Managing Regulatory and Privacy Requirements

Organizations need to be keenly aware of their obligations in relation to regulatory compliance. This can be challenging, especially for smaller businesses that may not have a dedicated compliance or data protection officer. It is important to recognize and implement the correct settings and controls in Microsoft Purview to ensure that you are observing the appropriate standards and regulations.

Equally (and increasingly) important is the awareness and implementation of privacy settings and controls. Data subjects have the right to privacy and are entitled to the expectation that data relating to them is appropriately protected, not overexposed, and only retained for as long as it is needed.

In this chapter, we will explore the available technologies in Microsoft Purview that allow you to plan for regulatory compliance and privacy within Microsoft 365. We will learn how to use the rich features of Compliance Manager within Microsoft...

Planning your regulatory compliance journey in Microsoft 365

To start planning for regulatory compliance using Microsoft 365, organizations should be aware of the rules and regulations to which they need to adhere to be considered compliant by regulatory bodies and standards. These include the General Data Protection Regulation (GDPR), which comprises rules for organizations that offer goods and services to people in the European Union (EU) or ones that collect and analyze data for EU residents regardless of where they or their organization may be located. The GDPR provides individuals with the right to manage any personal data that relates to them that has been collected by an organization. The individual can exercise these rights by lodging a Data Subject Request (DSR). The organization must respond in a timely fashion to DSRs and also perform Data Protection Impact Assessments (DPIAs).

Some of the terms and references you may encounter in relation to GDPR include the following...

Managing regulatory compliance in Microsoft Purview Compliance Manager

In this section, we will learn about Microsoft Purview Compliance Manager – first by accessing this feature and the required roles and permissions, then by viewing and implementing improvement actions, as well as the available assessments and assessment templates.

Access to Compliance Manager

Compliance Manager is accessed via the role-based access control (RBAC) model. When using Compliance Manager for the first time, it is recommended to log in as a global admin and then set the required access permissions to other users. To set the required access for Compliance Manager, complete the following steps:

1. Log in to the Microsoft Purview compliance portal at https://compliance.microsoft.com and navigate to Permissions from the menu pane on the left:

Figure 16.1: Permissions within Microsoft Purview Compliance Manager

2. Under Microsoft Purview solutions, select...

Exploring Microsoft Priva

Microsoft Priva is one of the newer additions to the Microsoft Purview suite of products. Although privacy is a category of its own, strictly speaking, and not really under the banner of compliance as such, the Priva solutions are included within the Microsoft Purview compliance portal. This is an understandable decision from Microsoft considering that there is no dedicated privacy admin portal at this point in time. In the absence of a privacy admin center, Purview is the logical location for these solutions.

There are currently two Priva solutions: Privacy Risk Management and Subject Rights Requests. These solutions are not part of any existing subscription such as Microsoft 365 E5 and must be enabled as add-on licenses. First, let’s take a look at Privacy Risk Management.

Implementing privacy risk management

Microsoft Priva Privacy Risk Management allows organizations to set up policies to identify any privacy risks in their Microsoft 365...

Summary

This chapter introduced the principles of managing regulatory and privacy requirements using the features and solutions available in Microsoft Purview. We learned how to plan an organizational compliance journey in adherence to regulatory standards such as GDPR. We also learned about the capabilities of the Microsoft Purview Compliance Manager and how it can be used to work with improvement actions, assessments, and assessment templates to improve your compliance posture and score. Finally, we learned how to use Microsoft Priva to manage our privacy requirements in Microsoft 365 and how to create, manage, and edit policies to minimize and manage risks such as data exposure. We also examined how, with Subject Rights Requests, we can respond to requests from data subjects regarding any personal data that our organization may be storing about them.

The next chapter will cover the principles of managing the Insider Risk Management controls and policies in Microsoft Purview and...

Questions

1. Which of the following is not one of the options within an assessment in Compliance Manager?
   1. Microsoft actions
   2. Controls
   3. Custom actions
   4. Your improvement actions
2. Which of the following are available policy templates in Microsoft Priva Privacy Risk Management (choose two)?
   1. Data compliance
   2. Data management
   3. Data overexposure
   4. Data minimization
3. True or false? Microsoft Priva Subject Rights Requests licensing must be allocated on a per-user basis:
   1. True
   2. False
4. What should you create to batch assessments together?
   1. An improvement action
   2. A group
   3. A product
   4. A template
5. True or false? Users with the Privacy Management role group can access all the features of Microsoft Priva:
   1. True
   2. False
6. Which of the following are types of assessment templates (choose two)?
   1. Premium templates
   2. Included templates
   3. Standard templates
   4. Advanced templates
7. True or false? Improvement actions can be assigned to other users to test and implement:
   1. True
   2. False
8. How many hours can action points in an improvement...

Further reading

Please refer to the following links for more information:

• Microsoft compliance offerings: https://learn.microsoft.com/en-us/compliance/regulatory/offering-home?view=o365-worldwide
• Microsoft 365 GDPR action plan – Top priorities for your first 30 days, 90 days, and beyond: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-action-plan?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• General Data Protection Regulation Summary: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Office 365 Data Subject Requests for the GDPR and CCPA: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-dsr-Office365?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Get started with Compliance Manager: https://learn.microsoft.com/en-us/microsoft-365/compliance/compliance-manager-setup?WT.mc_id=M365-MVP-4039827&view=o365-worldwide
• Build and manage assessments in Compliance...