LEARN. PRACTICE. GROW.Concept and mechanism
Classification helps decide how information should be handled; protection requires effective settings. A sensitivity label can include encryption and markings or merely indicate classification. The name Confidential does not prove encryption was applied. The publishing policy determines who receives labels; also check scope and support in the application being used. DLP evaluates content and usage conditions in configured locations and can apply actions. Having a policy does not prove that a file and channel are covered. In simulation, results support impact assessment without executing policy actions. If the goal is preventing a share, clearly distinguish observation from control enforcement.
Guided application
For fictional positions exports, identify data, authorized recipients, and channels. Trialing a policy with owners helps reduce false positives and define traceable exceptions. Retention is a separate decision: establish preservation and deletion under requirements validated by the organization. A policy can cover a location; a label can define item-level treatment. When retention and deletion overlap, inspect all settings, period start events, and exceptions. In simple examples without priority cleanup, retention prevents permanent deletion while the applicable period remains active. An item disappearing from the user’s view does not prove final destruction. Do not use illustrative course periods as legal rules for banking data. Tracking improvements in Compliance Manager helps manage actions, but a score does not certify legal compliance.
Retain four years and delete after two, from the same creation event without exceptions: no permanent deletion at two years.
Common pitfalls
Label as mandatory encryption; match as blocking; retention as universal backup; fictional periods as legislation.
Related topics: Evidence, investigation, and compliance · Responsibilities, identity, and risk
Check configuration, scope, mode, and period before claiming data is protected.
Reference: Data loss prevention · SC-900 objectives 2026-07-28; October 2026 update announced