Data Loss Prevention (DLP) for SMEs: Protecting Sensitive Data

Most data breaches at SMEs aren't spectacular hacks. They're a quote sent to the wrong recipient by mistake, a customer list in an Excel file that disappears via WeTransfer, a shared OneDrive folder with permissions set a little too wide. In 2025 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) received more than 44,000 data breach notifications, and almost 3 in 4 involved letters and emails that ended up with the wrong person. For SMEs, that's reason enough to stop seeing Data Loss Prevention (DLP) as "enterprise tooling" and start treating it as basic hygiene. This guide explains what DLP is, which sensitive data you need to protect, and how you can achieve a lot in Microsoft 365 on a limited budget.

What exactly is Data Loss Prevention?

Data Loss Prevention (DLP) is an umbrella term for the tooling and policies that stop sensitive information from leaving your organisation unintentionally or without authorisation. DLP consists of three layers that work together:

1. Discover. Where is your sensitive data stored (BSN citizen service numbers, IBANs, medical records, contracts, source code, price lists)?
2. Classify. Every sensitive file or message gets a label (for example "Public", "Internal", "Confidential", "Highly confidential").
3. Protect. Rules determine what can and can't be done with that label: emailing it externally, sharing it via a link, copying it to a USB stick, uploading it to ChatGPT.

A good DLP policy isn't a digital police force that blocks everything. It warns people the moment they're about to make a mistake, often offers an override with a justification, and only blocks where the risks are high.

Why DLP is urgent for SMEs right now

The figures leave little room for doubt. In 2025 the number of data breach notifications to the AP rose to 44,374, up from 37,839 in 2024. Almost 3 in 4 breaches involved post and emails that reached the wrong recipient. Figures for the first half of 2024 had already shown that 18 percent of all notifications (1,760 in six months) involved exactly that scenario: sensitive data in an email to the wrong person.

Why this hits SMEs especially hard: according to the Verizon Data Breach Investigations Report, 74 percent of all data breaches involve a human element (misdelivery, misuse, social engineering). Microsoft research shows that around 80 percent of employees use unapproved apps and that roughly 65 percent of the SaaS applications in use are unauthorised. And now that ChatGPT and Copilot have found their way into every workflow, sensitive data sometimes gets pasted into a prompt without a second thought; 73 percent of security leaders expect insider-driven data loss to increase over the next 12 months.

The legal stakes make this doubly important. Under the GDPR you must report a breach to the AP within 72 hours and, if the risk to the people affected is high, notify them as well. Fines can reach €20 million or 4 percent of global annual turnover. And with the Dutch Cybersecurity Act (the national implementation of NIS2) coming into force in the second half of 2026, a demonstrable data security policy becomes part of the duty of care you must be able to evidence. Our NIS2 guide for SMEs describes those duties in detail.

Which data do you need to protect?

Before you start writing DLP rules, you need to know what "sensitive" actually means for your business. For SMEs it usually falls into a few categories: personal data under the GDPR (name plus address, BSN, IBAN, customer profile), special category data (medical data held by GPs, dentists and occupational health services; criminal records data), financial data (payroll, bank details, cost prices), commercial data (quotes, contracts, price lists, customer databases), intellectual property (source code, technical drawings, formulas) and access data (passwords in Word documents, API keys in scripts).

The starting point is a one-page data classification. Who is responsible for each category, where is it stored (SharePoint, mailbox, ERP, HR tool), and what risk do you run if it gets outside your walls? Without that exercise, you're building DLP policy on thin air.

The main ways data leaks out

At SMEs, the same routes come up again and again: email to the wrong recipient (autocomplete on "Jan" picks Jan the customer instead of Jan the colleague), external sharing links in SharePoint or OneDrive set to "anyone with the link", USB sticks and laptops taken off-site, personal cloud storage (Dropbox, iCloud, a private Google Drive account), AI tools where people paste text without thinking, copying and printing outside managed devices, and departing employees who take their contact list or drawings with them. Each of these routes can be addressed with policy and the right tooling - not always completely, but enough to reduce the risk significantly.

DLP in Microsoft 365 Business Premium: what you get

Most SMEs run on Microsoft 365. Business Premium includes a basic DLP toolset that makes a good first layer for most organisations:

• DLP policies for Exchange Online, SharePoint Online and OneDrive. You can create rules that, for example, stop an email containing more than 10 BSNs from being sent externally, or prevent a SharePoint file with payslips from being shared outside the organisation.
• Sensitivity labels (applied manually) for Word, Excel, PowerPoint and Outlook, allowing a user to mark a document as "Confidential".
• Basic anti-phishing and anti-malware through Defender for Business.
• Purview Compliance Manager to work towards GDPR and ISO 27001 compliance in a demonstrable way.

What Business Premium doesn't do out of the box:

• DLP for Teams chats and channels. For that you need Microsoft 365 E5 or the Microsoft Purview Suite for Business Premium add-on, available in the Netherlands for around €10 per user per month.
• Endpoint DLP (rules governing what happens to files on Windows or macOS devices: copying to USB, uploading through a browser).
• Automatic classification using machine learning or trainable classifiers.
• DLP that stops Copilot from using sensitive files.

For many SMEs, Business Premium with a solid initial setup is enough. If you grow to 100+ employees, or work with special category data (healthcare, legal, finance), the Purview Suite is a sensible next step.

If you'd like a broad overview of Microsoft 365 licences for SMEs first, our guide to choosing Microsoft 365 licences walks you through the options.

How to tackle DLP in 6 concrete steps

1. Data inventory. List on a single page which types of sensitive data you hold, where they are stored and who owns them.
2. Choose your labels. Three or four is usually enough: Public, Internal, Confidential, Highly confidential. For each label, describe what's allowed (sharing, printing, emailing outside the organisation).
3. Enable sensitivity labels in Microsoft 365 Purview. Publish them to everyone and explain how to label a document from Word, Excel or Outlook.
4. Build three to five DLP policies. Focus on the biggest risks: a BSN in an email to external recipients, a payroll list shared via a SharePoint link, a list of IBANs in Excel, more than X customer files in a single attachment.
5. Start in "warn" mode. Don't block anything yet; spend two weeks measuring what gets triggered. That shows you where people actually run into problems.
6. Block only where you need to. Set the policies with the biggest risk reduction to "block with override" (the user can still send after giving a reason) and the most sensitive categories to "hard block". Communicate what's changing.

DLP without communication feels like surveillance to employees. DLP with a clear explanation and a channel for reporting false positives gets accepted. Always link this plan to your existing awareness training; our guide to security awareness training explains how to set that up.

DLP and generative AI: the new front line

The biggest emerging route for data loss is no longer email, but generative AI. Employees paste customer data, contracts or source code into a free version of ChatGPT or an AI summariser without thinking about where that data ends up. With Business Premium you have several options here:

• Copilot for Microsoft 365 instead of free AI tools; Copilot works inside your tenant and only uses your data within that tenant.
• Microsoft Defender for Cloud Apps (in E5 or as an add-on) to see which SaaS and AI tools employees use and where data is going.
• Browser policies (via Intune and Edge for Business) that block or log uploads to specific AI URLs.
• An AI usage policy that states explicitly which tools are allowed, and with which data.

For background on the risks of unauthorised AI tools, see our guide to shadow IT and shadow AI.

What DLP can't do (and what you need instead)

Managing expectations matters with DLP. Here's what DLP doesn't solve:

• Deliberately malicious insiders who have the necessary permissions and take their time to siphon off data in ways that don't trigger any policy.
• Theft or loss of physical devices without disk encryption (turn on BitLocker).
• Ransomware that first encrypts your data and then threatens to publish it. For that you need NGAV and EDR (see our explainer on next-gen antivirus and EDR) plus tested backups.
• Compromised accounts through phishing. For those, MFA is the base layer and 24/7 SOC monitoring the second.

DLP is one layer in a broader security model. If you rely on DLP alone, you'll fall through the other gaps.

Frequently asked questions about DLP for SMEs

Do I need Microsoft 365 E5 to do anything meaningful with DLP? No. Microsoft 365 Business Premium includes DLP for Exchange Online, SharePoint and OneDrive, plus sensitivity labels. For most SME scenarios (stopping a BSN from being emailed externally, keeping payslips from being shared outside the organisation) that is enough. Only when you need Teams chat, Endpoint DLP or DLP around Copilot do you need the Purview Suite (around €10 extra per user per month in the Netherlands) or E5.

How long does it take to set up DLP properly at an SME with 40 employees? A pragmatic initial setup (labels, three to five policies, communication and awareness) can usually be completed in 4 to 8 weeks, with around 20 to 40 hours of technical work plus some separate hours for communication and training. Keep fine-tuning for the first two to three months based on alerts; DLP is never finished on day one.

What's the difference between DLP and sensitivity labels? Sensitivity labels classify a file or message ("this is Confidential"). DLP is the policy that takes action based on that classification or on patterns (BSN, IBAN, credit card number). They work together: the label says what something is, and DLP policies say what can and can't be done with it.

What should I do if a DLP policy upsets a customer because an email doesn't arrive? Wherever possible, set policies to "block with override": the user gets a warning, gives a reason and can still send. Log those overrides so you know how often it happens. Only hard-block where the business impact of a leak outweighs the business impact of a delay (for example, payroll lists accidentally going outside the organisation).

Do I also need a separate data classification for NIS2 alongside DLP? Yes. NIS2 requires demonstrable risk management, including knowing exactly what sensitive data you hold and how you protect it. A one-page data classification with owners, DLP policies linked to it, and an annual review is what you want to be able to show during an audit. Our ISO 27001 guide for SMEs covers similar requirements that fit well with NIS2.

Conclusion

For Dutch SMEs in 2026, Data Loss Prevention is no longer a luxury. With almost 44,000 data breach notifications a year, most of them caused by human error and misaddressed emails, a basic DLP setup is the cheapest way to concretely reduce your risk of GDPR fines, reputational damage and lost customers. Microsoft 365 Business Premium offers enough for the first layer: sensitivity labels, DLP for Exchange and SharePoint, and clear warnings to employees at the moment it matters. If you work in a sector with special category data or heavy Teams usage, the Purview Suite is the logical next step.

TRON Group helps Dutch SMEs set up DLP pragmatically: from data classification and label sets to policies, communication and day-to-day management. Want to know how to better protect your organisation's sensitive data without bringing the business to a standstill? Get in touch via our cybersecurity page or call +31 85 303 5869 for a no-obligation conversation.