4

DLP Policies

SL-08

Every rule consumes Discovery classification, consent state and purpose metadata rather than static patterns. A policy that blocks on a regex produces noise; a policy that blocks on 'this is classified children's data with withdrawn consent' produces evidence.

DischargesS.8(4)R.6S.6S.9
Policies
8
Enforcing
7
In simulate
0
Consent-aware
2

Block on withdrawal

Children's data rules
2

8 records

ChannelsDriven by
Block outbound email containing government identifiers
All mailboxes
Email
Government identifierBiometric reference
BlockEnforcing1483.1%Critical
Quarantine children's data leaving the department
Education, Health and Welfare directorates
EmailCloud & SaaSWeb & APIEndpoint
Consent stateChildrenChildren's personal data
QuarantineEnforcing626.4%Critical
Block sharing of data with withdrawn consent
Department-wide
EmailCloud & SaaSWeb & APIDatabase
Consent stateAny personal data with consent state = withdrawn
BlockEnforcing341.2%Critical
Prevent bulk copy to removable media
All managed endpoints
Endpoint
Personal dataHigh-risk personal data
BlockEnforcing918.9%High
Block public or external sharing in cloud storage
SharePoint, object storage
Cloud & SaaS
ChildrenPersonal dataChildren's personal data
BlockEnforcing272.2%Critical
Warn on personal data submitted to unsanctioned web services
Department-wide
Web & API
Personal data
WarnEnforcing20414.6%High
Detect mass database export
Tier-1 databases
Database
High-risk personal data
BlockEnforcing110.8%Critical
Redact identifiers in printed output
District offices
Print
Government identifierBank account
RedactSimulate38622.4%Medium