GDPR Data Discovery in Microsoft 365: Purview and Auditor Evidence
GDPR data discovery means finding every place your tenant holds personal data of people in the EU, so you can answer an access request, honor a deletion, and show an auditor a record of processing that matches reality. In Microsoft 365 the tool is Microsoft Purview: built-in sensitive information types for EU identifiers, trainable classifiers for documents with no pattern, and the Content explorer and Activity explorer screens that show where the data sits and what happens to it. This guide gives the steps, the license each step needs (Microsoft list price, October 2026 price list), and the evidence pack an auditor accepts.
How GDPR data discovery works in Microsoft 365
Microsoft Purview classifies content where it already sits; nothing is copied to a scanner. Exchange Online mailboxes, SharePoint sites, OneDrive accounts and Teams messages and files are indexed, and each item is evaluated against the sensitive information types, trainable classifiers and sensitivity labels you have turned on. The results feed three places: data loss prevention policies that act on the item, Content explorer that shows the counts by location, and Activity explorer that shows what people did with the items.
The order of work for a tenant that has done nothing yet:
- Confirm and assign the licenses on the table below; classification reports only on licensed users and workloads.
- Turn on the EU sensitive information types in a DLP policy in simulation mode, scoped to Exchange, SharePoint, OneDrive and Teams; simulation reports matches and takes no action.
- Wait for the first full pass: hours for recent content, days for a tenant with terabytes in SharePoint.
- Open Content explorer, filter by each EU type, and export the item list per site, mailbox and OneDrive account; that export is the first column of your data map.
- Add trainable classifiers for the documents that patterns miss: contracts, CVs, HR files, medical certificates.
- Interview the owners of the busiest locations for the purpose of processing, the recipients and the retention period.
- Write the Records of Processing from steps 4 and 6, set retention and sensitivity labels to match, and switch the DLP policy from simulation to notifications.
The GDPR obligations article covers what the regulation asks of a US company; this article is about finding the data.
The EU sensitive information types Purview already has
Microsoft maintains sensitive information types (SITs) for the identifiers most EU member states issue, and groups them into EU bundles that match any member state's format. The bundles on the Microsoft Learn entity definitions list that matter for GDPR discovery:
| Sensitive information type | What it matches | Where it turns up in a US company |
|---|---|---|
| EU passport number | Passport formats of the member states (the Poland passport number, for instance, is in the bundle and also available alone) | HR files for EU hires, travel bookings |
| EU national identification number | National ID card numbers by member state | Customer onboarding folders |
| EU Tax identification number | Tax IDs by member state | Vendor records, EU payroll |
| EU driver's license number | License formats by member state | Fleet, insurance and HR records |
| EU social security number or equivalent identification | Social insurance numbers by member state | Payroll, benefits, pensions |
| EU debit card number | Debit card formats | Finance mailboxes, refunds |
| International Banking Account Number (IBAN) and SWIFT code | Bank account and routing identifiers | Accounts payable, expense claims |
Each bundle is built from the country-level types, so a policy can be scoped to the countries you do business in. Two more types matter: credit card number and IP address, because an IP address tied to a person is personal data under GDPR. Where your data has a shape the built-in types do not know, such as a customer number, create a custom sensitive information type (regular expression plus keywords, available to every tenant) or an exact data match type that fingerprints a column of your customer database (E5).
Trainable classifiers for data that has no pattern
A contract, a CV or a doctor's note contains personal data with no number pattern to match. Trainable classifiers are machine learning models that recognize a document type from its content. Microsoft ships pre-trained classifiers (resumes, source code, financial statements and others), and you can train your own from at least 50 positive samples in a SharePoint site.
Microsoft documents trainable classifiers as an E5 capability; tenants without E5 can test them in the 90-day Purview solutions trial. In preview, Content explorer can filter by trainable classifier and count the matches in SharePoint, Teams and OneDrive without labeling anything, which is the discovery view a GDPR project wants. Three custom classifiers earn their training time: employment contracts and HR correspondence, scanned identity documents, and support tickets that quote personal details.
Content explorer and Activity explorer: the two screens auditors want to see
Content explorer (Purview portal, Data classification) lists every item that matched a sensitive information type, a trainable classifier, a sensitivity label or a retention label, grouped by workload and then by site, mailbox or account. Two roles gate it: Content Explorer List Viewer sees counts and locations, Content Explorer Content Viewer can open the items; give the auditor the first for the day, or export the list.
Activity explorer shows the events: label applied, changed or removed, file read, copied to USB or a cloud app, DLP rule matched, DLP rule overridden with the justification text. Filter by an EU sensitive information type and a date range and you have the answer for a breach notification or a subject access request.
Both screens are E5-tier. Business Premium and E3 tenants see DLP match reports and the audit log, but not the item-by-item inventory; the Purview DLP article shows what those tenants can do with the included reports.
Licensing by capability: Business Premium, E3, E5 and the add-ons
Prices are per user per month on an annual commitment, Microsoft list price, October 2026 price list.
| Capability | Business Premium $22.00 | Microsoft 365 E3 $39.00 | Microsoft 365 E5 $60.00 | Add-on for E3 |
|---|---|---|---|---|
| Sensitive information types and DLP for Exchange, SharePoint, OneDrive | Yes | Yes | Yes | — |
| Manual sensitivity labels, retention policies | Yes | Yes | Yes | — |
| Content search, eDiscovery (Standard), Audit (Standard) with 180-day retention | Yes | Yes | Yes | — |
| Custom sensitive information types (regular expression) | Yes | Yes | Yes | — |
| Content explorer and Activity explorer | No | No | Yes | E5 Information Protection and Governance $7.00 or Microsoft Purview Suite $12.00 |
| Custom trainable classifiers, auto-labeling, exact data match, Teams chat DLP, endpoint DLP | No | No | Yes | The same two add-ons |
| eDiscovery (Premium), Audit (Premium) with one-year retention | No | No | Yes | E5 eDiscovery and Audit $6.00 or Purview Suite $12.00 |
| Insider Risk Management | No | No | Yes | E5 Insider Risk Management $6.00 or Purview Suite $12.00 |
Three notes. The Microsoft Purview Suite is the former Microsoft 365 E5 Compliance, renamed on 1 October 2025, and it bundles the three $6.00 to $7.00 add-ons for $12.00. Microsoft also sells a Microsoft Purview Suite for Business Premium; it is not on the October 2026 sheet, so we quote it on request. Compliance Manager is in every tenant; its premium assessment templates are sold as the Compliance Manager Premium Assessment Add-On at $500.00 per month.
From discovery to the data map a Records of Processing needs
Article 30 of GDPR asks a controller to keep a record with the purposes of processing, the categories of data subjects and personal data, the recipients, any transfer to a third country, the retention periods and the security measures. A US company with EU customers or staff keeps this record even without an EU office. Purview fills the columns it can see; people fill the rest.
| Records of Processing column | Where it comes from |
|---|---|
| Processing activity and purpose | Interview with the site or mailbox owner (HR, sales, support, finance) |
| Categories of data subjects | Owner interview, confirmed by the sensitive information types that matched (employees, customers, vendor contacts) |
| Categories of personal data | Content explorer: which types matched in that location, and how many items |
| Location and system | Content explorer: site, mailbox, OneDrive account, Teams channel |
| Recipients and processors | Owner interview, plus the connected-apps list in Defender for Cloud Apps for SaaS tools that receive the data |
| Transfers outside the EU | Tenant region and processor list; for a US tenant every item is a transfer, covered by the EU-US Data Privacy Framework or standard contractual clauses |
| Retention period | The retention label or policy applied to the location; where none exists, that is a finding |
| Security measures | Sensitivity labels, DLP policies, Conditional Access and encryption, listed from the admin centers |
Keep the map as a SharePoint list or an Excel workbook, one row per processing activity, with the Content explorer export date in a column; a quarterly refresh is a workable cadence for a company under 500 people.
The evidence pack an auditor accepts
An auditor, a cyber insurer or an EU customer's procurement team asks the same question: show me that you know where the personal data is and that controls exist. This is the pack we hand over, every file dated and exported from the tenant:
- Scope statement. Workloads, countries' identifiers, the date the discovery ran, the licenses in place.
- Sensitive information type inventory. The Content explorer export by type and location, with item counts.
- DLP policies and matches. The policy list with scope and actions, and the match report for the last 90 days.
- Label distribution. Items by sensitivity label and by retention label, from Content explorer.
- Retention policies. Policies and labels with their periods, mapped to the Records of Processing rows.
- Audit log export. The unified audit log for the period as CSV; Audit (Standard) keeps 180 days and Audit (Premium) one year, so export at least every six months.
- A tested subject access request. A content search for a named test subject across the four workloads, the export, and the time it took, which shows you can meet the one-month response window.
- Compliance Manager assessment. The EU GDPR assessment with its improvement actions, owners and closure dates.
Format: a PDF cover memo, the eight exports as CSV or Excel in a folder, and the Records of Processing workbook. Auditors accept native Microsoft exports; they discount screenshots.
Worked example: an 80-user firm on Microsoft 365 E3
An 80-user manufacturer in Ohio with EU distributors and three employees in Germany wants Content explorer, Activity explorer and one custom classifier for distributor contracts. Prices are Microsoft list, October 2026 price list, annual commitment.
| Option | Per user per month | Per month | Per year |
|---|---|---|---|
| Keep E3, add E5 Information Protection and Governance | $7.00 | $560.00 | $6,720.00 |
| Keep E3, add the Microsoft Purview Suite (also eDiscovery Premium, Audit Premium, Insider Risk) | $12.00 | $960.00 | $11,520.00 |
| Step up to Microsoft 365 E5 ($60.00 − $39.00) | $21.00 | $1,680.00 | $20,160.00 |
The $7.00 add-on covers the discovery requirement. The Purview Suite is the choice when the same project needs eDiscovery (Premium) for litigation holds or Audit (Premium) for a year of log retention. The E5 step only makes sense when the security side also wants the Defender Suite, which the E3 versus E5 article works through. Licenses stay the customer's own Microsoft subscription; the discovery project is quoted separately.
Frequently asked questions
What is GDPR data discovery?
It is the process of finding every location where an organization holds personal data of people in the EU, recording what it is, why it is processed, who receives it and how long it is kept. In Microsoft 365 the discovery is done by Microsoft Purview classification, and the record it produces feeds the Records of Processing that Article 30 requires.
How do I do data discovery for GDPR in Microsoft 365?
Turn on the EU sensitive information types in a DLP policy in simulation mode across Exchange, SharePoint, OneDrive and Teams, wait for the classification pass, then export Content explorer by type and location. Add trainable classifiers for contracts and HR documents, interview the owners of the busiest locations, and write the data map from the two.
Which license do I need for Content explorer?
Content explorer and Activity explorer are Microsoft 365 E5 features. An E3 tenant adds them with the Microsoft 365 E5 Information Protection and Governance add-on at $7.00 per user per month or the Microsoft Purview Suite at $12.00 (Microsoft list price, October 2026 price list). Business Premium tenants ask us about the Microsoft Purview Suite for Business Premium, $10.00 per user per month on an annual commitment (Microsoft list price, October 2026 price list).
Does Microsoft Purview have GDPR sensitive information types?
Yes. The built-in list includes EU passport number, EU national identification number, EU Tax identification number, EU driver's license number, EU social security number or equivalent identification and EU debit card number, each built from country-level types, as well as IBAN and SWIFT code. A DLP policy template for GDPR selects the common ones for you.
What evidence do GDPR auditors ask for in Microsoft 365?
A dated inventory of where personal data sits (the Content explorer export), the DLP policies and their match reports, sensitivity and retention label distribution, retention policies mapped to the record of processing, an audit log export, a tested subject access request and the Compliance Manager assessment with owned improvement actions. Native exports are accepted; screenshots are not.
Can Business Premium do GDPR data discovery?
Partly. Business Premium includes DLP with the EU sensitive information types, manual sensitivity labels, retention policies, content search and the audit log, so you can detect and act on EU identifiers in email and files. The item-by-item inventory in Content explorer and the event view in Activity explorer need an E5-tier license or the Purview Suite for Business Premium.
How long does Microsoft 365 keep the audit log?
Audit (Standard), included in Business Premium, E3 and E5, keeps 180 days. Audit (Premium), in E5, the Purview Suite and the E5 eDiscovery and Audit add-on, keeps one year by default. Export the log on a schedule so the evidence outlives the retention window.
Sources
- Commercial price list, October 2026: Microsoft 365 Business Premium, E3 and E5, Microsoft 365 E5 Information Protection and Governance, E5 eDiscovery and Audit, E5 Insider Risk Management, Microsoft Purview Suite, Compliance Manager Premium Assessment Add-On
- Sensitive information type entity definitions — Microsoft Learn, checked 2026-10-11 (the EU bundles and the country-level types)
- EU passport number — Microsoft Learn, checked 2026-10-11
- Learn about trainable classifiers — Microsoft Learn, checked 2026-10-11 (E5 licensing, the 90-day trial, the Content explorer preview)
- Required license for Activity Explorer on Purview portal — Microsoft Q&A, checked 2026-10-11
- Microsoft Purview — Microsoft, checked 2026-10-11
- Microsoft Defender and Purview Suites for M365 Business Premium — CIAOPS, checked 2026-10-11 (the 1 October 2025 rename)
Key takeaways
- Purview discovers EU personal data with built-in sensitive information types (EU passport, national ID, tax ID, driver's license, social security and debit card numbers, plus IBAN and SWIFT) across Exchange, SharePoint, OneDrive and Teams.
- Data loss prevention with those types, manual sensitivity labels, content search, eDiscovery (Standard) and Audit (Standard) are in Business Premium ($22.00), E3 ($39.00) and E5 ($60.00).
- Content explorer, Activity explorer, custom trainable classifiers and auto-labeling are E5 features; E3 tenants add them with the $7.00 E5 Information Protection and Governance add-on or the $12.00 Microsoft Purview Suite.
- A Records of Processing needs purposes, data categories, recipients, transfers and retention periods; Content explorer gives the location and volume columns, and the rest comes from owner interviews.
- The evidence pack is eight dated exports: scope, sensitive information type inventory, DLP policies and matches, label distribution, retention policies, audit log, a tested access-request procedure and the Compliance Manager GDPR assessment.
- Audit (Standard) keeps 180 days of activity and Audit (Premium) keeps one year; export the log before it ages out.
- For an 80-user E3 tenant the add-on that unlocks Content explorer is $560.00 per month; the Purview Suite is $960.00; the full E5 step is $1,680.00.
If you want the discovery run, the data map drafted and the evidence pack assembled for your next audit, the GDPR Data Discovery Service is a fixed-price project at $15,000, quoted in writing before work begins.
Questions this article didn’t answer?
Thirty minutes with Mike — our CEO, not a sales rep. Bring the hard version of the question.