policy design, testing and ongoing review. Additional software may be needed for some locations or devices.
- Licences. Existing entitlements and any additional licences, shown separately.
- Setup. Discovery, policy design, simulation, tuning and staff guidance.
- Management. Alert review, policy changes and review frequency, where agreed.
- Devices. Endpoint onboarding and checks, where they apply.
- Terms. Exclusions, support hours, GST and the term, set out in the quote.
DLP is not assumed to be part of every managed IT or cyber security agreement, so the quote separates setup, recurring management and software charges.
Questions
Data loss prevention questions
What is data loss prevention?
DLP uses policies to identify sensitive information and govern how it is handled in covered locations. Depending on the platform and rule, it can audit, warn or restrict an action. It can address risky internal use as well as external sharing, without blocking every approved transfer.
How is DLP different from backup?
DLP governs information handling in supported locations. Backup provides recovery for agreed data after loss or damage. DLP cannot restore deleted records, and a backup does not stop an authorised user sharing sensitive information, so a business may need both.
Does Microsoft 365 include DLP?
Coverage depends on the exact licence and feature. Business Premium includes core DLP for email, SharePoint and OneDrive, while Teams messages and endpoint activities have separate requirements. Check the users, locations and capabilities in scope before assuming your subscription covers them.
Does DLP cover Teams files and messages?
They are different locations. Files shared in Teams are stored in SharePoint or OneDrive and can be covered by the relevant file policies. Chat and channel messages need a Teams DLP entitlement and configuration, so file coverage does not mean the messages are inspected.
Can DLP stop a departing employee taking data?
It may detect or restrict covered transfers that match the policy. It does not guarantee prevention of deliberate theft or monitor every route. Use role-based access, departure procedures, device controls and appropriate investigation alongside DLP.
Can DLP control USB copying, printing and personal cloud uploads?
Some endpoint activities can be governed, subject to licences, device onboarding, supported browsers and applications, and policy settings. Coverage is checked for the actual workflow. Personal devices, phones and every third-party cloud or messaging service are not included automatically.
Do we need sensitivity labels?
Labels can show how information should be handled, but some DLP policies use recognised information types and other conditions instead. Agree the classification approach for the business first. Manual and automatic labelling have different licence requirements and need testing.
Will DLP disrupt staff?
Rules can affect legitimate work. Simulation, a pilot and testing help reveal unexpected matches before enforcement. Staff need an approved way to share information and a clear exception route, and tuning reduces disruption without promising there will be none.
How much does data loss prevention cost?
It depends on current licences, covered users and locations, policy design, testing and ongoing review. Additional software may be needed for some locations or devices. The quote separates setup, recurring management and software charges, with exclusions and GST stated.
Where does Exodesk provide DLP help?
Our Christchurch and Dunedin teams set up and manage Microsoft 365 DLP for businesses nationwide, whether or not we support your wider IT. Workloads, device coverage, licences, alert review and support hours are agreed for each arrangement.
Next step
Discuss the first useful scope
Tell us which information concerns you, where it is kept and how staff need to share it, and we can agree a practical starting point. Please keep client records, credentials and other sensitive material out of the enquiry form.
Get in touch
Talk to us about data loss prevention
Tell us which information categories concern you, where they are kept and how staff need to share them, and we will be in touch to arrange a time that suits.
Prefer to talk?
Christchurch
Level 1, 85 Riccarton Road
Christchurch 8011
03 343 3124
Dunedin
Level 3, Bartons Building
2 Stafford Street, Dunedin 9016
03 479 2941