microsoft-priva

Microsoft Priva

Microsoft Priva helps organisations manage privacy risk and fulfil data subject (privacy) rights requests for personal data held in Microsoft 365 and beyond. Priva is a separate SKU from Purview - confirm licensing before designing.

When to use

Use this skill when the user has a privacy programme obligation (GDPR, CCPA, LGPD, UK DPA) and needs to reduce personal-data risk or respond to subject rights requests at scale.

Do not use this skill for security DLP (use purview-dlp-policy), eDiscovery for litigation (use purview-ediscovery), or AI prompt data (use purview-dspm-ai).

Pick the right Priva solution

Priva is two distinct solutions sold under one brand. Pick the row that matches the trigger.

If the goal is...	Solution	Typical first policy
Find and reduce personal data overexposure across SPO/OneDrive	Privacy Risk Management — Overexposure	All-org overexposure of high-confidence personal SITs
Stop personal data transfers across borders or departments	Privacy Risk Management — Transfer	Cross-region transfer of personal data outside EU
Reduce data hoarding (long-retained personal data)	Privacy Risk Management — Minimisation	Inactive personal data older than retention obligation
Respond to GDPR Article 15 / CCPA Right to Know requests	Subject Rights Requests (SRR)	Access request workflow with redaction
Fulfil deletion / erasure requests	SRR (Delete request type)	Erasure with reviewer approval
Send privacy nudges to users producing risky behaviour	Privacy Risk Management — user notifications	Inline tip when sharing personal data externally

Rule of thumb: start with Privacy Risk Management - overexposure before SRR. You will get more SRRs than you can handle if your tenant is already leaking personal data; fix the leak first, then operationalise the request flow.

Approach

Order matters. Each step gates the next.

1. Classification prerequisite — Priva detects personal data using Purview SITs and trainable classifiers. Confirm at least the built-in personal-data SITs (national ID, passport, IBAN, driving licence, email, phone) match real items in your tenant via Purview → Content Explorer. Without this, Priva policies fire on nothing or on noise. Verify: Content Explorer shows non-zero hits for at least 3 personal-data SITs relevant to your region (e.g. UK NINO, EU national ID, IBAN).
2. Confirm licensing — Priva Privacy Risk Management and Priva Subject Rights Requests are separate add-on SKUs, not bundled in M365 E5 Compliance. SRR is licensed per request (paid bundles); Privacy Risk Management is per-user per-month. Buy before you build. Verify: portal shows Priva tile under Microsoft 365 admin centre with active SKU.
3. Privacy Risk Management — pilot in audit mode — Create your first overexposure policy in Test mode on a small site collection for 7-14 days. Review match volume and false-positive rate before turning on user notifications or remediation.
4. User notifications carefully — When you flip from Test to Active, notifications go to users who shared the data. This is your privacy programme talking to your workforce - get comms and HR sign-off on the wording first.
5. Subject Rights Requests workflow — Configure the SRR template: data sources (Exchange, SPO, OneDrive, Teams), reviewers, conflict-of-interest exclusions, redaction reviewer role, and secure delivery method. Test with a fake request before publishing the intake form. Verify: a dry-run SRR for a test user returns expected items and the reviewer can redact and approve before delivery.
6. Report & operate — Track SRR SLAs (GDPR = 30 days, extendable by 60), policy match trends, and user-notification dismissal rate. Feed insights back to the classification team.

Guardrails

• Priva depends on classification accuracy. Deploy after at least basic Purview SITs are validated; otherwise policies are noise.
• Coordinate with legal and privacy office before going live. SRR fulfilment is a regulated process - inadvertent disclosure of third-party personal data inside a response is a breach.
• Apply least privilege. SRR content is highly sensitive (the most sensitive in the tenant during the request window). Use scoped Privacy Management role groups, not Compliance Administrator.
• Reviewer separation of duties. The reviewer who approves redaction should not be the requester or the data subject's manager.
• SRR delivery format matters. Default PDF includes metadata; confirm the export format meets your regulator's expectations.
• Test-mode first, always. Privacy Risk Management policies in Active mode send user notifications - false positives erode trust in the privacy programme fast.

Common anti-patterns

• "Turn on SRR before classification." Requests return either nothing or the wrong items; you fail SLA on the first real request.
• "Skip Test mode to ship faster." First wave of user notifications fires on false positives; users learn to dismiss them and the programme dies.
• "Use Compliance Administrator for the privacy team." Grants tenant-wide compliance rights beyond Priva scope. Use Privacy Management role groups.
• "Build the SRR intake form before testing end-to-end." First real request exposes a reviewer-permission gap or a source-system missing scenario.

Example prompts

• Set up Microsoft Priva to manage subject rights requests (DSARs).
• Configure privacy risk policies for overexposed personal data.
• What licence do I need for Priva Subject Rights Requests?
• How do I support GDPR fulfilment and data minimisation with Priva?
• Which Priva solution should I roll out first?
• Automate DSAR collection and review with Priva.

Microsoft Learn

• Priva overview: https://learn.microsoft.com/privacy/priva/priva-overview
• Privacy Risk Management policies: https://learn.microsoft.com/privacy/priva/risk-management-policies
• Subject Rights Requests: https://learn.microsoft.com/privacy/priva/subject-rights-requests
• Get started / setup: https://learn.microsoft.com/privacy/priva/priva-setup
• Roles and permissions: https://learn.microsoft.com/privacy/priva/priva-permissions
• Licensing (Priva & Purview): https://learn.microsoft.com/microsoft-365/solutions/data-privacy-protection