Ghani Governance · Microsoft Purview
UK GDPR and data privacy
The UK GDPR and the Data Protection Act 2018 require organisations to process personal data lawfully, keep it secure, hold it no longer than necessary and respond to individuals’ rights, such as subject access requests, within one month. Ghani Governance configures Microsoft Purview so those duties are workable in Microsoft 365: finding personal data, protecting it, retaining it correctly and searching it for DSARs.
What is GDPR? GDPR meaning in plain English
The General Data Protection Regulation (GDPR) is the EU law on personal data; after Brexit the UK kept it as the UK GDPR, alongside the Data Protection Act 2018. Personal data is any information relating to an identified or identifiable living person – often called PII (personally identifiable information) in US usage. GDPR compliance means having a lawful basis, being transparent (your privacy policy), applying privacy by design, securing data and handling rights requests. Primary source: the ICO’s UK GDPR guidance.
Where Microsoft Purview helps with data protection
Subject access requests (DSAR)
A subject access request must be answered without undue delay and within one month, extendable by up to two further months for complex or multiple requests; since the Data (Use and Access) Act 2025 the clock can pause while you seek clarification, and searches must be reasonable and proportionate. Purview eDiscovery and Priva can find a person’s data across mailboxes, OneDrive, SharePoint and Teams.
Right to be forgotten
Erasure requests need you to locate the data and know which retention duties override deletion. Purview retention and records management make that decision traceable.
DPIA
A data protection impact assessment (DPIA) is mandatory for high-risk processing, including many AI uses. Purview data classification and DSPM for AI give the DPIA real data rather than guesses.
Data breach
A personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms. Purview audit and DLP alerts help establish what was exposed.
GDPR compliance checklist for Microsoft 365
- Know where personal data sits (data classification and sensitive information types).
- Protect it (sensitivity labels and DLP).
- Keep it only as long as needed (retention policies).
- Be able to find it for DSARs and erasure (eDiscovery, Priva).
- Log access (audit).
- Assess new processing, including AI and Copilot, with a DPIA.
- Agree roles with your data protection officer (DPO) where you have one.
This is a technical checklist, not legal advice. Data privacy regulations change; we are not a law firm.
How long does a company have to respond to a DSAR?
One month from receipt. That can be extended by up to two further months for complex or multiple requests, provided you tell the person within the first month. Exemptions exist (for example, legal privilege, or a request that is manifestly unfounded or excessive), but they are narrow. A DSAR (data subject access request) is the same thing as a subject access request. Purview eDiscovery and Priva make the search reasonable and proportionate rather than a manual trawl.
What does GDPR compliance mean in practice?
GDPR compliance means following the seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. You also need to respect individuals’ rights. Purview helps most with security, storage limitation and accountability evidence.
What is privacy by design?
Privacy by design means building data protection into systems and processes from the start, rather than adding it afterwards. UK GDPR Article 25 makes “data protection by design and by default” a legal duty. By default means collecting and exposing only the personal data needed. In Microsoft 365 that translates into default sensitivity labels, DLP and retention configured before a new workload or AI tool goes live.
AI privacy and data privacy regulations
AI privacy risk is mostly ordinary data privacy risk at greater speed: personal data pasted into prompts, used to ground answers, or retained in logs. See Microsoft 365 Copilot data security and AI data security threats.
GDPR enforcement news
Searches for GDPR enforcement news, “GDPR enforcement news today”, “GDPR fine news today”, “data privacy regulation news today” and “data privacy law news today” are best answered by the regulators themselves: the ICO enforcement page and the European Data Protection Board news. We do not republish fines or quote figures from memory.
Data protection questions
Are you a data protection officer service?
No. We implement Microsoft Purview technical controls. We work with your DPO or legal adviser, and we do not provide legal advice.
Is UK GDPR different from EU GDPR?
They are very similar in substance. The UK version sits with the Data Protection Act 2018 and is regulated by the ICO.
Book a discovery workshop
A scoping conversation about what you need to protect, what is already configured, and what must not break.