1. A computer-implemented method, comprising: detecting, by a client computing device, that a local application has accessed a document on the client computing device; determining that the document contains sensitive data according to one or more endpoint data loss prevention (DLP) polices; determining that the local application and a type of the document is not included in a whitelist of the DLP policies; presenting a notice to a user of the application that the application is subject to capture of visual data that presents privacy issues; capturing visual data pertaining to one or more operations that the application performs on the document; and sending the captured visual data to a server, wherein the server analyzes the captured visual data to determine if the captured visual data indicates at least one of a malicious or a suspicious activity occurred with respect to the document on the endpoint device.