Most organizations know they must respond to subject data requests — but far fewer have a structured and repeatable way of doing it in Microsoft 365.
Update: handling subject data requests are depriciated as a Priva service:
Subject Data Rights
When an organization processes personal data about individuals, those individuals have a set of rights related to how their personal data is handled. These are commonly referred to as subject data rights, and requests from individuals are often called subject data requests (SDR). Their purpose is to ensure transparency, accuracy, and individual control over personal data.
Organizations in Europe must comply with the GDPR. Under the GDPR, subject data rights are primarily defined in Articles 12–22. These include the right to be informed (Articles 13–14), the right of access (Article 15), the right to rectification (Article 16), and the right to erasure (Article 17), as well as several additional rights. Together, these rights require organizations to be able to identify where personal data is stored, determine which data is relevant to a request, and perform actions such as exporting, correcting, restricting, or deleting personal data.
Handling subject data requests is also reflected in Microsoft Purview Compliance Manager. Several improvement actions in privacy-related assessments, including EU GDPR, relate directly to the organization’s ability to respond to data subject requests, as we can see from these controls:
Although the GDPR is a key reference point in Europe, similar rights exist in many other jurisdictions. Privacy regulations around the world include comparable requirements. Privacy standards also address the handling of subject data requests. For example, ISO 27701 includes several controls related to the management of SDRs. The ability to handle such requests through well-defined processes and supporting systems is therefore an essential part of an effective privacy management system.
Microsoft 365 as a Repository for Personal Data
For most organizations, Microsoft 365 is one of the largest repositories of personal data. Emails, documents, Teams conversations, and collaboration data often contain significant amounts of personal information. As a result, Microsoft 365 will almost always be a central data source when handling subject data requests. Organizations often underestimate how much personal data is stored in Microsoft 365. Even a single user account can contain thousands of emails, documents, chat messages, and metadata that must be evaluated as part of a subject data request.
M365 solutions for handling subject data requests
Microsoft 365 administrators typically have two main technical approaches for handling subject data requests:
- Using eDiscovery in Microsoft Purview
- Using Subject Data Requests in Microsoft Priva
In practice, most organizations start with eDiscovery and later consider Microsoft Priva as the number of requests increases.
Let’s have a closer look at those two options.
Using eDiscovery to handle Subject Data Requests
eDiscovery can be used to search for and export personal data related to a specific individual. A typical subject data request search in eDiscovery is based on identifiers such as the person’s name and email address and may include Exchange mailboxes, OneDrive accounts, SharePoint sites, and Teams data.
We first need to create a new case, then define a query (search). We can specify name and e-mail address of the subject:
When the query is completed, we can review what has been found:
Then, we can export the results using the Export feature:
For many organizations, this is the most accessible approach because standard eDiscovery is included in Microsoft 365 E3 and E5 licenses by default. But even though eDiscovery provides a flexible and powerful search capability, it is not specifically designed for subject data requests. As we can see, mainly support right of access and in some degree right of deletion (deletion requires eDiscovery Premium).
For organizations that handle subject data requests regularly, these limitations can make the process time-consuming and difficult to manage consistently.
Enter Priva.
Using Microsoft Priva to handle Subject Data Requests
Microsoft Priva Subject Rights Requests is a dedicated solution for handling SDR in Microsoft 365. Unlike eDiscovery, Priva is specifically designed to support privacy workflows for access, export, and deletion requests.
Let’s go through the process of handling a subject data request for right to access with Priva.
We start by opening the Microsoft Purview portal and navigate to Priva. In the Priva portal, Choose Subject rights requests, and create a new request. Be aware that this solution requires an additional license, although trial licenses are available.
We click Data access – Get started:
Then, we enter the name and e-mail address of the data subject. We can also choose the relevant regulation (selecting a regulation mainly affects the request template and documentation, but the technical collection process is the same).
We click Create:
Priva will now search across relevant Microsoft 365 workloads and collects items related to the data subject.
We can monitor the progress of the data collection and see which data locations contain relevant information. The progress bar shows the status:
In the review data phase, we need to review each item, and choose whether they should be included or excluded from the export:
This step is particularly important, since subject data requests often include information about other individuals that must be evaluated before disclosure. We can also add collaborators if we want several people included in the review (typically HR personnel).
When we have completed the review, Priva generates a report of the included items:
Finally we can download a export package (zip-file) containing the personal data that can be provided to the data subject:
Priva also provides built-in tracking and documentation of the entire process. Each request includes status information and a history of actions performed. This makes Microsoft Priva particularly suitable for organizations that need a repeatable and auditable process for handling subject data requests.
Cost considerations
Microsoft Priva Subject Rights Requests is licensed separately and is purchased as a bundle of requests. This means that organizations must evaluate whether the investment is justified based on the expected number of subject data requests.
For organizations that receive only occasional requests, eDiscovery may be a sufficient solution despite the more manual process. However, the manual effort required to search, collect, review, and document data can be significant. Microsoft Priva reduces this effort by providing a structured and streamlined workflow, which can make a substantial difference for organizations that handle subject data requests regularly. In many cases, the decision becomes a trade-off between licensing cost and administrative effort.