System and method for reducing data loss prevention scans

A non-transitory computer readable storage medium having instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

• receiving a file, the file having metadata comprising data indicating that the file has previously been scanned for confidential information, whether content of the file contains confidential information, and a version of a data loss prevention (DLP) policy associated with a previous scan of the file;
• determining, by the processing device, from the metadata for the file, that the content of the file contains confidential information;
• determining, from the metadata for the file, whether the data loss prevention policy has been modified since the file was previously scanned;
• if the metadata of the file indicates that the DLP policy has not been modified since the file was previously scanned, determining whether or not the file violates the data loss prevention policy using the data in the metadata indicating whether the content of the file contains confidential information;
• and
• if the metadata of the file indicates that the DLP policy has been modified since the file was previously scanned, scanning the file to determine whether or not the file violates the modified data loss prevention policy.

A system comprising:

• a memory;
• and
• a processing device coupled to the memory, the processing device to:
• receive a file, the file having metadata comprising data indicating that the file has previously been scanned for confidential information, whether content of the file contains confidential information, and a version of a data loss prevention (DLP) policy associated with a previous scan of the file;
• determine, from the metadata for the file, that the content of the file contains confidential information;
• determine, from the metadata for the file, whether the data loss prevention policy has been modified since the file was previously scanned;
• and
• if the metadata of the file indicates that the DLP policy has not been modified since the file was previously scanned, determine whether or not the file violates the data loss prevention policy using the data in the metadata indicating whether the content of the file contains confidential information;
• and
• if the metadata of the file indicates that the DLP policy has been modified since the file was previously scanned, scan the file to determine whether or not the file violates the modified data loss prevention policy.