How do we set up DLP for outbound mail without colleagues complaining?

Data Loss Prevention scans outgoing messages for sensitive info (national IDs, credit cards, IBAN, customer IDs) and can block or warn. For SMB a policy-tip approach usually beats hard blocks, you train without breaking work.

Try this first

1. 1Start by listing what you actually want to prevent. Dutch BSN numbers leaving the org? Customer lists going to personal mail? Build policies from that, not the other way around. Microsoft has templates (Financial, PII NL) as a starting point in Purview admin > Data loss prevention.
2. 2Set the first policy to 'Test mode with policy tips' or 'Audit only'. Purview logs matches without blocking anyone. Run that for 2-3 weeks, see what triggers, and adjust thresholds (for example require at least 5 BSN matches before escalating).
3. 3Add policy tips in Outlook. Those warn the user: 'This message may contain sensitive info. Continue?' with explanation and optionally an 'override with reason' button. That trains people instead of running them into walls.
4. 4Only switch to 'Block' once tip-mode shows false positives are at an acceptable level. Otherwise expect escalations from people unable to do legitimate work.
5. 5Add exceptions for specific groups or recipients where exchange is known (your accountant who needs to see BSNs). That's via condition exceptions in the policy.
6. 6Document what blocks and how someone requests an override or escalates. Otherwise IT becomes the bottleneck and people work around via personal Gmail.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.