1. Define the sensitive data first. See “Defining the sensitive data”.

2. Define the DLP scan rules which specify the information to be checked in the email traffic. See “Configuring DLP rules”.

3. Define DLP profiles, which use one or more rules. See “Configuring DLP profiles”. You also specify the actions for the matched rules. These are the same action profiles you use in the content profiles. See “Configuring content action profiles”.

4. Apply the DLP profiles to the IP or recipient based policies. See “Controlling email based on recipient addresses” and “Controlling email based on IP addresses”.