Managing Data Risk After GDPR: The Microsoft 365 Controls That Count

Data risk after GDPR comes down to four questions you must answer quickly: what personal data you hold and where, who can reach it, how long you keep it, and what happened to it on a given day. In Microsoft 365 the answers come from seven controls, in this order:

1. Audit log retention you have checked. Audit (Standard) keeps 180 days; Audit (Premium) keeps Exchange, SharePoint, OneDrive and Microsoft Entra records for one year, with a 10-year add-on.
2. Three or four sensitivity labels (Public, General, Confidential, Highly Confidential) with markings, and encryption on the highest one.
3. DLP policies for the identifiers you really hold: Social Security numbers, card numbers, health records, EU national IDs if you serve EU residents.
4. Retention policies that delete, not only keep: a one-page schedule per workload is your data-minimization evidence.
5. Sharing defaults: SharePoint and OneDrive external sharing at the least permissive level you can live with, default link "specific people", default permission "view".
6. A subject-request routine: who receives a request, how you search, and a calendar that fits GDPR's one-month response window.
7. A Compliance Manager assessment so every control above has an owner, a test date and uploaded evidence.

GDPR (Regulation (EU) 2016/679) applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. The obligations that drive technical work are specific: a record of processing activities (Article 30), data kept no longer than needed (Article 5), a reply to an access request within one month (Articles 12 and 15), and notification of a personal data breach to the supervisory authority within 72 hours of becoming aware of it (Article 33).

A US organization with no EU customers meets the same four questions by other routes: California's regulator has risk-assessment rules with deadlines in 2027 and 2028, cyber insurers ask for MFA, backup and logging evidence at every renewal, and enterprise customers send questionnaires before they sign.

Microsoft's service plan reference (Microsoft Learn, August 2026) lists what each suite carries. Prices are Microsoft list price, October 2026 price list, per user per month on an annual term.

The row that surprises people is DLP: a 60-person Business Premium tenant already licenses it for mail, SharePoint and OneDrive, where most personal data leaks happen. The rows that justify an add-on are Audit (Premium) and endpoint DLP, for the users who handle regulated data; Business Premium tenants have their own step-up, the Microsoft Purview Suite for Microsoft 365 Business Premium at $10.00, and the add-on math for an E3 tenant is in a separate guide.

The 72-hour clock in Article 33 starts when you become aware of a breach, and counsel's first question is always the same: which records, which mailboxes, which files, accessed by whom, between which dates. Only the unified audit log answers that, and only for the period it retains.

Microsoft's Audit (Premium) documentation sets the rules: with Audit (Premium) licensing, Exchange, SharePoint, OneDrive and Microsoft Entra records are kept one year by a default policy; other services' records are kept 180 days unless a custom policy extends them, up to 10 years with the per-user 10-Year Audit Log Retention add-on. Without Audit (Premium), plan on 180 days.

In the first week: confirm auditing is on and run one search that returns results; decide whether 180 days satisfies your contracts and insurer, and if not buy the eDiscovery and Audit add-on for the users in scope or export the log to Log Analytics or Microsoft Sentinel, where you set retention yourself; and record where each log lives, using our breach-evidence guide as the checklist.

Sensitivity labels turn "confidential" from a word in a policy into a header, an encryption setting and a DLP condition. Business Premium and E3 include manual labeling in Office apps, Outlook, SharePoint, OneDrive and Teams (Microsoft Learn, August 2025). A schema that works for a 20- to 500-person organization:

Publish General as the default so unlabeled content stops existing, and train users on the two decisions they face: Confidential or not, internal or external. Leave automatic labeling for later; it needs E5 or the Information Protection and Governance add-on and works better after a few months of manual labels. If Microsoft 365 Copilot is on the roadmap, do this step before the pilot.

A DLP policy in Microsoft Purview watches a location (Exchange, SharePoint, OneDrive, and with E5 licensing Teams chat and onboarded devices) for sensitive information types and applies an action: notify, block with an override the user must justify, or block. Microsoft ships built-in types for the U.S. Social Security number, credit card numbers, U.S. health terms and the EU national identification, passport and debit card numbers you need for EU residents.

Roll out every policy in three stages: simulation mode for two to four weeks to see matches without touching anyone's work; then policy tips and notifications; then block with override for external recipients and sharing links. The five policies that cover most organizations are in Purview DLP for a 50-user firm. Pair the external-sharing policy with Microsoft Purview Message Encryption, included in Business Premium: a mail flow rule that encrypts any outbound message carrying a sensitive information type is an Article 32 technical measure that asks nothing of users.

Article 5 asks you to keep personal data no longer than necessary. The evidence is a retention schedule that actually deletes, and Microsoft 365 deletes nothing until you tell it to: a mailbox or site with no retention policy keeps content until a person removes it.

Build the schedule per workload, then apply it as retention policies (whole locations) and retention labels (specific items): mail seven years then delete for finance and leadership and three years for everyone else, with Exchange Online Archiving (included in Business Premium) carrying older mail; SharePoint and OneDrive five years then delete, with a longer label for contracts and a 90-day label for recruiting folders; Teams chats one year; departed users' OneDrive 30 days after the account is removed. Regulated records (SEC, FINRA, HIPAA) need Records Management with disposition review, which is E5 or the Information Protection and Governance add-on. Our Data Lifecycle Management implementation ($4,500 per project) builds the schedule and the policies.

Access requests. GDPR gives you one month, extendable by two for complex requests. The search is either an eDiscovery (Standard) content search across mail, files and Teams, exported for review, or Microsoft Priva Subject Rights Requests, which automates search, review and redaction and is licensed per request (quoted on request; see the Privacy Management page). Name the owner and run one test request; the eDiscovery search assistance service ($500 per project) covers a first request end to end.

Breach notification. Write the 72-hour sequence down before you need it: hour 0, a Defender incident or user report reaches the security contact; hour 2, the account or device is contained and the audit search starts; hour 12, counsel has the list of affected records, drawn from DLP matches, labels and audit entries; hour 48, the notification decision; hour 72, the supervisory authority or state attorney general is notified if required. The Security Managed Service: Incident Response engagement ($700 per project) runs containment and evidence collection with your team.

Microsoft Purview Compliance Manager is included in Business Premium, E3 and E5 (Microsoft Learn, August 2025). It maps regulations to improvement actions, scores them, lets you assign owners, upload evidence and record tests, and exports the lot for an auditor. The Microsoft Data Protection Baseline template is included at every subscription level; other regulations (GDPR, ISO 27001, NIST, HIPAA, the state privacy laws, the EU AI Act) are premium templates licensed per regulation for one year, with unlimited assessments per licensed regulation. On the October 2026 price list the Compliance Manager Premium Assessment Add-On is $500.00 per month on an annual term ($6,000.00 per year), with a 90-day trial available first.

The workflow that produces evidence rather than a score: create the Data Protection Baseline assessment first and add GDPR or a state law only when a customer or regulator names it; give each improvement action for the seven controls a named owner and a due date; implement the control in its own workload, then upload the proof; have someone other than the implementer mark it tested; export the assessment before every audit, renewal or questionnaire. The score is not a certification; the evidence behind each action is what an auditor reads. The Compliance Evidence and Audit Readiness Retainer ($950 per month) keeps that evidence current.

Does GDPR apply to a US company?

It applies if you offer goods or services to people in the EU or monitor their behavior there, wherever you are based. A US company with no EU customers is outside GDPR but faces the same questions from state privacy laws, cyber insurers and enterprise customers.

Does Microsoft 365 Business Premium include DLP?

Yes, for Exchange, SharePoint and OneDrive, with sensitivity labels, Message Encryption and Compliance Manager. Endpoint and Teams chat DLP need the Purview Suite for Business Premium ($10.00 per user per month on an annual term, October 2026 price list).

How long does Microsoft 365 keep audit logs?

180 days with Audit (Standard). With Audit (Premium), Exchange, SharePoint, OneDrive and Microsoft Entra records are kept one year by default, extendable to 10 years with the 10-Year Audit Log Retention add-on. Export to Log Analytics or Microsoft Sentinel to control the period yourself.

Is Compliance Manager free?

The tool and the Microsoft Data Protection Baseline template come with Business Premium, E3 and E5. Premium regulation templates such as GDPR, ISO 27001 and HIPAA are licensed per regulation per year; the add-on is $500.00 per month on an annual term on the October 2026 price list.

What is the difference between retention and backup?

Retention keeps or deletes content inside the tenant to meet a rule; backup makes a separate copy you can restore after deletion, corruption or ransomware. Microsoft 365 Backup or a third-party backup does the second job.

Do I need E5 for GDPR?

No. Audit, labels, DLP for mail and files, retention, sharing controls, subject-request searches and Compliance Manager are in Business Premium and E3. E5 or its add-ons add one-year audit retention, endpoint and Teams DLP, auto-labeling, Records Management and Insider Risk Management.

• Regulation (EU) 2016/679 (GDPR), Articles 5, 12, 15, 30, 32 and 33 — EUR-Lex, Publications Office of the European Union; cited from the regulation text, page not opened on 2026-10-11
• Set up information protection in Microsoft 365 Business Premium — Microsoft Learn, ms.date 08/14/2025, checked 2026-10-11 (labels, DLP, Message Encryption and Compliance Manager in Business Premium)
• Microsoft 365 for business security overview — Microsoft Learn, ms.date 09/30/2025, checked 2026-10-11
• Product names and service plan identifiers for licensing — Microsoft Learn, ms.date 08/18/2026, checked 2026-10-11 (service plans in Business Premium, E3, E5 and E5 Compliance)
• Audit (Premium) — Microsoft Learn; retention rules confirmed through search excerpts on 2026-10-11, page not opened
• Learn about regulations in Compliance Manager and Compliance Manager premium assessments trial — Microsoft Learn; template licensing confirmed through search excerpts on 2026-10-11, pages not opened
• Get started with endpoint data loss prevention — Microsoft Learn; licensing requirement confirmed through search excerpts on 2026-10-11, page not opened
• Microsoft commercial price list, October 2026: Business Premium, Microsoft 365 E3 and E5, Purview Suite, Purview Suite for Microsoft 365 Business Premium, E5 Information Protection and Governance, E5 eDiscovery and Audit, E5 Insider Risk Management, Compliance Manager Premium Assessment Add-On