Typically the DLP does this in three steps; identifying where and when the data was lost, identifying what data was lost, and then resecuring the remaining data.