1. A method comprising: monitoring, by a processing device in a data loss prevention (DLP) system, outbound data transfers performed by a computing system for violations of a DLP policy; analyzing a structure of information contained in an outbound data transfer in the outbound data transfers against protected structures defined in the DLP policy, wherein the protected structures are defined based on first structural information extracted from a blank form; identifying the information contained in the outbound data transfer as protected based on analyzing the structure using the protected structures; and detecting a violation of the DLP policy in response to identifying the information as protected.