One Excel email away from the front page.
Sensitive data lives in places nobody documented. Sharing controls are decorative. The next subject access request will take three weeks of panic.
Sensitive files in unmarked locations, two-week subject access requests, no DLP, last DPIA on a process that no longer exists. Fix it with a Microsoft Purview rollout. 18GB labelled in six weeks, DLP active, SAR turnaround down to two days.
If half of these sound familiar, this is your fight.
No formal assessment needed, just an honest look at the daily friction.
You don't know which datasets contain personal data.
Sensitive files travel through Teams, Outlook and personal OneDrives without classification.
Subject access requests take more than two weeks to fulfil.
Retention rules are documented but rarely enforced.
No DLP policies are active across the M365 tenant.
Your last DPIA was on a process that no longer exists.
Why it happens
No classification
Without sensitivity labels, every file is "default" , which means there's no friction on the wrong action.
Drifted inventories
The data map you built three years ago doesn't match what's actually in production today.
No automation
Retention, deletion and access reviews are manual, which means they don't happen consistently.
What it costs you
Breach exposure
A leaked sensitive file is 30 minutes from public, and 30 days from a regulator letter.
GDPR fines
Up to 4% of global turnover, plus the cost of incident response, notifications and trust loss.
Audit failure
Privacy auditors expect lineage, classifications and retention. Without them, every audit becomes a sprint.
The shortest path from problem to results.
Microsoft-first stack. Belgian and Estonian engineering. Senior team kickoff through delivery to support.
Microsoft Purview rollout
Sensitivity labels, DLP, retention, audit logs: live in your tenant within weeks, not quarters.
See solutionData classification & DPIA refresh
Automated discovery + labelling for personal data across M365, SharePoint, Dataverse and Fabric.
See solutionDefender + Microsoft Sentinel
Detection, response and audit logging integrated end-to-end, so anomalies surface in minutes, not weeks.
See solutionWhen 18 GB of unclassified files got labels in six weeks.
Purview rollout · 18 GB labelled, DLP active
A Belgian healthcare provider with no classification across 18 GB of clinical and administrative files. We rolled out Microsoft Purview with auto-labelling, DLP and retention. Subject access requests now resolved in two days. First privacy audit passed first time.
Privacy and security risk is tractable. Start with a label.
Free 60-minute risk assessment: we'll show you the three highest-leverage moves.
Common questions, direct answers.
What's the difference between Purview Information Protection and Defender?
Purview classifies and protects data (sensitivity labels, DLP, retention). Defender detects threats (suspicious access, malware, phishing). They work together. Most organisations start with Purview.
How aggressive should auto-labelling be?
Start advisory (suggests labels), move to enforced after three months. Automated labelling on personal data, financial records, and source code typically catches 70%+ of sensitive files without false positives.
What about M365 vs Fabric/Azure data?
Purview spans both. SharePoint, Teams, OneDrive, Outlook get labels via Information Protection. Fabric/Azure data gets the same labels via Purview Data Map: single classification taxonomy across all stores.
How fast can we close subject access requests?
With Purview eDiscovery + classification: from weeks to two days. The bottleneck used to be "find the data". Now it's reviewing what eDiscovery returns.
Do we need to label everything to be compliant?
No. GDPR requires you to know where personal data lives and protect it, not label every spreadsheet. We focus auto-labelling on high-risk file types and locations first.