Endpoint DLP, or endpoint data loss prevention, is a set of controls installed on user devices to limit how sensitive data can be copied, moved, or exposed. It monitors actions such as copying to USB storage, uploading to cloud apps, printing, clipboard use, screen capture, and file transfers between local applications.
It matters because many leaks and malware pathways begin at the endpoint, where users work with live data every day. By enforcing policy on the device itself, Endpoint DLP can block unauthorized transfers, require encryption, log activity, and trigger alerts when risky behavior appears. In practice, defenders use it to reduce ransomware spread, stop insider exfiltration, and enforce rules for removable media and mixed Windows, macOS, and Linux fleets. It is strongest when paired with clear policy decisions about what data may move and to which devices.