Sensitive data is masked or anonymised where full access is not required
Monitoring for sensitive data leaving through unmonitored channels checks that A.5.12's classification tiers are respected in practice, catching confidential data that slips past its intended handling.
The DLP policy facet names which sensitive data categories must never leave the company and how movement is monitored, the written commitment A.8.11 expects.