The DLP alert: a customer list leaves the company

14:22: a DLP alert

The data loss prevention system reports an upload: 12,480 customer records, from a company laptop to a personal cloud storage account. The policy for customer data only watches, so the upload went through. The Triage Agent makes it an urgent security incident — a possible personal data breach — and notes that if it is one, the 72-hour clock for telling the supervisory authority has already started.

Facts first

• The Security Analyst agent works out what left: names, business email and phone, companies and contract values. No payment data, no passwords.
• And who: a salesperson who resigned last Monday. No other unusual exports in 90 days.
• It proposes containment and is clear about its limits: it has not contacted the employee, and this needs a decision from a person.

A person decides

Deniz decides to contain now. Containment runs as an emergency change with one approval: uploads to personal storage blocked for that account and CRM exports suspended, done by 14:58. HR and the data protection officer will talk to the employee the same day — as a conversation, not an accusation.

The conversation and the assessment

• At 16:05 he explains that he wanted to keep his customer contacts. He deletes the file during the meeting and signs that he kept no copies.
• The data protection officer records it as a personal data breach, judges the risk to the people concerned low, and decides it does not need to be reported — with the reasons written down, 2 hours 43 minutes after the alert.

Closing the gaps

• The problem record names them: anyone in Sales could export every customer at once, the DLP policy only watched, and export rights didn't change after a resignation.
• The next morning a normal change switches the policy from watching to blocking, for everyone. On its first day it stops two harmless uploads.
• Exports over 1,000 records now need approval, and export rights end on the day someone resigns.
• The first 24 hours go into the knowledge base: facts first, contain, then people.