Data loss prevention

One wrong email can send a client file to a stranger.

Autocomplete picks the wrong address. A spreadsheet of client details goes to a personal Gmail. Someone pastes a contract into a free AI tool. None of it needs a hacker. We set up rules in Microsoft 365 that spot sensitive information, warn staff before it leaves and block the risky cases.

Talk to an engineer Find your sensitive data 07 3114 2808

Microsoft Purview
Watch mode first
Most clients already own it

Checklist on a screen with every item ticked — **Warn first, block the worst**Staff see a short message before a risky send.

What changes

What is different once the rules are on.

Pick one to see how it works.

Risky emails get a second look

When someone tries to send client files, tax file numbers or health details outside the business, Outlook warns them first. High-risk sends are stopped.

Built-in detection for Australian data types

Find your data

What would the rules watch for in your business?

Tick the information you hold and how it could leave. You will see what Purview can spot and the first rules we would set.

What sensitive information do you hold?

How could it leave?

Where we would start

3types Purview can watch for

Tax file numbers: Australia tax file number
Bank account details: Australia bank account number
Client files and contracts: A sensitivity label you apply, such as Confidential

First rules

Warn before sending outside the business, block the riskiest sends
Stop company files syncing or sharing to personal accounts

Built-in Microsoft Purview sensitive information types. Purview data loss prevention for email and files comes with Microsoft 365 Business Premium. Rules start in watch mode before anything is blocked.

The numbers

Mistakes leak data too. So does AI.

667

data breaches notified to the OAIC in the first half of 2026.

OAIC, January to June 2026

37%

of notified breaches were caused by human error in the first half of 2025, up from 29%.

OAIC, January to June 2025

67%

of employees using AI on work devices did it through personal accounts.

Verizon 2026 DBIR

Why mistakes matter

Human error is a leading cause of reported breaches.

In the OAIC's Notifiable Data Breaches reports, human error, like sending personal information to the wrong person, is consistently one of the top causes of breaches reported by Australian organisations. In the first half of 2025 it caused 37% of notified breaches, up from 29%.

These are exactly the mistakes data loss rules are built to catch: the wrong attachment, the wrong recipient, the spreadsheet sent to a personal address. A warning at the right moment stops most of them, and the logs show what happened if one gets through.

How it works

How we set it up.

Step 1Find it
We look through email, SharePoint, OneDrive, Teams and laptops to find where sensitive information lives.
Step 2Label it
Three or four simple labels, like Internal and Confidential, mostly applied automatically.
Step 3Watch first
Rules start in watch mode, so nothing is blocked while we learn how your staff work. Then warnings and blocks go on.
Step 4Tune it
We review what the rules catch, fix false alarms and adjust as the business changes.

Cybersecurity

Eight layers. One team running them.

Every layer is run by the same Brisbane engineers who look after your IT, so an alert, a leaked password and a suspicious email all land with people who already know your business.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask before they call.

What is data loss prevention?

Rules that stop sensitive information leaving the business by accident or on purpose. They watch email, file sharing, cloud storage and devices, warn staff before a risky send and block the worst cases.

What tools do you use?

Microsoft Purview, which includes data loss prevention for email and files in Microsoft 365 Business Premium, plus device rules in Intune for things like USB drives. Most clients already own both and have never switched them on.

What does the Privacy Act expect?

If the Privacy Act covers your business, Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, loss and unauthorised access. Data loss rules are one of the clearest ways to show you have taken those steps.

What about AI tools?

The 2026 Verizon DBIR found 45% of employees now use generative AI on work devices, and 67% of them through personal accounts. We agree which AI tools are approved, write it into your AI use policy and keep client data out of the rest.

Will it get in the way of work?

Not if it is set up properly. Staff doing normal work never see it. When something looks risky they get a short message explaining why, and in most cases they can give a reason and carry on.

Does it help if we have a breach?

Yes. The logs show what data was touched and where it went, which you need for a breach assessment under the Notifiable Data Breaches scheme, where a suspected breach generally has to be assessed within 30 days.

Which Microsoft 365 plans include it?

Microsoft 365 Business Premium and some E3 and E5 plans include Purview data loss prevention for email and files. We check your licences first, because most clients already own it and have never switched it on.

Next step