Privacy-preserving reversible watermarking, as a subfield of secure signal processing, has received a growing research attention in the recent years due to privacy concerns in cloud computing. In this paper, we propose a novel reversible watermarking scheme for data exfiltration prevention. This scheme enables the cloud to embed labels that indicate the degree of confidentiality into the encrypted documents in such a way that the network administrator can monitor the document exfiltration through detecting the labels in the encrypted domain without compromising data privacy. An efficient watermarking algorithm is devised primarily based upon the concept of lexicographic permutations. In addition to this, a content-adaptive signal estimation mechanism is constructed for assisting host media recovery. Experimental results show that the proposed scheme outperforms the state-of-the-art with regards to watermarking capacity, fidelity, and recoverability.