GDPR Data Discovery Service — Personal Data Inventory & PII Discovery

The GDPR Data Discovery Service is a 2–6 week IT Partner engagement that identifies and inventories personal data relevant to GDPR across online and on-premises data sources. It helps organizations answer how much data they have, where it resides, and which data may be impacted by GDPR, including data containing personally identifiable information (PII). The service SKU is ITPWW190TRNOT.

No. The GDPR Data Discovery Service, including the GDPR Discovery Toolkit, is not a tool to certify GDPR compliance. IT Partner helps identify personal data, document data locations, and guide next steps, but compliance certification remains the responsibility of the customer and their legal and compliance teams.

The service includes a data source inventory, a catalog of discovered data sources, classification and labeling guidance, a data classification taxonomy and label schema, a finalized classification scheme, documentation of that scheme, and reporting on data discovery. The catalog documents details such as data source location, access type, type of data, and data owner where discovered during the engagement.

The GDPR Data Discovery Service typically takes 2–6 weeks. The actual timeline depends on the agreed discovery scope, availability of required access, readiness for Microsoft Information Protection, and coordination between IT Partner and the customer during planning and execution.

The stated price for the GDPR Data Discovery Service is $15,000. If the required scope, environment complexity, or prerequisites differ from the standard service description, the customer should confirm pricing and assumptions with IT Partner before starting the engagement.

The service is designed to discover and scan data sources across the organization, including online and on-premises locations. For Microsoft 365, Content Search can search mailboxes, inactive mailboxes, Microsoft 365 Groups and Teams mailboxes, SharePoint and OneDrive for Business sites, Microsoft 365 group and Teams sites, and public folders. For on-premises scanning with Microsoft Information Protection, supported locations include local folders on the scanner server, CIFS/UNC network shares, and SharePoint Server 2016 or SharePoint Server 2013 sites and libraries.

Yes, the service can include on-premises and non-Microsoft locations in the discovery planning, because customer responsibilities include providing access to databases, local storage, removable devices, backup media, third-party applications, and non-Microsoft cloud solutions. However, support and scanning methods vary by location, so exact coverage for non-supported or non-Microsoft sources should be confirmed with IT Partner during scoping and kickoff.

During kickoff, IT Partner introduces the project team, reviews the proposed timeline and expected outcomes, and explains the technical details of the scanning process. The meeting also covers discovery scope, required prerequisites, access needs, and what the scanning process will and will not scan for.

The engagement starts with kickoff, then identifies and assesses possible data sources across the organization. IT Partner then plans for automated classification and labeling, helps select the appropriate Microsoft data governance approach, and proceeds with the relevant on-premises and/or online discovery activities. The online path uses Microsoft 365 search and discovery capabilities, while the on-premises path can use the Microsoft Information Protection scanner where prerequisites are met.

The service may use Microsoft Information Protection (MIP), Microsoft Advanced Data Governance (ADG), Microsoft 365 labels, and Content Search in the Microsoft 365 Security & Compliance Center. MIP and ADG both support data classification and automated labeling based on sensitive data types, but they have different deployment scenarios and are not fully integrated according to the service description.

For the MIP scanner service, the customer needs an on-premises domain-joined member server. On-premises scanner operation also requires an integrated deployment in which on-premises Active Directory and Azure Active Directory are synchronized, because the scanner relies on the cloud-based Microsoft Information Protection service for policy and labeling information.

The customer must provide access to relevant data locations and be ready to implement Microsoft Information Protection where applicable. Required access may include OneDrive Personal non-supported locations, databases such as SQL Server or Access, local storage on endpoints, removable devices, backup media, third-party applications, and non-Microsoft cloud solutions. Additional prerequisites should be confirmed during kickoff because the source service description does not provide a complete checklist beyond the stated items.

IT Partner is responsible for helping identify what personal data exists and where it resides, reporting how personal data is used and accessed, and recommending ways to establish security controls to prevent, detect, and respond to vulnerabilities and data breaches. IT Partner also advises on keeping required documentation and managing data requests and breach notifications, within the scope of the discovery engagement.

The customer is responsible for providing access to data locations, supporting resource and activity planning, establishing and confirming timelines, and being ready to implement Microsoft Information Protection where applicable. The customer’s legal and compliance teams remain responsible for determining and certifying GDPR compliance.

The service plans for automated classification and labeling by translating legal and business requirements into policies, labels, and conditions. Microsoft 365 labels, Microsoft Information Protection, and Advanced Data Governance can support automated or user-applied labeling, but exact implementation depends on the selected solution, deployment scenario, and agreed scope.

Yes. IT Partner helps define a data classification taxonomy and label schema based on legal and business requirements, then documents a finalized classification scheme that defines policies, labels, and conditions. This is intended to support discussion among legal, business, and IT teams and to provide input for later processing steps.

The service description does not state a planned downtime requirement. Because the engagement involves discovery, scanning, access to data locations, and use of Microsoft 365 or MIP capabilities, any expected business impact should be reviewed during kickoff based on the selected data sources, scan approach, and customer environment.

After completion, the customer receives discovery reporting, an inventory or catalog of discovered data sources, and documentation of the classification scheme. These outputs can be used as input for next steps such as improving data governance, applying security controls, advancing GDPR maturity, and working with legal and compliance teams on GDPR obligations.

The service is most effective when IT, legal, business, data owners, and compliance stakeholders participate, because the engagement documents data locations and translates legal and business requirements into classification policies, labels, and conditions. The customer should also provide resources who can grant access to data sources and confirm timelines.

The listed manager for the GDPR Data Discovery Service is Mike Mackey. Customers should confirm engagement logistics, scheduling, and any environment-specific assumptions with IT Partner before project kickoff.