DLP blocking emails

Question

We have a set of DLPs enabled for our organization and so far GDPR is giving us the most "problems". It often gives "false positive" alerts when it mistakes for example serial numbers for EU ID card numbers.

Option for an override is enabled, so end users can use that when they get a prompt before sending out an email, but i wanted to understand how and if at all does the DLP "learn" not to "mark" some content as sensitive?

For example, user John Smith is sending outside the organization a file with a list of mentioned serial numbers. He uses the override option and email goes out. Are those numbers in the attachment getting "whitelisted" somehow? Or will he be forced to use the override option each and every time he sends out the same list?

Is there an option to update list with actual numbers or maybe numeric patterns that given policy should ignore going forward?

Answer 1

hi,

so to paraphrase: if for an email X, override is used by ser John, if user Mark sends the same email (content/attachments/recipient etc) he will also be asked to override?

What about a situation where John sends email X on monday to someone (uses override) and he needs to send the very same email a week later - will he have to override again, or will it be somehow "remembered" that "this data with this To email address" have been overwritten already so is is ok to send?

Answer 2

Dear Michal SMIGIELSKI;

Good day! Thank you for posting to Microsoft Community. We are happy to help you.

Based on your description, I understand that you have a concern with 'DLP blocking emails'. 

Office 365 DLP detects regulated information exchanged on SharePoint and OneDrive for Business, as well as in Exchange Online email. When users' content is sensitive, it notifies them and, if required, limits sharing. It may miss some content; however, it cannot learn not to label sensitive information. The DLP rules for the types of information to detect in their users' files and email messages are defined by the organization that subscribes to Office 365.

Your understanding and cooperation are much appreciated.

Sincerely,

De Paul | Microsoft Community Moderator