--- title: "GenAI data loss prevention: Stopping sensitive data loss via prompts and uploads" description: "The important point is simple: GenAI makes sharing information feel like normal work. That is why protection must happen at the moment of use, before sensitive data is sent." canonical_url: https://www.acronis.com/en/blog/posts/genai-data-loss-prevention-stopping-sensitive-data-loss-via-prompts-and-uploads/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # GenAI data loss prevention: Stopping sensitive data loss via prompts and uploads The important point is simple: GenAI makes sharing information feel like normal work. That is why protection must happen at the moment of use, before sensitive data is sent. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 6 min read Last updated 21 July 2026 Other languages available:[Deutsch](https://www.acronis.com/de/blog/posts/genai-data-loss-prevention-stopping-sensitive-data-loss-via-prompts-and-uploads/) [Español](https://www.acronis.com/es/blog/posts/genai-data-loss-prevention-stopping-sensitive-data-loss-via-prompts-and-uploads/) [Français](https://www.acronis.com/fr/blog/posts/genai-data-loss-prevention-stopping-sensitive-data-loss-via-prompts-and-uploads/) [Italiano](https://www.acronis.com/it/blog/posts/genai-data-loss-prevention-stopping-sensitive-data-loss-via-prompts-and-uploads/) [Português](https://www.acronis.com/pt/blog/posts/genai-data-loss-prevention-stopping-sensitive-data-loss-via-prompts-and-uploads/) **Author: Alexander Ivanyuk**, Senior Director, Technology GenAI data loss rarely starts with someone trying to steal data. More often, it starts with someone trying to work faster: a technician pasting a support ticket into an AI chat, a finance user uploading a spreadsheet for analysis, a sales manager asking AI to simplify a proposal, or a developer requesting help with a code fragment. The productivity gain is real, but so is the risk. Prompts and uploads can contain customer records, internal notes, pricing, contracts, credentials, personal data, source code or other sensitive information that should not leave the company through an unmanaged AI workflow. This is why GenAI data loss prevention (DLP) matters. It protects a new type of data movement: sensitive information leaving through prompts, pasted content, uploaded files and AI-enabled applications. The risk is already measurable. In Q2 2025, [Harmonic Security analyzed](https://www.harmonic.security/resources/genai-data-exposure-report-fa6wt) one million GenAI prompts and 20,000 uploaded files across more than 300 GenAI and AI-enabled SaaS applications. It found that 4.37% of prompts and nearly 22% of uploaded files contained sensitive content. The important point is simple: GenAI makes sharing information feel like normal work. That is why protection must happen at the moment of use, before sensitive data is sent. Figure 1. Prompts and uploads create a new path for sensitive data to leave through normal AI use. ![Image 3: Figure 1. Prompts and uploads create a new path for sensitive data to leave through normal AI use.](https://staticfiles.acronis.com/images/content/e35c49dc4ac3c77d04f5cd37bc2f39a9.png) Figure 1. Prompts and uploads create a new path for sensitive data to leave through normal AI use. ## Why prompts and uploads change the DLP problem A prompt might look like a simple question, but it can contain far more than the user realizes. Imagine a finance employee preparing a monthly cash-flow summary. To save time, he or she uploads a spreadsheet into a GenAI tool and asks it to identify unusual expenses and create a short management summary. The spreadsheet includes vendor names, bank details, customer invoices, payroll amounts, tax information and internal notes about upcoming cost reductions. The employee’s intention is practical and productive. But the file may expose financial, employee, customer and business-sensitive information to an AI service that was never approved for that data. This is the core difference with GenAI DLP. The risky action does not always look like a file being stolen or a user deliberately sending data outside the company. It can look like a technician asking for help, a finance user uploading a spreadsheet or a manager asking AI to summarize a contract. Prompts and uploads also carry different kinds of risk. A prompt is often smaller, but it may contain copied customer data, logs, credentials, internal notes or code. An upload can be much larger and less predictable. A spreadsheet may include hidden tabs. A document may include comments, metadata or copied internal discussion. A screenshot may reveal system names, account details or security information in the background. A user may only care about one paragraph, but the AI tool receives the whole file. Traditional DLP is still important, but GenAI changes the consequence and reversibility of oversharing. With email, file transfer or cloud sharing, an organization may still be able to trace the recipient, revoke access, delete a shared file or prove where the data went. With [unmanaged GenAI tools](https://www.acronis.com/en/blog/posts/what-is-shadow-ai-and-why-genai-usage-monitoring-matters-for-msps-and-smds/), that control can be much weaker. Depending on the service and account settings, prompts and uploads may be retained, reviewed or used to improve models, and the organization may not be able to retrieve or delete the data with certainty. [Research on training data extraction](https://www.usenix.org/system/files/sec21-carlini-extracting.pdf) has also shown that language models can memorize and reproduce training data when queried, including examples containing names, email addresses, phone numbers, code and other unique text. This is why GenAI DLP must act before submission. The goal is not only to monitor AI use after the fact, but to prevent customer data, financial records, credentials, source code or confidential business content from entering unmanaged AI workflows in the first place. Figure 2. Prompts and uploads carry different risks, but both need the same DLP policy control. ![Image 4: Figure 2. Prompts and uploads carry different risks, but both need the same DLP policy control.](https://staticfiles.acronis.com/images/content/1b34f2b76e9c81aa3394971008ed2fec.png) Figure 2. Prompts and uploads carry different risks, but both need the same DLP policy control. ## Why this matters for MSPs and SMDs For MSPs, GenAI DLP is more than a security control. It is a new managed service opportunity. Many SMD customers are already experimenting with AI, but they often lack the time, expertise or governance processes to define safe usage rules on their own. They need help answering practical questions: Which AI tools are employees using? What types of data are being shared? Which tools should be allowed? When should users be warned? When should sensitive data be blocked? This creates a clear advisory and operational role for the MSP. Instead of simply telling customers to avoid AI, the MSP can help them adopt AI safely: discover GenAI usage, assess data exposure risk, define acceptable-use policies, enable monitoring, apply DLP controls and provide regular reporting. That turns [GenAI security](https://www.acronis.com/en/blog/categories/genai-security/) into a repeatable service motion rather than a one-time policy discussion. The commercial value is also clear. GenAI risk gives MSPs a reason to start a new security conversation with existing customers, create an entry point for customers that are not ready for a full DLP program, and differentiate their managed security offering with AI-specific visibility and enforcement. For SMDs, the value is practical protection without building an internal AI governance team. For MSPs, the value is a scalable service they can deliver across many customer environments. ## What GenAI DLP should do and how Acronis GenAI Protection helps GenAI DLP should help organizations safely enable AI use, not simply block AI tools. To be effective, it needs five practical capabilities. ## 1.Inspect before submission Sensitive data should be analyzed before a prompt or file upload reaches the AI application. [Acronis GenAI Protection](https://www.acronis.com/en/products/cloud/cyber-protect/genai-protection/) helps inspect GenAI interactions so policy can be applied before data is sent. ## 2.Apply policy based on risk Not every customer needs the same enforcement level. Some want visibility first; others need blocking for high-risk data. Acronis GenAI Protection supports detection mode for monitoring and blocking mode for enforcement when sensitive data is detected. ## 3.Guide users at the moment of risk Blocking is more effective when users understand why it happened. Acronis can notify the end user when sensitive data is prevented from being sent, helping turn risky behavior into safer behavior. ## 4.Record events for investigation and reporting MSPs need evidence, not only policy statements. GenAI DLP events should be recorded so administrators can investigate what happened, review patterns, tune policies and report outcomes to customers. Acronis records GenAI DLP events in the events log. ## 5.Operationalize across customer environments For MSPs, the control must be repeatable. Acronis GenAI Protection can be enabled through a management plan and assigned to protected devices, helping partners manage GenAI security as part of a broader managed protection model. Together, these capabilities help MSPs move customers from unmanaged AI use to safer AI adoption: discover where AI is used, inspect what users are submitting, apply policy, notify users when needed and report on the results. ![Image 5: Figure 3. Data loss prevention settings in Acronis GenAI Protection focuses on inspecting content, detecting sensitive data, applying policy, and recording events.](https://staticfiles.acronis.com/images/content/81f4edfad91cafc9fbad1d5ae5c0bd31.png) Figure 3. Data loss prevention settings in Acronis GenAI Protection focuses on inspecting content, detecting sensitive data, applying policy, and recording events. ## Conclusion: A practical service model for safer GenAI use GenAI risk is difficult because it appears inside everyday productivity workflows, not as an obvious security incident. GenAI is becoming part of daily work, and the right response is not to block productivity. The right response is to make AI use visible, governed and safer. SMD organizations need a way to understand which AI tools are being used, decide what data should be protected, prevent sensitive information from being submitted when policy requires it, and report on the results. Where malicious instructions are used to trigger data exposure, prompt injection protection can help detect the attempted manipulation while DLP helps prevent sensitive data from being sent or exposed. For MSPs, this creates a clear managed service motion: discover, assess, monitor, enforce, report and tune. Acronis GenAI Protection helps deliver that model with GenAI usage visibility, DLP controls for prompts and uploads, detection and blocking options, user notification, event logging and reporting. This helps partners turn safe AI adoption into a practical, repeatable service for their customers. [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) ## Written by ![Image 6: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/nis2-compliance-for-health-care-msps-what-you-need-to-know-and-do/) [NIS2 compliance for health care MSPs: what you need to know and do](https://www.acronis.com/en/blog/posts/nis2-compliance-for-health-care-msps-what-you-need-to-know-and-do/) [Next post](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-cloud-once-again-earns-perfect-score-in-av-test-atp-evaluation/) [Acronis Cyber Platform once again earns perfect score in AV-TEST ATP evaluation](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-cloud-once-again-earns-perfect-score-in-av-test-atp-evaluation/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 7: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 8: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 9: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read