A DLP tool scans all outbound email, including messages that appear to be privileged HR complaints to external counsel. How should the employer approach design of the control?
Select an answer to reveal the explanation.
Short Explanation
DLP is a seatbelt, not a license to steam-open every sealed envelope. You can still protect against leaks while narrowing what gets scanned and who sees it. Purpose, minimisation, and careful handling of sensitive HR traffic matter.
Full Explanation
Data loss prevention in employment contexts remains personal-data processing and must respect purpose limitation, data minimisation, and confidentiality. Scanning that indiscriminately exposes privileged or highly sensitive complaints heightens intrusion and confidentiality risk. Proportionate designs use targeted rules, restricted alert audiences, logging controls, and documented justifications rather than unrestricted human review of all outbound content.