Most small businesses in London hold more sensitive information than they realise. Client contracts, payroll records, passport scans, bank details and draft proposals move between laptops, mobile phones and personal email accounts every working day. When that information leaves the business by mistake, the consequences extend beyond the incident itself, including regulatory scrutiny, client attrition and remediation work. Data loss prevention (DLP) is the set of policies and controls that reduces this risk. For London SMEs, the central question is not whether to apply DLP but how to apply it so that staff can still send invoices, share files with clients and meet deadlines.
Table of Contents
- Quick Takeaways
- Where Sensitive Data Sits in a London SME
- Setting Policies Around Real Working Practices
- Microsoft 365 DLP Controls for Small Teams
- Common Causes of Data Leaks in Small Firms
- Rolling Out DLP Without Disrupting Operations
- Comparing DLP Approaches
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Map sensitive data before writing any rule | Identify where client, payroll and personal data is stored, shared and emailed. Rules written without this map tend to block legitimate work. |
| Run new policies in report-only mode first | Observe alerts for at least one full monthly cycle before enforcing blocks, so routine tasks such as payroll and invoicing are not disrupted. |
| Follow the channels staff already use | Email, Teams, SharePoint and OneDrive carry most day-to-day sharing. Controls should sit on these routes rather than introduce new tools. |
| Restrict access before blocking transfers | Limiting who can open sensitive folders removes more exposure than attempting to stop every download. |
| Provide a clear override with a reason | A short justification prompt keeps urgent work moving and creates a record that can be reviewed. |
| Assign a named owner for alerts | A monthly review by one accountable person keeps policies aligned with how the business operates. |
Where Sensitive Data Sits in a London SME
In a typical London professional services firm, sensitive information sits in more places than owners often expect. Shared mailboxes hold client correspondence, finance teams keep bank details in spreadsheets, and HR files may remain in folders created years earlier. Each of these locations is a potential source of accidental disclosure.
A practical first step is to classify information into three groups: personal data covered by UK GDPR, commercial data such as pricing and contracts, and operational data such as system credentials. Personal data usually carries the strictest handling requirements. Commercial data is often the most damaging to lose to a rival bidder.
Identifying the Highest-Risk Data Stores
Start with locations that combine broad access with high sensitivity, such as a company-wide shared drive containing HR files. Removing unnecessary access from these locations typically reduces risk more than any single technical control. Our engineers usually begin this work with an access review rather than a policy configuration.
Pro tip: Ask each department lead to name the three documents they would be most concerned to see sent to the wrong recipient. This list gives the IT team a practical starting point for policy design.
Setting Policies Around Real Working Practices
A DLP policy that does not reflect how staff work will be bypassed. If a finance team sends supplier invoices containing bank details every day, a rule that blocks all such emails will generate constant support requests and encourage workarounds such as personal email accounts. Policies should be designed around legitimate business flows first, then tightened where risk is clearly higher.
Defining Approved Sharing Routes
Document which routes are approved for each data category. Client files may be shared through a controlled SharePoint library with external access limited to named guests, while payroll data may never leave an internal finance folder. Clear routes reduce judgement calls at the moment of sending.
Controls that match the way people already work are far more likely to be followed than controls that require people to work around them.
Policy wording should also be brief. A message such as “This file contains bank details. Confirm the recipient before sending” is more likely to be read and followed than a lengthy policy reference.
Microsoft 365 DLP Controls for Small Teams
For businesses already running Microsoft 365, DLP capabilities are provided through Microsoft Purview. Policies can scan email, Teams messages and files stored in SharePoint and OneDrive for content that matches sensitive information types, such as payment card numbers. Microsoft’s planning guidance recommends defining the scope and objectives of a deployment before enforcing rules, and this section follows that sequence.
Confirming Licence Coverage
Feature availability depends on the Microsoft 365 or Purview licence held. Microsoft publishes its pricing and trial options on its official Purview pricing page, and the capabilities included in each plan should be confirmed there before a project is scoped. A feature missing from the current plan can change the entire approach, so this check belongs at the start.
Policy Modes and Alert Handling
Policies can be set to report only, show policy tips to the sender, or block sharing. In practice, the report-only stage should run for several weeks so that the team can see which legitimate activity triggers alerts. Blocking should be introduced first for narrow, high-risk categories.
Pro tip: Configure policy tips that explain the reason for a block in one sentence. Staff who understand why a message was stopped are less likely to request repeated exceptions.
Common Causes of Data Leaks in Small Firms
Most incidents in small firms are accidental rather than malicious. Misaddressed emails, files shared through links open to anyone, and documents saved to unmanaged personal devices account for a large share of the cases typically seen in practice. Each cause calls for a different control.
Misdirected Emails and Autocomplete Errors
Email autocomplete is a frequent cause of disclosure when two clients share similar surnames, or when a former employee remains on a distribution list. Requiring confirmation for external recipients on messages with attachments addresses this risk without restricting internal communication.
Broad Sharing Links
Links created with organisation-wide or public access settings can be forwarded beyond the intended audience. Restricting default link types to specific people, and reviewing sharing reports each month, closes this gap without affecting collaboration with named clients.
Rolling Out DLP Without Disrupting Operations
A phased rollout protects both data and productivity. Start with one department, typically finance or HR, where sensitive information is concentrated and workflows are well understood. Measure alert volumes, gather feedback and adjust rules before expanding to the wider company.
Testing Before Enforcement
Run each policy in test mode and record the number of alerts per week, along with a sample of the content that triggered them. Adjust conditions where legitimate work is caught, and enable blocking only when alerts are infrequent enough that staff do not routinely request exceptions.
Assigning Ownership After Go-Live
DLP is not a one-off project. A named owner should review alerts, approve exceptions and report monthly to a senior manager. Without clear ownership, alert queues grow and policies drift away from business reality.
Pro tip: Keep a short change log of every policy adjustment, including the reason and date. This record supports audits and helps new administrators understand why rules were set as they are.
Comparing DLP Approaches
Small firms usually choose between three approaches, which are often combined. The table below compares them against the criteria that matter most to owners: protection level, effect on daily work and resourcing requirements.
| Approach | Strengths | Trade-offs |
|---|---|---|
| Native Microsoft 365 DLP policies | Automated detection across email, Teams and file storage, with policy tips that guide staff at the point of sending | Requires licence confirmation, careful tuning and ongoing alert review |
| Access restriction and least-privilege permissions | Reduces the number of people who can reach sensitive data, with little daily friction | Requires an accurate access review and clear ownership of each folder |
| Staff guidance and approval routines | Low cost and builds awareness of what counts as sensitive | Depends on consistent behaviour and does not stop mistakes automatically |
For most small firms, access restriction should come first because it reduces exposure without adding steps to daily work. Native policies can then be added once ownership and review routines are in place. Staff guidance supports both and should not be relied on alone.
Frequently Asked Questions
What is data loss prevention for a small business?
Data loss prevention is a set of policies and controls that identify sensitive information and prevent it from being shared inappropriately, whether by accident or intent. For SMEs, it usually covers email, cloud file storage and removable devices.
Do London SMEs need DLP if they already have a firewall and antivirus?
Firewalls and antivirus software address external threats. DLP addresses authorised channels, such as an employee emailing a spreadsheet to the wrong client, which perimeter tools do not control in the same way.
How does DLP relate to UK GDPR?
UK GDPR requires organisations to apply appropriate technical and organisational measures to protect personal data. DLP can support this obligation by reducing the chance of personal data being sent outside the business in error, but it does not replace a documented data protection approach.
How long should a DLP policy run in test mode?
There is no fixed period, but running policies for at least one full monthly cycle captures routine activity such as payroll and month-end invoicing. This gives a more accurate view of alert volumes before enforcement begins.
Can an outsourced IT provider manage DLP for a small business?
Yes. An outsourced IT department can design policies, monitor alerts, manage exceptions and report on changes, which removes the need for in-house security expertise. iTO.London provides this service as part of its managed IT support for London businesses, and more information is available at https://ito.london/.
We welcome feedback from business owners on which types of sensitive data cause the most difficulty in their own operations, and how they have balanced protection with everyday productivity.