Understanding EU GDPR from an Office 365 Perspective
GDPR turns personal data into a board-level liability: it applies directly in every EU Member State, it reaches any business anywhere that handles the data of people living in the EU, and it puts a 72-hour clock on breach notification. In this article we will try to clarify the role of GDPR from an IT viewpoint, in particular with a Microsoft 365 perspective. Moreover, we will introduce an open source tool called GDPR Activity Hub, which is available for free to help partners and customers to process the most common IT tasks related to GDPR.
GDPR took effect on 25 May 2018, and its text has held steady since. What has moved is the Microsoft 365 estate it applies to. Copilot and other AI assistants now read across mail, files, and chat at each user’s existing permissions, so a document someone was never meant to open can surface in a generated answer within seconds. That drags the original GDPR question back to the front: who can reach personal data, and who is accountable for that access. An assistant inherits the permissions it is handed, so those permissions are what you have to get right.
What is the EU GDPR? Does it matter for you?
The first question to give an answer to is: “What is the EU GDPR?”. GDPR stands for General Data Protection Regulation (ref. Regulation EU 2016/679), and it is a regulation from the European Union with the scope to protect data of all individuals living in the EU.
The fact that it is a regulation means it is immediately applicable and enforceable by law in all Member States, without the need for a specific transposed national law in each Member State. GDPR went live on May 25th, 2018. Since that date, every business anywhere in the world, not only in the EU, that handles the personal data of anyone living in the EU has had to follow the rules of GDPR and comply with the regulation.
As you can see, from an IT perspective, organizations need to train privacy personnel and employees, audit and update data policies, in some cases appoint a Data Protection Officer, a job role introduced by the GDPR, and create and manage compliant vendor contracts.
Moreover, still from an IT perspective, businesses need to keep track of events and requests related to personal data of data subjects. For example, the GDPR states that every single EU citizen has the right to access, correct, or erase her/his data that is stored by a third party. From an IT perspective you will have to keep track of such requests related to personal data, through whatever kind of logging system of your choice.
Furthermore, in case of any issue (like a Data Breach) or any potential issue (like an Identity Risks/Theft) you will have to keep track of these events and behave accordingly to the GDPR requirements. For example, in case of any Data Breach event, the GDPR states that: “as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it.” A supervisory authority can be a Data Protection Authority (DPA).
Thus, the GDPR introduces some new requirements, which can become a challenge for customers and a new business opportunity for partners. In fact, customers will need to have internal processes to manage those requirements, and they will need to have workflows to manage those processes.
Microsoft 365 and the GDPR
Considering that most businesses today keep some of their data and processes in the cloud, using Software as a Service (SaaS) offerings like Microsoft 365, it’s worth working out what can be done out of the box with Microsoft 365, from a GDPR requirements perspective.
First of all, it is important to highlight that in February 2017 Microsoft announced that its cloud services would comply with GDPR by May 25, 2018. Microsoft 365 now includes a range of services and tools that help businesses verify their compliancy and their level of security, monitor events, and prevent data leaks. In the following schema you can see, divided by category, the most useful services and tools available out of the box in Microsoft 365.
Notice that some of the above services require specific subscription plans (like E3 or E5) or dedicated SKUs (product licenses). However, covering licensing is out of context for this article.
For example, the Microsoft Secure Score, available in the Microsoft 365 security portal, gives you a measure of how secure your tenant is, comparing your services settings with a baseline provided by Microsoft. Moreover, it gives you “actions” that you can accomplish to improve your score. Clearly, whatever will be your score, there is no guarantee that you will not be breached. Nevertheless, a high score can let you be more confident about the strength of your environment.
Services like Data Loss Prevention (DLP) enable you to identify sensitive/personal data as it travels through Exchange Online, SharePoint Online, and OneDrive for Business. You can eventually prevent accidental sharing of sensitive information and you can help users stay compliant. Moreover, you can collect useful data about DLP, which can be used to report events and content matching policies.
For example, using DLP you can prevent users to share specific categories of documents, using content-based rules or labels applied to content (manually or automatically). In case a user shares sensitive or classified content, DLP will prevent him or her from having a data leak and will show an informative message that explains why the action is forbidden.
Services like “Customer Lockbox” ensures that Microsoft engineers do not get access to the customer’s content without customer’s explicit approval. In fact, all access is obtained through a rigorous access control technology and administrators of the tenant can approve or reject the access request.
Services like Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and the data governance capabilities now in Microsoft Purview provide proactive and intelligent capabilities that protect your users and help prevent data leaks from your company perspective.
Moreover, the unified audit log in Microsoft 365, now part of Microsoft Purview, allows administrators to search for users’ activities and events, which can be useful to keep track of all of the happenings from a GDPR perspective. For example, using the unified audit log you can determine who deleted a file, or who shared a file with someone else, etc. The areas and services that you can inspect through the unified audit log include:
- Files
- Folders
- Sharing and Access Requests
- Synchronizations
- Site Administration
- Exchange Mailboxes
- Sway
- User Administration
- Microsoft Entra ID Group Administration
- Application Administration
- Role Administration
- Directory Administration
- eDiscovery
- Power BI
- Microsoft Teams
- Dynamics 365
- Power Automate
Last but not least, from a SharePoint Online perspective, you can configure your tenant to support classification of sites. Sites classification allows you to apply a policy level (classification) to every modern site that you create, so that you can create custom policies and automation/governance rules based on the classification level of a site. Just for the sake of making an example, whenever users create a site classified as “GDPR” maybe you want to automatically enforce security rules and custom policies to protect data stored in that site.
GDPR Activity Hub
If you are a big enterprise with an internal development team, or if you are a Microsoft partner selling solutions to third parties, most likely you will be interested in discovering the GDPR Activity Hub. The GDPR Activity Hub is an open source project, hosted under the SharePoint & Office 365 Patterns & Practices (PnP) umbrella, which allows you to handle the most common activities related to collecting requests and events that are GDPR related.
The project is fully open source and can be downloaded from GitHub. It is a showcase of Microsoft technologies like:
- SharePoint Online modern sites
- SharePoint Framework client-side web parts
- Microsoft 365 Groups/Microsoft Teams
- Remote provisioning
- Power BI
Out of the box, the functionalities offered by the GDPR Activity Hub are:
- GDPR Dashboard: a dashboard based on Microsoft Power BI that you can use to measure your performances about GDPR events and requests (see the GDPR Activity Hub home page in the above figure).
- Data repository based on SharePoint Online: it uses SharePoint online as the default repository for data, but you can customize it and replace SharePoint with a regular DBMS, if needed.
- Custom pages for data management: a bunch of custom pages for data entry of events and requests that need to be monitored and logged from a GDPR perspective.
- Client-side web parts: few client-side web parts, built using the Microsoft SharePoint Framework, useful to insert requests and events, to design a GDPR hierarchy for the current company, and to manage tasks related to any GDPR process.
- Sample workflows to process data breaches and some other sample events/requests.
The project can be installed automatically in your own Microsoft 365 tenant, just by following the step by step setup guide provided here. However, the project is not meant to be a “ready to go” product, rather a starter kit to help you build your own products. Thus, aside from playing with it in your own environment, you should start building your own solution on top of it.
Please, notice that installing the GDPR Activity Hub in your tenant does not mean that you will be GDPR compliant. Moreover, because it is not a product, do not expect to have any kind of Service Level Agreement (SLA) or guarantee. It just works based on community efforts, and your feedbacks and your contribution will be more than welcome, if any!
Wrap up
To wrap up this article: GDPR is in force, and the duty is ongoing. Whatever your business is, whatever the size of your business is, and wherever your business is located, you need to know how you collect and monitor the data that matters under GDPR. Microsoft’s own assessment materials are a reasonable starting point.
If you are moving to the cloud, and to Microsoft 365 in particular, the out of the box services and capabilities above can help you meet GDPR requirements.
The GDPR Activity Hub is worth a look too.
One thing has not changed since this article was written: compliance rests on knowing what data you hold, where it sits, and who can reach it. That is a board-level question of compliance, and it is what Rencore’s Digital Workplace module is built for, giving you one control plane to inventory content, sites, and access across Microsoft 365, rank the exposure by risk, and enforce the policy that closes it. It complements and extends Microsoft Purview and Entra rather than replacing them.
Thank you!
This blog post has been originally published on Paolo’s blog
Would you like to find out more about EU GDPR from an Office 365 Perspective? You can view a recording of Paolo’s Rencore webinar. Simply click the button below and fill in the short form. We will send you the link to the webinar recording via email.
Last updated 12 March 2024
