Hello Nadia,
Ronak was merely suggesting *ONE* method to perform initial triage of the event; you can certainly set it up in a manner that suits your business' needs.
From an event workflow perspective, there are a couple of different other ways you can implement an effective program. The method that Ronak suggests is similar to a "fan out" method, where an initial First Responder triages the event, and then escalates to the various elevated Business Groups for remediation/Incident Response. If you have dedicated analysts who already triage events from other tools, such as email gateways, web proxies, SIEM, IPS/IDS, etc., these analysts could potentially also triage DLP. Many larger organizations have a Security Operations Center (SOC) with analysts for initial triage, who can establish intial validity (True Positive vs. False Positive), context, and severity. Based off the initial Triage, then the event, which will turn into an actual Incident, can be escalated to next level remediation teams, such as Incident Response. The Incident Response team can establish the best way to remediate, which could include contact with the sender, contact with the sender's leadership, HR, or other.
Another method that can be effective is the "Fan In" method, but this method does require a somewhat mature DLP program. Fan In works by having the data element owners (i.e., the Businesses) perform initial triage and establish validity, context, and severity. If the event needs escalation as an Incident to other groups, these Businesses then will funnel the escalations to an established team like Incident Response.
You do not need to have all these different levels. Smaller programs can be successful by having the First Responder and Incident Response personnel as the same people/group. You simply lose a bit of the "separation of duties" aspect.
I hope this helps. Good luck!
Nick