DLP (data loss prevention) for LLMs is the control layer that stops sensitive data leaving your organisation through AI prompts and uploads. Traditional DLP watches files at rest, email, and endpoints — but text typed into ChatGPT’s input box usually walks straight past it. LLM-focused DLP closes that gap with three possible responses: block the prompt (stops work), flag it for review (after the fact), or mask the sensitive values and forward the rest (work continues, data stays). The architectures differ mainly in where they sit — network edge, endpoint agent, or in the browser at the point of use.
Why classic DLP misses the prompt box
Classic DLP was built for files and email: pattern-match attachments, watch endpoints, inspect network traffic. A prompt is different — it is composed live in a browser text box and submitted over an encrypted connection to a legitimate SaaS domain. Unless the control understands the AI site itself, the paste event looks like ordinary web traffic.
That is why organisations with mature DLP still discover staff pasting customer records into chatbots. The question for any vendor is concrete: does your DLP see what goes into the ChatGPT input field before send?
Block, flag, or mask — the three postures
Blocking stops the prompt entirely. Safe, but it taxes productivity and pushes users to personal devices. Flagging (observe-and-coach) lets the data go and tells someone afterwards — visibility without prevention. Masking detects the sensitive values and replaces them before submission, letting the rest of the prompt proceed: the user keeps working, the data never leaves, and the event is logged.
Mask-and-forward with reversible tokenization is the strictest posture that still preserves the productivity benefit — which is why it suits regulated teams that cannot simply ban AI.
The short version
- The prompt box is the gap in traditional DLP coverage.
- Block stops work; flag reports after the data has gone; mask prevents while work continues.
- Point-of-use (browser) controls cover whatever AI tool staff actually use.
- Audit evidence — what was caught, when, under which policy — is half the value.
Related questions
Do we need LLM DLP if we already run Purview or Netskope?
Check the gap directly: does the existing control see and act on text entered into AI chat inputs, on managed and unmanaged tools alike, before submission? For most deployments the answer is partial at best — a prompt-layer control complements rather than replaces suite DLP.
What about AI tools we host ourselves?
Self-hosted models inside a secure network are a different risk category — the tribunal ruling on open tools explicitly distinguished them. Prompt-layer DLP matters most for public and third-party AI services where the data leaves your boundary.
How accurate does detection need to be?
Nothing catches 100%, and anyone claiming it is overselling. What matters is measured accuracy on the identifiers you care about (published benchmarks, not vibes) plus an audit trail that makes misses visible and improvable.
This page is general information, not legal advice. Where third-party guidance or law is summarised, read the originals via the source links before relying on them. Last reviewed: 17 July 2026.
This is the control in action
Identifiable data is masked in the browser before the prompt ever leaves — try it yourself with a sample prompt, or bring one low-risk workflow to a 20-minute review.
Advise Sarah Thompson, NI AB123456C, on the settlement offer.
Advise <PERSON_7K9X>, NI <NI_8W1R>, on the settlement offer.