Learn about Microsoft Priva
Privacy is top of mind for organizations and consumers today, and concerns about how private data is handled are steadily increasing. Regulations and laws such as the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) impact people around the world, setting rules for how organizations store personal data and giving people rights to manage personal data collected by an organization.
To meet regulatory requirements and build customer trust, organizations need to take a "privacy by default" stance. Rather than manual processes and a patchwork of tools, organizations need a comprehensive solution to address common challenges such as:
- Protecting the increasing amounts of unstructured data from privacy issues arising from human error
- Helping employees adopt sound data handling practices and training them to spot and fix issues
- Understanding the potential risks in the amount and type of personal data they store and share
- Fulfilling data subject requests, or subject rights requests, efficiently and on-time
Microsoft Priva helps you meet these challenges so you can achieve your privacy goals. Watch the video below to learn how Priva helps organizations safeguard personal data and build a privacy-resilient workplace:
How Priva helps your organization
Priva provides capabilities that help you:
- Proactively identify and protect against privacy risks such as data hoarding, problematic data transfers, and data oversharing
- Gain visibility into the storage and movement of personal data
- Empower employees to make smart data handling decisions
- Enable users to effectively manage data and take steps to comply with evolving privacy regulations
- Manage subject rights requests at scale
Priva's capabilities are available through two solutions: Priva Privacy Risk Management, which provides visibility into your organization's data and policy templates for reducing risks; and Priva Subject Rights Requests, which provides automation and workflow tools for fulfilling data requests. You can choose to purchase one or both modules to suit your organization's needs. Learn more about Priva solutions.
Find and visualize personal data
Understanding your privacy posture starts with having a thorough understanding of what content your organization is storing in Microsoft 365 that contains personal data, where it lives across the services you use, and the conditions under which it's managed. Priva helps organizations to discover personal data automatically and provide key analytics and insights to admins to help them understand the privacy issues and associated risks in their organization. The solution will evaluate where personal data in your organization is stored, how this data flows, and personal data trends over time.
These insights are presented within your Overview dashboard, which provides automatic updates about your data with important trends, and the data profile, which allows you to explore ongoing analytics. These insights help you understand privacy issues in your organization and to identify actions to remediate them.
To learn more, see Find and visualize personal data in Priva.
Manage privacy risks at scale
Complex data environments can present potentially risky scenarios for personal data. Priva Privacy Risk Management provides tools to detect these risks, establish policies and processes for remediation, and directly notify your users about issues and recommended actions to take. In this way you can inform and educate your users, along with enabling them to handle risk mitigation within tools they use every day. This can make a lasting, positive change in your organization’s privacy behaviors.
Priva provides built-in, customizable templates for establishing ongoing policies tailored to these scenarios:
- Overexposed personal data: Discover open and over-privileged personal data in your organization and prioritize remediation efforts to secure data. Easily manage access rights to this data to protect privacy and prevent inappropriate use.
- Data transfers: Detect and manage transference of personal data between departments in your organization or across country or regional borders. This can help reduce the risk of data exposure, or of stepping out of accordance with privacy regulations and laws.
- Data minimization: Identify personal data that doesn't need to be retained and prioritize remediation efforts to delete this data.
Once set up, you can evaluate your data on an ongoing basis, receive alerts when policy matches are detected, and set up email notifications to your users about recommended remediation steps and training about best practices.
To learn more, see Create policies in Privacy Risk Management.
Efficiently fulfill personal data requests
Certain privacy regulations around the world allow individuals, also referred to as data subjects, to make requests to review or manage personal data about themselves that companies have collected. For companies that store large amounts of unstructured information, finding the relevant data can be a formidable task.
Priva Subject Rights Requests provides you with the capability to automate data subject rights fulfillment with easy access to relevant data and customizable workflows that fit into existing business processes. When you search for data related to an individual, our subject rights request solution will automatically collect data from throughout your Microsoft 365 environment and help you to review the findings and produce reports. You can securely collaborate with multiple people in your organization to complete requests. You can also customize your workflows based on your business processes with built-in templates.
To learn more, see Learn about Priva Subject Rights Requests.
How Priva works with Microsoft Purview risk and compliance solutions
Microsoft Purview Compliance Manager
Priva can work hand in hand with Microsoft Purview Compliance Manager, which offers data protection and privacy assessment templates that correspond to compliance regulations and industry standards around the world. Based on the assessments you build with these templates, Compliance Manager can help you understand what steps to take to meet your organization's regulatory requirements. Taking steps in Priva to protect the personal data you store can contribute to your privacy assessments in Compliance Manager and can help improve your compliance score.
In preview: By taking specific actions in Priva, you can achieve points that count toward assessment completion and increase your overall compliance score. Examples of actions that Compliance Manager can monitor and give you credit for include setting up a Privacy Risk Management policy, and enabling data retention limits for subject rights requests. Compliance Manager automatically detects whether you've completed the actions and awards points that contribute to your compliance sore. Learn more about automatic testing of improvement actions.
- To access Compliance Manager: Users who hold a Priva role won't automatically have the necessary role to access and work in Compliance Manager. See permissions and roles needed for Compliance Manager and talk to your IT admin if you need to be assigned a role.
- To find Priva actions in Compliance Manager: In Compliance Manager, go to the Improvement actions tab. On the Solutions filter, select "Priva Privacy Risk Management" and "Priva Subject Rights Requests."
Microsoft Purview Data Loss Prevention
Microsoft Purview Data Loss Prevention (DLP) provides robust capabilities to help prevent the unintentional sharing of sensitive items outside of an organization. Priva can extend this protection by delivering insights unique to your organization and empowering your users to address risks right away. For example, when you use Privacy Risk Management to detect transfers of personal data outside of your organization or between certain departments, users can receive email notifications with remediation actions right in the email. Get more details about user email notifications in Privacy Risk Management.
How and where Priva identifies items with personal data
Personal data is typically personal information that is related to a living person that can be used to identify that person. It may be a data type that can directly identify the individual, such as a name, passport number, social security number, and so on, or combinations of different data types that can be used to identify the individual. The definition of personal data or personal information may vary under applicable law, so make sure you understand the types of data for which you have legal obligations.
Priva utilizes foundational capabilities of Microsoft 365 to help you identify these personal data types based on your settings, through the use of sensitive information types (SIT). To review the list of all defined sensitive information types, see Sensitive information type entity definitions. Organizations that create custom SITs can use those SITs in Priva.
Priva evaluates your organization's data stored in the following Microsoft 365 services within your Microsoft 365 tenant:
- Exchange Online
- SharePoint Online
- OneDrive for Business
- Microsoft Teams
Priva evaluates only data within your organization's Microsoft 365 environment. It does not access personal data that isn't part of the organization's Microsoft 365 environment. For example, it doesn't access a user's personal Microsoft 365 account.
Watch a 13-minute video explaining Microsoft Priva features from Microsoft Mechanics on YouTube.
For more information about how Microsoft approaches privacy and safeguards your data, visit Microsoft Privacy.
To begin using Priva, see Get started with Priva.