Form Data Loss Prevention

What is Data Loss Prevention (DLP), and Why Is It Important?

Data loss prevention is the set of strategies, tools, and practices designed to ensure that sensitive or critical information is not lost, corrupted, or accessed by unauthorized users. In the context of digital forms and web applications, DLP focuses on preventing users from losing the data they’ve entered, like form fields or application inputs, due to session timeouts, page reloads, errors, or system crashes.

Key points for understanding DLP in forms:

The primary purpose of preventing data loss in digital forms is to ensure that forms save and maintain data when users are timed out from an authenticated space. This means that if a user's session expires, they should be able to continue their activity without losing the information they have already entered.

How Does Data Loss Prevention Impact Accessibility?

Preventing data loss is crucial for ensuring that everyone can effectively use digital content and tools without frustration.

For example, people with certain cognitive or motor disabilities may take longer to complete tasks. If their session times out and they lose all entered data, it creates a significant barrier and forces them to restart, potentially leading to frustration and an inability to complete the task.

Additionally, when forms, especially critical ones like login, signup, or checkout forms, are inaccessible due to data loss, users can be completely blocked from accessing a site or purchasing products. The requirement to re-authenticate without data loss is considered an accessibility best practice, even being a Level AAA success criterion in WCAG.

What WCAG Success Criteria are Relevant for Preventing Data Loss?

The Web Content Accessibility Guidelines (WCAG) include a specific success criterion directly addressing the prevention of data loss:

• WCAG Success Criterion 2.2.5 Re-authenticating: This criterion states that if an authenticated session expires, the user must be able to continue their activity without losing data after re-authenticating. It is noted as a Level AAA success criterion, highlighting its importance as a best practice for accessibility.

How Do I Maximize Accessibility When I Code Forms?

To prevent data loss, developers should implement mechanisms to save and maintain form data even when a user's authenticated session expires.

Similarly, it is vital to allow for timeout extensions for users who may take longer to complete tasks, such as those with cognitive or motor disabilities.

When a timeout is about to occur, ensure that cursor focus is driven to the timeout option so users can effectively choose to extend their session or log out, thus preventing abrupt data loss.

How Do I Test the Accessibility of Forms?

To ensure data loss prevention is effectively implemented, consider the following testing methods, particularly for forms and authenticated sessions:

Keyboard Navigation

Test that all form fields can be focused, filled out, or selected using only the keyboard. Ensure users can navigate and interact with all elements, including any timeout extension options.

Screen Reader Testing

• Verify that screen readers announce labels and instructions for all form fields, ensuring users understand what information is required.

• If a session timeout warning appears, ensure the screen reader immediately announces its presence and the shift of focus to the relevant interactive elements (e.g., extend session button).

• Test the re-authentication process to confirm that previously entered data is retained after re-authenticating.

Simulate Session Timeouts

Actively test scenarios where authenticated sessions expire to confirm that data is indeed saved and retained upon re-authentication, allowing the user to continue their activity without interruption or loss of progress.