Microsoft Priva

Microsoft Priva helps organisations manage privacy risk and fulfil data subject (privacy) rights requests for personal data held in Microsoft 365 and beyond. Priva is a separate SKU from Purview - confirm licensing before designing.

When to use

Use this skill when the user has a privacy programme obligation (GDPR, CCPA, LGPD, UK DPA) and needs to reduce personal-data risk or respond to subject rights requests at scale.

Do not use this skill for security DLP (use purview-dlp-policy), eDiscovery for litigation (use purview-ediscovery), or AI prompt data (use purview-dspm-ai).

Pick the right Priva solution

Priva is two distinct solutions sold under one brand. Pick the row that matches the trigger.

Rule of thumb: start with Privacy Risk Management - overexposure before SRR. You will
get more SRRs than you can handle if your tenant is already leaking personal data; fix the
leak first, then operationalise the request flow.

Approach

Order matters. Each step gates the next.

1. Classification prerequisite — Priva detects personal data using Purview SITs and trainable

classifiers. Confirm at least the built-in personal-data SITs (national ID, passport, IBAN, driving licence, email, phone) match real items in your tenant via Purview → Content Explorer. Without this, Priva policies fire on nothing or on noise. Verify: Content Explorer shows non-zero hits for at least 3 personal-data SITs relevant to your region (e.g. UK NINO, EU national ID, IBAN).

1. Confirm licensing — Priva Privacy Risk Management and Priva Subject Rights Requests are

separate add-on SKUs, not bundled in M365 E5 Compliance. SRR is licensed per request (paid bundles); Privacy Risk Management is per-user per-month. Buy before you build. Verify: portal shows Priva tile under Microsoft 365 admin centre with active SKU.

1. Privacy Risk Management — pilot in audit mode — Create your first overexposure policy in

Test mode on a small site collection for 7-14 days. Review match volume and false-positive rate before turning on user notifications or remediation.

1. User notifications carefully — When you flip from Test to Active, notifications go to

users who shared the data. This is your privacy programme talking to your workforce - get comms and HR sign-off on the wording first.

1. Subject Rights Requests workflow — Configure the SRR template: data sources (Exchange,

SPO, OneDrive, Teams), reviewers, conflict-of-interest exclusions, redaction reviewer role, and secure delivery method. Test with a fake request before publishing the intake form. Verify: a dry-run SRR for a test user returns expected items and the reviewer can redact and approve before delivery.

1. Report & operate — Track SRR SLAs (GDPR = 30 days, extendable by 60), policy match

trends, and user-notification dismissal rate. Feed insights back to the classification team.

Guardrails

• Priva depends on classification accuracy. Deploy after at least basic Purview SITs are

validated; otherwise policies are noise.

• Coordinate with legal and privacy office before going live. SRR fulfilment is a regulated

process - inadvertent disclosure of third-party personal data inside a response is a breach.

• Apply least privilege. SRR content is highly sensitive (the most sensitive in the tenant

during the request window). Use scoped Privacy Management role groups, not Compliance Administrator.

• Reviewer separation of duties. The reviewer who approves redaction should not be the

requester or the data subject's manager.

• SRR delivery format matters. Default PDF includes metadata; confirm the export format

meets your regulator's expectations.

• Test-mode first, always. Privacy Risk Management policies in Active mode send user

notifications - false positives erode trust in the privacy programme fast.

Common anti-patterns

• "Turn on SRR before classification." Requests return either nothing or the wrong items;

you fail SLA on the first real request.

• "Skip Test mode to ship faster." First wave of user notifications fires on false

positives; users learn to dismiss them and the programme dies.

• "Use Compliance Administrator for the privacy team." Grants tenant-wide compliance rights

beyond Priva scope. Use Privacy Management role groups.

• "Build the SRR intake form before testing end-to-end." First real request exposes a

reviewer-permission gap or a source-system missing scenario.

Example prompts

• Set up Microsoft Priva to manage subject rights requests (DSARs).
• Configure privacy risk policies for overexposed personal data.
• What licence do I need for Priva Subject Rights Requests?
• How do I support GDPR fulfilment and data minimisation with Priva?
• Which Priva solution should I roll out first?
• Automate DSAR collection and review with Priva.

Microsoft Learn

• Priva overview: https://learn.microsoft.com/privacy/priva/priva-overview
• Privacy Risk Management policies: https://learn.microsoft.com/privacy/priva/risk-management-policies
• Subject Rights Requests: https://learn.microsoft.com/privacy/priva/subject-rights-requests
• Get started / setup: https://learn.microsoft.com/privacy/priva/priva-setup
• Roles and permissions: https://learn.microsoft.com/privacy/priva/priva-permissions
• Licensing (Priva & Purview): https://learn.microsoft.com/microsoft-365/solutions/data-privacy-protection