Data Protection, Encryption, and Compliance in Email
Data Protection, Encryption, and Compliance in Email
This domain tests how email data is protected in transit, at rest, and through policy, and how compliance features retain or disclose it. Know the difference between transport encryption and message-level encryption.
Core rules
- TLS protects the SMTP hop. Opportunistic TLS is attempted and may fall back; forced TLS requires a verified certificate and fails closed. TLS does not protect the message after delivery.
- Message-level encryption includes S/MIME and client-side or service-based encryption. S/MIME requires certificate exchange and provides end-to-end protection; service-based encryption often delivers a link or portal, so the recipient experience differs.
- DLP policies inspect content and context, then block, encrypt, or notify. Sensitivity labels can apply encryption and persistence across workloads.
- Retention labels, litigation hold, and eDiscovery govern preservation. A deletion by a user does not necessarily remove the item from a hold.
Worked example
A DLP policy blocks outbound messages containing a credit-card pattern to external recipients. A user needs to send an encrypted report. The correct path is to apply the approved encryption or sensitivity label and, if policy permits, use an override with justification. Disabling DLP or sending via a personal account is not acceptable.
Traps
- Claiming TLS provides end-to-end encryption; it only protects the transport hop.
- Assuming S/MIME works without recipient certificates.
- Confusing retention deletion with legal hold preservation.
- Treating a portal-link encryption message as equivalent to S/MIME for all compliance purposes.