- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s enterprise security conversation has shifted dramatically in 2025 and 2026. While ransomware and phishing dominate headlines, a quieter, equally damaging threat is bleeding organisations dry: data exfiltration. Sensitive customer records, financial data, intellectual property, and employee personally identifiable information (PII) are leaving networks through email, cloud uploads, compromised endpoints, and malicious insiders — often undetected for weeks or months.
The passage of the Digital Personal Data Protection (DPDP) Act, 2023 and subsequent enforcement guidance from the Data Protection Board has made data loss prevention (DLP) a board-level priority. Organisations that cannot demonstrate active controls over personal data processing and transmission face significant penalties. Yet most Indian enterprises we work with still treat DLP as an afterthought — a checkbox on a compliance spreadsheet rather than an operational programme.
This guide lays out a practical DLP programme for Indian enterprise IT and security teams, covering the threat landscape, FortiGate-based technical controls, operational visibility, and the DPDP Act compliance angle.
The challenge is not technical — the tools exist. The challenge is operational: organisations deploy DLP capabilities but lack the monitoring, tuning, and response workflows to make them effective.
Three trends are making data loss worse:
The DPDP Act adds a legal dimension: organisations processing “significant volumes” of personal data are classified as Significant Data Fiduciaries (SDFs), subject to mandatory Data Protection Impact Assessments, stricter breach notification timelines, and obligations to demonstrate lawful processing. DLP is the technical layer that makes these obligations operationally real.
Attackers — and negligent insiders — use several network channels to move data out:
Even the most hardened network perimeter cannot stop data leaving on USB drives, printed documents, or screen captures. Endpoint DLP controls — typically deployed through endpoint protection platforms integrated with your SIEM — are essential for complete coverage. This is especially relevant for banking, healthcare, and manufacturing environments where workstations handle sensitive documents daily.
Shadow IT is the DLP programme’s silent nemesis. When employees use personal cloud accounts to work around slow VPNs or storage quotas, sensitive data leaves the perimeter without any alert firing. Cloud Access Security Broker (CASB) capabilities — available as part of FortiGate’s application control and integrated through FortiSASE — provide visibility into which SaaS applications your organisation is actually using versus which ones are sanctioned.
FortiGate Next-Generation Firewalls provide built-in DLP capabilities that, when properly configured, cover the network layer comprehensively. Here is how we approach deployment for Indian enterprise clients:
The single most impactful DLP control you can enable is SSL/TLS deep inspection. Without it, the firewall cannot read the content of HTTPS sessions — which today carry the vast majority of enterprise traffic. Configure a certificate inspection profile and deploy your internal CA certificate to managed endpoints so browsers trust the inspection proxy.
SSL inspection does introduce some performance overhead; size your FortiGate accordingly and use hardware-accelerated NP7/SP5 processors for high-throughput environments. Work through your legal and HR teams on the acceptable use policy update before enabling full inspection — employees must be informed.
FortiGate DLP sensors match content patterns against traffic flows. For DPDP Act compliance, configure sensors to detect:
Apply DLP sensors to outbound traffic policies — particularly those permitting HTTPS to internet destinations, SMTP/SMTPS email, and any cloud application categories your users access.
FortiGate’s application control database includes signatures for hundreds of cloud storage and file-sharing services. Create a tiered policy:
Network-layer DLP on the firewall cannot inspect encrypted SMTP sessions between your mail server and external recipients after handoff. FortiMail provides dedicated email security with deep content inspection, attachment scanning, and policy-based quarantine. Configure FortiMail DLP profiles in conjunction with FortiGate policies to ensure complete email channel coverage — both outbound corporate email and webmail accessed through browsers.
Technical controls on the FortiGate stop known patterns, but sophisticated exfiltration attempts are designed to evade signature-based detection. Low-and-slow data theft — small batches sent over days or weeks — won’t trigger volume thresholds. Detecting it requires behavioural correlation across multiple data sources: firewall logs, email logs, endpoint telemetry, and identity events. That’s where operations-layer visibility becomes essential.
For clients who need this level of detection, we deploy and operate PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is PrahiX Ora’s primary field deployment and operations partner in India.
The platform addresses DLP use cases across four integrated pillars:
SIEM: Ora ingests FortiGate DLP alert logs, FortiMail audit trails, endpoint protection events, and Active Directory authentication logs into a unified event stream. MITRE ATT&CK-mapped correlation rules surface exfiltration techniques like T1048 (Exfiltration Over Alternative Protocol) and T1567 (Exfiltration Over Web Service). Critically, Ora supports tiered log retention — hot, cold, and archive — covering CERT-In’s direction on 180-day in-country log storage, which is essential for post-incident forensic investigations under DPDP Act breach enquiries.
NMS: The Network Management System pillar provides unified observability across your firewall estate, switches, APs, and WAN/SD-WAN links. LLDP/CDP topology discovery means Ora maps where every network segment connects, so DLP analysts can trace an alert back to a specific physical location or department — invaluable when investigating insider threat incidents across multi-site manufacturing or retail estates where NOC visibility is otherwise fragmented.
Video Surveillance (VMS): For manufacturing, retail, and financial services clients, Ora’s video surveillance (VMS) pillar integrates ONVIF/Hikvision/Dahua camera management with network security operations. Physical security incidents — an employee carrying an unauthorised device into a secure area — can be correlated with network DLP alerts to build a complete incident storyline, all from one operations console.
SOAR: When a DLP alert fires, speed of response determines how much data leaves. Ora’s SOAR pillar runs automated response playbooks: quarantine an email, block an IP at FortiGate, disable an AD account, and generate an incident ticket — all within seconds. This automation is what makes CERT-In’s 6-hour incident reporting window realistic rather than aspirational. Manual triage and escalation processes simply cannot meet that deadline at scale; SOAR can.
If your organisation is evaluating unified SecOps platforms to support your DLP and DPDP Act compliance programme, speak with our team about a PrahiX Ora pilot deployment.
DLP controls are only as good as your data classification framework. Before configuring a single sensor, map your data landscape:
The DPDP Act requires organisations to process personal data only for specified, lawful purposes. Classification tells you which data is in scope for the Act’s protections, and therefore what your DLP programme must protect.
A DLP policy framework should specify, for each data category:
Document this policy framework. Under the DPDP Act, organisations must be able to demonstrate to the Data Protection Board that they had appropriate technical and organisational measures in place. A written, implemented DLP policy is evidence of that.
The DPDP Act and CERT-In’s 2022 directions both impose breach notification obligations. CERT-In requires reportable cybersecurity incidents to be reported within 6 hours of detection. For data breaches involving personal data, the Data Protection Board expects prompt notification to affected data principals.
Your DLP programme must feed directly into your incident response playbook. When a DLP alert escalates to a confirmed breach, the clock starts. Automated SOAR workflows that generate incident records, preserve evidence logs, and notify the response team are what make these timelines operationally achievable.
DLP is not a product you install — it is an operational programme you run. The FortiGate provides the enforcement layer. FortiMail closes the email channel. PrahiX Ora provides the detection, correlation, and automated response layer that makes the whole programme operationally coherent. And CERT-In and DPDP Act compliance becomes achievable rather than aspirational.
PJ Networks helps Indian enterprises design, implement, and operate DLP programmes as part of our managed security service. Our 24/7 NOC/SOC team monitors DLP alerts in real time, tunes policies to your environment, and runs the incident response workflows when alerts escalate.
If your organisation is overdue for a DLP assessment — or if a recent audit finding or near-miss has put data protection back on the agenda — reach out to our team for a conversation about where to start.