Review data for a subject rights request
After data has been collected for a subject rights request, the next stage is to review the content items, decide what items to include or exclude as part of the request, and redact information if necessary.
Tasks for completing the data review
The Review data stage is when collaborators examine the content items on the Data collected tab. A Teams channel will automatically be set up to facilitate content review by all stakeholders. See Collaboration for data review below for more details. The essential tasks for the data review step are listed below:
- Import other files
- Start with priority items
- Filter the item list
- Mark items as Include or Exclude
- Download files
- Apply data review tags
- Redact content
- Enter notes about a file
Note
Delete requests involve an additional approval substage at the review data step. See details at Create and manage a delete request.
Import files
When fulfilling an Access or Export request, you may want to bring other content items into the request to consolidate your review and output for the data subject. For example, files stored outside your organization's Microsoft 365 environment, or other items you think are relevant but weren't scoped in the search. You can import files into the Data collected tab of an individual request to be reviewed and worked on, along with the other items. Imported files are added to the same Azure Blob Storage container with the other content items retrieved from your search.
Follow the steps below to import files:
From the request details page, select Import files from the command bar at the top of the page.
An Import files box will appear on the screen. Select Choose files, and from your file explorer view, choose one or more files to import.
You'll be taken back to the Import files box, which lists the files you chose. You can select Choose files again to add more items to the list. To remove any of the files, select Clear, which removes all files, and choose files again.
When all desired files are listed in the Import files box, select Import. To exit without uploading, select Cancel import.
When the import begins, you'll be taken back to the request's Data collected tab. A message above the tab indicates your upload is in progress. If there's a problem with the upload, the message will tell you and provide an option to retry.
You'll see a confirmation message above the Data collected tab when the import is complete.
More details about importing files:
The maximum file size for importing is 500 MB. You'll see a warning message on the Import files box if a file exceeds the limit.
It may take up to 20 minutes before the imported files are available in the Data collected tab.
If an import is already in progress for one user, the same user won't be able to upload more files until the previous upload process finishes. Multiple users can upload files to the same request simultaneously. However, the more uploads that are in progress, the longer they'll take to complete. Status messages on the request will inform when an upload has finished and files are ready to review.
Start with priority items
The Priority items to review tile on the requests's overview page shows the number of content items flagged for potential conflicts. We recommend starting your data review by looking at these priority items first. Learn details about priority items and how to find them in your list of items.
An example of a conflict is an item that you decide should be deleted as part of a delete request, yet that item has a retention label, which prevents it from being deleted. In this scenario, if you mark the item as Include, you'll see the conflict listed on the Include item flyout pane with a warning message about the conflict.
Filter the item list
Above the list of items on the Data collected tab are a set of static filter options, such as Keywords, Review status, and Tags. To apply any of these filters, select the down arrow next to the filter name and enter the requested filter criteria.
Tip
Filtering by Keywords can be very helpful in identifying a specific subset of items associated to the data subject. You can input multiple keywords separated by a semicolon. The keyword text field is wildcard supported; you can add the wildcard character (*) before or at the end of a word to find variations of that word.
Find more filters by selecting the Filters command above the list of items. A Filter flyout pane will display with a list of extra filter sets; for example, item name, personal data types, or recipients. Check the box next to the filter set you want to apply to your list of items. The Site/path filter, like the Keyword filter, is wildcard supported.
When you're done choosing filters, select Done. Your list of items is now filtered according to your choices.
If you apply filters and then navigate away from the Data collected tab, the filter criteria resets. When you come back to the Data collected tab, you'll have to reapply any desired filters.
Mark items as Include or Exclude
Review the items listed on the request's Data collected tab to determine whether they contain the data subject's personal data. To review the content in each item, select the item's name on the list of items. The content will appear in the content review area to the right of the table. If the content doesn't display, you can download the item to review it using these instructions.
Tip
The Plain text tab of the content review area highlights text that matches the data subject identifiers you provided when you created the request (see step 4 of the guided process for creating a request). Identifiers are highlighted when they appear in the body of an email, a document, or other content item. Identifiers aren't highlighted when they appear in email or document headers.
If you decide that the item should be included as part of the final report back to the data subject, select Include on the command bar across the top of the list of items. You can also select the blue Include button in the content review area to the right of the list of items. When you select Include, a flyout pane appears with an option to add notes. When you're done, select Submit to save the item's review status as Include.
If the item doesn't belong as part of the request, you can select Exclude on the command bar or the Exclude button in the content review area. Marking an item explicitly as Exclude is often required for internal records.
By default, only items you mark as Include will be included in the final reports that are generated for the data subject.
Note
If you mark an item as Exclude, you're required to add a note as justification for why it doesn't pertain to the subject rights request. Notes are for internal purposes and aren't included in final reports.
If the content appears to be a false positive for your search query, select Not a match and on the flyout pane, select Confirm. This action will flag the item as something that shouldn't have been detected in the search.
Download files
If an item's content won't display in the content review area, you can download the item to your local computer to review and make any necessary redactions. To download an item, select its name from the item list, then select the Download command to the left of the search box above the item list. If you need to make redactions to the item, save the changes to the item on your local computer, then reimport the item following the import instructions.
Apply tags
Data review tags can be used to help you identify and mark items that may need further attention. For example, applying a tag can be useful to ask collaborators to review a specific set of files. Data review tags don't perform or initiate any action on a content item.
There are 23 total data review tags. Two are default tags named Follow-up and Update, for which you can set a description. The other 21 are custom tags that you can name and describe.
Learn how to manage your tags in Priva Settings. Tag settings apply to all of your subject rights requests.
To add or remove tags for a single item:
- Select the item from the list on the Data collected tab of the request.
- In the item preview area to the right of the list, select the Apply tags button on the bottom row. You can also select the three dots to the right of the item name and select the Apply tags option, or select the tags icon in the command bar above the item listing.
- A flyout pane appears with the list of tags. Check the box next to any of the tags you want to apply to the item. Unchecking a checked box will remove the tag.
- When you're done select Save, which saves your tag selections and closes the flyout pane.
To add or remove tags for multiple items:
- Select the first item from the list on the Data collected tab of the request.
- Select the check box next to other items in the list to perform the same tag change.
- In the area directly above the item listing, select the Apply tags command.
- In the drop-down that appears, select Add or Remove.
- A flyout pane appears with the list of tags. Check the box next to any of the tags that you want to add or remove.
- Add notes if desired to each selected file. Notes are for internal reference only and not visible to data subjects.
- Select Save to save your selections and close the flyout pane.
To add custom tags or update tag descriptions:
- From the Subject Rights Requests page, select Settings in the upper right corner of your screen to get to your Priva settings.
- Go to the Data review tags page, and select the tag to input a description and, for the custom tags, a name. Learn more about tag settings.
To export a list of tagged items:
- Go to the Data collected page in a subject rights request.
- Above the list of items, select the Export command.
- An Excel file will download which shows the properties for all the items collected by the search for the request. Find the Tags column to identify and sort the items by tag.
Redact content
When you include an item for the request, it's important to ensure that other individuals' personal data doesn't appear in content that gets provided back to the data subject. There could also be sensitive information related to your organization or other irrelevant information that you want to block out. You can redact content by going to the Redact tab in an item's content review area.
How to apply redactions
There are different ways you can look for and apply redactions:
- Use Search and redact (preview) to enter a value that, if found, will be highlighted; you can then quickly apply redactions if you wish.
- Manually apply redactions as you review each content item by using the annotation commands located above the content preview area.
Note
Review a list of current redaction limitations.
What happens to an item when you apply redactions
When you apply redactions to an item, a PDF version of the item will be created so that the redactions are visually represented in the PDF. The original file remains unaltered and stored in its original location. The redacted item is the version that's included in the data package for you to provide back to the data subject for Access or Export requests.
Search and redact (preview)
Note
The Search and redact feature is in preview. In order to use this feature, customers need an active trial or a paid available license for Priva Subject Rights Requests. Learn more about Priva subscriptions and licensing.
Preview features allow Microsoft and customers the opportunity to evaluate and understand the new feature before it goes to general availability (GA). This preview is voluntary, and use is subject to terms applicable to "Previews" as detailed in the Universal License Terms for Online Services section of the Microsoft Product Terms and the Microsoft Products and Services Data Protection Addendum("DPA"). During preview, we'll continue to refine the feature. Once preview is completed, it will become generally available with formal support.
Note
Preview features aren't available for US Government Community (GCC) Moderate, GCC High, and Department of Defense (DoD) customers.
When you select an item that supports redaction on the Data collected tab, there will be a Redact tab in the content review area next to the list of items. On the Redact tab, use the Search and redact command underneath the Search instances counter to search for a custom value of your choosing within an item. If any matches are found, you can mark them for redaction. The Searched instances counter on the Redact tab reflects the total number of matches found for your searched values.
To search for a custom value and apply redactions:
On the Redact tab, select Search and redact.
On the Search and redact flyout pane, enter a value in the search box, then select Add. You can enter one or more words to represent an individual value to search for. To search for additional values, repeat the process for each value. Searches aren't case-sensitive.
If a match is found, it will be listed under the Value column and its number of instances in the item will be reflected in the Search instances counter.
Check the circle next to the value in the list and select the Redact command underneath the search box. This action will redact all instances of the value within the item. The value's Status column changes from Not redacted to Redacted. The Redactions counter on the pane now reflects total number of instances redacted.
Select Close on the flyout pane, which takes you back to the Redact tab. You'll see the redactions applied in the item's content review area and the Total redactions counter increases by the amount of redactions you applied.
Tip
It can take several seconds to complete actions on the Search and redact flyout pane, depending on the number of instances found. A dynamic loading bar indicates that actions are in progress and the Close button is disabled. When actions are complete, you can select Close."
To remove redactions on all instances of a value:
On the Redact tab, select Search and redact.
On the Search and redact flyout pane, check the circle next to the value and select the Remove redaction command. The Redactions counter will decrease by the number of instances that were unredacted.
Select Close.
To remove a value from the list, which will also remove redactions on all instances of that value:
On the Redact tab, select Search and redact.
On the Search and redact flyout pane, check the circle next to the value and select the Delete command. The Searched Instances count will decrease by the number of instances for that value. If redactions were performed, the Redactions counter will also decrease by the number of instances that were unredacted.
Select Close.
Tip
If there are multiple instances of a value and you don't redact all instances, the Redaction status for that value reads Partial. Hover over the Partial status to see how many instances are redacted out of the total number.
You can also remove individual redactions. In the content review area, select the redaction box, then select the x in box's upper right corner.
Editing the text on a redaction box
By default, the word "Redacted" appears on top of a redaction box. The data subject will see this text on items provided to them in the final data package. You can edit the text that appears on a redaction box by following the steps below.
To change the text on a redaction box for a custom value you redacted:
On the Redact tab, select Search and redact.
On the Search and redact flyout pane, for any value where the Status is set to Partial or Redacted, check the circle next to the value you're updating.
Select the Annotate command and choose Update annotation.
In the pop-up window, enter a value. We recommend using a short value to better fit on smaller redaction boxes.
Select Apply. The Annotation column updates with your selection.
Select Close on the flyout pane, which takes you back to the Redact tab. You'll see the redactions for that value now have the typed text on the box, if it fits.
To reset the value back to the default on redacted instances, follow steps 1 and 2 above, and at step 3, choose Remove annotation.
Tip
You can apply a transparency view to see through the redaction without removing the redaction. On the annotation command bar, select the tool on the far right, which reads on hover Toggle annotation transparency.
Manually redact
You can manually create inline mark-ups and redact content using the annotation commands located just above the content review area on the Redact tab.
Tip
Use the Search command (the magnifying glass icon) near the bottom of the content review area to quickly find the text you want to redact. Type the text you're looking for in the search text box, then select the Next and Previous arrows to the right of the search box to navigate to the next instances.
To redact an area of text: Go to the Drawing tool in the command bar (the third from the left) and from its dropdown menu, select Area redaction. Then use your cursor to draw a text box that covers the area of text you want to block out. When you're done drawing the box, you'll see the text area blocked out.
To remove all redactions on a page or within the entire item: From the Drawing tool, select Remove drawings on current page to remove all redactions on the current page within the item, or select Remove all drawings in document to remove all redactions within the item.
To remove an individual redaction: Using the Select annotations tool (the pointer icon on the far left) on the command bar, select the redaction box that you want to remove, then select the x in the box's upper right corner. The redaction will be removed.
Tip
You can apply a transparency view to see through the redaction without removing the redaction. On the annotation command bar, select the tool on the far right, which reads on hover Toggle annotation transparency.
Redaction limits
Limits on how redactions are retrieved or displayed are explained below.
Redact tab available on supported files: When you select an item on the Data collection tab that supports item preview and redaction, a Redact tab appears in the content preview area. Certain files, namely archives such as .zip files, need to be expanded in the list in order for you to select the items within and use available redaction features.
Searches are detected on a per-page basis: This means that if a value crosses over from one page to the next (for example, your search value is a person's first and last name, and the first name appears at the end of one page and the last name appears at the beginning of the next page), the value won't be detected in this instance.
Longer search time for items over 50 pages: For any content items that are over 50 pages in length, it may take longer to search for a value or perform actions on a value, such as redact, remove redaction, and annotate.
Limit of 500 annotations per item: Annotations include any Search and redact instances that are found (highlighted but not yet redacted), any applied redactions, and any manually applied drawings. A notification indicates that you've exceeded the annotation limit, and you won't be able to add any more annotations. We recommend removing any Search and redact highlights that you don't intend to redact.
Enter notes about a file
To add or review notes on an item, select the item from its row and go to the File Notes tab in the content review area to the right. You can also use the Add file note option to create a new comment. To review or add notes at an overall case level, go to the main Notes tab above and use Add case note. These notes will be visible to users working on the request, but won't be included in the final report or otherwise shared with the data subject.
Collaboration for data review
Subject Rights Request Administrators can view all requests. You can add other users as collaborators for the request. When a user is added as a collaborator, that user is automatically granted a Privacy Management Contributors role, which provides them access to view that request and work with the data collected within it to help move the request to completion (learn more about Priva roles).
The Collaborators tab on the request details page shows all the collaborators who can view and contribute to the request and to any associated Teams channel. To add collaborators to a request:
- On a request's details page, go the Collaborators tab.
- Select the Add collaborator command under the tab.
- In the Add collaborator window, begin typing the user's name, select the name once it appears, then select Add.
Important
After adding a collaborator, you'll need to send them a direct link in order to access the reqeust's details page. Get the link by selecting Share in the upper-right corner of the request details page, then select Copy link.
When you create a request, a dedicated Teams channel is automatically created for collaborators to discuss the request and safely share input. To start a Teams chat, any collaborator can select Chat with collaborators in the upper right of the request's details page. This action opens Teams and places you in the General channel for your subject rights request's Team site.
To remove a collaborator, select their name from the list of collaborators and select the Remove collaborator command. Removing a collaborator removes the user from the list of Collaborators and from the request's Teams channel. The user who created the request can't be removed as a collaborator.
You can change the default behavior of creating Teams channels for subject rights requests by going to Priva Settings in the top right corner of Subject Rights Request. Select Teams collaboration, then uncheck the box on the page to turn off Teams capabilities for all subject rights requests.
Complete the review
When all items have been reviewed and you've set their status as Include, Exclude, or Not a match, it's time to close out the review step. Any of the collaborators on a request can complete the review.
Select the Complete review button in the upper right corner of the request. A flyout pane will show a summary of the data and add any related notes. These notes are for internal record keeping and aren’t shared with the data subject.
Select Complete review on the flyout pane to finish the review step. This action prepares the request for the final stages of the process: generating reports and closing the request. Summaries of your decisions will be provided later under the Reports tab.
Next steps
Learn how to generate the final report and work toward completion of the request at Generate reports and close a request.