Retention Labels Versus DLP in a Shared Document Library
A regulated firm stores client contracts in a SharePoint document library. A retention label named Contract-7yr retains content for seven years and then deletes it. A data loss prevention policy blocks documents containing a client identification number pattern from being shared externally. An employee shares a contract externally through a link. The DLP policy fires and the share is blocked. Separately, an auditor asks whether a contract that was deleted by its owner 18 months ago still exists, and whether the firm can prove the deletion was authorized. The compliance team also wants to know why a document that was placed on litigation hold still shows as available for deletion by its retention label.
1. Explain the difference in purpose between the retention label and the DLP policy, and why one firing does not imply the other will.
Read the worked answer
They solve different problems and operate at different layers.
A retention label governs lifecycle: how long content is kept and what happens at the end of that period. Contract-7yr retains for seven years and then deletes. It does not evaluate who is sharing what; it applies to the item regardless of user action.
A DLP policy governs movement: it inspects content for sensitive information types and enforces rules when that content crosses a boundary, such as an external share. The block on the external link is a DLP outcome and says nothing about the retention schedule.
So a blocked share does not mean the item is protected from deletion at the end of its retention period, and a retention label does not stop an employee from sharing a document externally. A complete control set needs both, plus the audit trail that proves what happened.
2. Answer the auditor's two questions and resolve the litigation hold contradiction.
Read the worked answer
Deleted 18 months ago, seven-year retention: if the item carried Contract-7yr before deletion, the retention label preserves it in the preserved location for the remainder of the retention period; deletion by the user removes it from the user's view but not from the preserved copy. The auditor should search the preserved locations rather than the library.
Proof of authorized deletion: retention alone does not prove authorization. The audit log is the evidence source. Search unified audit log events for the item, including deleted items and record changes, to show who deleted it and when, and whether the action was permitted by policy.
Litigation hold versus retention label: the item still appears eligible for label-driven deletion because a hold and a retention label are independent controls. A hold preserves content for discovery and overrides disposition; the label's disposition will not permanently remove content that is on hold. The label may show as pending disposition or the deletion may be suspended while the hold applies. The team should verify hold status on the item and confirm the label's disposition review settings, because the visible state reflects the hold taking precedence, not a failure of the label.