How to Stop Sensitive Data Quietly Walking Out of Your Organisation
ISO 27001 Control 8.12 Data leakage prevention is all about making sure your information doesn’t slip out through the side door – whether by accident, misconfiguration, or deliberate action.
You can have strong firewalls and access controls, but if someone can email a full customer export to their personal account, sync confidential files to an unsanctioned cloud app, or walk out with a USB drive full of data, your security posture is already compromised.
This control expects you to understand how data moves, identify where it could leak, and put sensible, layered measures in place to detect, prevent and respond to those leaks.
This guide breaks down what ISO 27001 Control 8.12 is really asking for and how to build a practical, risk-based data leakage prevention (DLP) approach that people can actually live with.
What ISO 27001 Control 8.12 Actually Requires
In plain English, ISO 27001 Control 8.12 – Data leakage prevention expects you to:
- Identify which data is sensitive, where it lives, and how it flows.
- Control and monitor how that data leaves your systems and networks (email, web, uploads, APIs, print, USB, cloud apps, etc.).
- Use technical and procedural measures to block or reduce risky data movements.
- Detect and investigate suspicious data access or transfers, especially to untrusted destinations.
- Make sure your approach aligns with legal, regulatory and contractual requirements.
It’s closely linked to:
- Data classification and handling
- Access control and identity management
- Logging and monitoring
- Use of cloud and third-party services
- Insider threat management
The key idea: DLP isn’t one magic product – it’s a combination of policies, controls, tools and user behaviour that makes data leakage much less likely and much easier to spot.
Step 1 – Get Clear on What You’re Protecting
You can’t prevent data leakage if you don’t know what you’re trying to protect.
Under ISO 27001 Control 8.12, you should:
- Identify your sensitive data
– Personal data (especially special categories, payment details, contact lists)
– Intellectual property (designs, source code, algorithms, internal methods)
– Commercially sensitive information (pricing, bids, contracts, strategic plans)
– Security-sensitive data (keys, secrets, credentials, internal network maps) - Classify data by sensitivity
– Use labels such as “Public”, “Internal”, “Confidential”, “Highly Confidential”.
– Make sure people know what these labels mean in practice (what they can and can’t do with each level). - Map where it lives and how it moves
– Key systems and repositories (CRM, ERP, file shares, cloud storage, collaboration tools).
– Typical flows: to customers, regulators, suppliers, and between internal systems.
That gives you a sensible basis for deciding where to focus DLP effort rather than trying to monitor everything equally.
Step 2 – Identify Your Main Data Leakage Paths
Next, think concretely about how data could leak in your organisation.
Common routes that ISO 27001 Control 8.12 is concerned with:
- Email
– Sending to the wrong recipient
– Forwarding sensitive content to personal accounts
– Large attachments or exports leaving the organisation - Cloud and web
– Uploading files to unsanctioned cloud services (“shadow IT”)
– Copying data into unmanaged collaboration or messaging tools
– Public links created and never revoked - Endpoints and removable media
– Copying to USB drives or external disks
– Local sync folders on unmanaged devices
– Printing and physical documents leaving the building - Lost or stolen devices
– Laptops, mobiles, tablets with cached data
– Unencrypted devices used off-site - APIs and system integrations
– Poorly controlled exports or APIs feeding third parties
– Over-broad data sharing “just in case” - Insiders and social engineering
– Disgruntled staff deliberately exfiltrating data
– Staff manipulated into sharing data with someone who sounds legitimate
Once you’ve listed these, you can start to design specific controls for each path, rather than relying on vague “don’t leak data” messages.
Step 3 – Define Your DLP Policy and Responsibilities
ISO 27001 Control 8.12 works best when people know what’s allowed, what’s not, and who owns the risk.
Your DLP policy should:
- Set clear rules for sensitive data
– Which channels are acceptable for which classification levels (e.g. no “Highly Confidential” via standard email without encryption).
– Which cloud services are sanctioned, and which are not to be used. - Define approval points
– When is it acceptable to export or share sensitive datasets externally?
– Who has to sign off (e.g. data owner, legal, security)? - Assign ownership
– Data owners responsible for deciding what can be shared and with whom.
– IT/security responsible for operating DLP tools and monitoring.
– Line managers responsible for user behaviour in their teams. - Link to other policies
– Acceptable use, remote working, incident management, supplier management.
A short, practical DLP policy, backed by clear guidance, makes ISO 27001 Control 8.12 much easier to embed and audit.
Step 4 – Monitor and Control Data Movement
This is the heart of ISO 27001 Control 8.12: watching and controlling how data moves so you can reduce the risk of leaks.
Practical controls include:
- Email controls
– Warning prompts when sending to external recipients with sensitive content.
– Optional or mandatory encryption for certain classifications.
– Restricting auto-forwarding to personal accounts. - Web and cloud controls
– Controlling which cloud storage and collaboration apps are allowed.
– Blocking uploads of sensitive data to unknown or high-risk sites.
– Using CASB (cloud access security broker) or equivalent where appropriate. - Endpoint DLP
– Blocking or controlling copying to USB drives and external media.
– Controlling copy/paste from sensitive apps to unsanctioned destinations.
– Monitoring file transfers to local sync folders or printing of sensitive documents. - Network monitoring
– Detecting unusual outbound data volumes or patterns.
– Flagging connections to high-risk external destinations from internal systems. - Mobile device management (MDM)
– Enforcing encryption and screen lock on mobiles and tablets.
– Remote wipe for lost or stolen devices.
– Containerisation to separate work and personal data on BYOD.
You don’t have to deploy everything at once; start where your highest-value data and highest-risk channels intersect.
Step 5 – Use DLP Tools Wisely (Not as a Magic Wand)
DLP products can be extremely helpful for ISO 27001 Control 8.12, but they aren’t a silver bullet.
If you use DLP tooling, aim to:
- Start with visibility
– Initially run in detect/monitor mode to understand how data is actually being used.
– Use this insight to refine rules before you begin blocking. - Focus on high-value patterns first
– Known identifiers: national ID numbers, card details, customer IDs, key phrases.
– Particular file types or repositories (e.g. exports from core systems). - Tune rules to reduce noise
– False positives will cause “alert fatigue” and workarounds.
– Work with business teams to adjust rules so they’re strict enough to help, but not so strict people can’t do their jobs. - Integrate with incident processes
– DLP alerts should feed into your security incident workflow.
– Define how you triage, investigate and respond to potential data leakage events.
Think of DLP tooling as one layer in your Control 8.12 strategy, sitting alongside policy, process, and user behaviour.
Step 6 – Tighten Access and Reduce Unnecessary Data Exposure
Many data leaks happen simply because too many people have access to too much data.
To support ISO 27001 Control 8.12:
- Apply least privilege
– Use role-based access control so people only see the data they genuinely need.
– Avoid “everyone in the department” access to entire databases or shared drives. - Use strong authentication
– Multi-factor authentication (MFA) for systems holding sensitive data.
– Extra checks for remote access or high-risk actions (e.g. large exports). - Clean up access regularly
– Review permissions for high-value systems and shared locations.
– Remove access for joiners/movers/leavers promptly. - Limit export capabilities
– Restrict who can perform mass exports from core systems.
– Apply additional approval or logging where large datasets are involved.
The less data any one account can touch, the harder it is for that account to become the source of a major leak.
Step 7 – Control Exports, Backups and Third-Party Sharing
Data leakage isn’t just about “live” systems – it’s also about where copies end up.
For ISO 27001 Control 8.12, make sure you:
- Control data exports
– Require justification and, for high-risk exports, approval by the data owner.
– Encrypt files in transit and at rest when shared externally.
– Use secure transfer channels (e.g. SFTP, secure portals) rather than ad-hoc methods. - Protect backups and archives
– Encrypt backups and restrict access to backup systems and media.
– Apply retention and deletion policies so backups aren’t kept indefinitely “just in case”. - Manage suppliers and partners
– Ensure contracts define how they protect your data and what they’re allowed to do with it.
– Confirm they have appropriate DLP controls of their own if they handle sensitive information.
This helps you show that data leakage prevention under Control 8.12 extends beyond your own perimeter.
Step 8 – Address Insider Risk and Human Behaviour
Most data leaks have a strong human element – error, habit, or intent.
To address this under ISO 27001 Control 8.12:
- Provide targeted awareness training
– Real examples of how data leakage happens (wrong recipient, public link left open, unsanctioned cloud storage).
– What staff should do instead (approved tools, encryption, asking for help). - Set clear behavioural boundaries
– Rules on forwarding work emails to personal accounts.
– Expectations around using personal cloud storage or messaging apps for work content. - Monitor for unusual behaviour
– Large, unusual downloads by specific accounts.
– Access to data outside a user’s normal pattern (time, volume, system). - Have a supportive culture
– Encourage people to ask “is this the right way to share this?” without fear of looking silly.
– Treat unintentional mistakes as learning opportunities, while still handling serious or deliberate misuse appropriately.
Done well, this turns ISO 27001 Control 8.12 from a purely technical control into part of your security culture.
Step 9 – Compliance, Legal and Privacy Considerations
Data leakage prevention is tightly linked with regulatory duties.
To align ISO 27001 Control 8.12 with compliance:
- Map your sensitive data to relevant laws and standards
– Personal data (e.g. GDPR and other privacy regimes).
– Payment data (e.g. PCI DSS).
– Sector-specific rules (e.g. health, finance). - Ensure monitoring respects privacy
– Balance employee monitoring with local employment and privacy laws.
– Be transparent in policies about what is monitored and why. - Document your DLP controls
– Policies, procedures, configurations, and incident handling.
– Use these as evidence in audits and regulatory enquiries.
This helps you show that Control 8.12 is part of a coherent compliance story, not an isolated technical measure.
Quick Implementation Checklist for ISO 27001 Control 8.12
Use this to benchmark your current position:
- ISO 27001 Control 8.12 (Data leakage prevention) is covered in a clear policy that staff can understand.
- Sensitive data is identified, classified and mapped, including where it lives and how it flows.
- The main data leakage paths (email, web, cloud, USB, print, APIs, lost devices) are understood and documented.
- Controls are in place to monitor and, where appropriate, block risky data movements.
- Any DLP tooling is tuned, with a focus on visibility first and manageable alert volumes.
- Access to sensitive data follows least privilege and is reviewed regularly.
- Data exports, backups and third-party sharing are controlled, encrypted and logged.
- Staff receive regular training on data leakage risks and how to handle data safely.
- Insider risk is addressed through monitoring, behaviour analytics and clear expectations.
- DLP measures are documented, auditable and aligned with legal and regulatory requirements.
Bringing It All Together
ISO 27001 Control 8.12 – Data leakage prevention – is about accepting that your data is under constant pressure to move: to devices, to partners, to the cloud, and sometimes to places it shouldn’t.
If you:
- Know what data really matters,
- Understand how it can leak,
- Put layered technical and procedural controls around the highest-risk paths, and
- Back that up with monitoring and user education,
you’ll dramatically reduce the likelihood and impact of a leak – and you’ll have a clear, defensible approach that satisfies ISO 27001 Control 8.12 and supports your wider information security objectives.
Explore the ISO 27001 Control Group Purposes