microsoft-priva

Name: microsoft-priva
Author: vinayaklatthe

161stars34forks

How to install microsoft-priva?

vinayaklatthe/microsoft-security-skills/microsoft-priva

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill microsoft-priva

Installs into the current project.

Summary

Guidance for Microsoft Priva — privacy risk management and subject rights requests. Covers Priva Privacy Risk Management and Priva Subject Rights Requests to find privacy risks and fulfill data subject requests (GDPR/CCPA). WHEN: Microsoft Priva, privacy risk management, subject

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Priva
2
3	Microsoft Priva helps organisations manage privacy risk and fulfil data subject (privacy) rights
4	requests for personal data held in Microsoft 365 and beyond. Priva is a separate SKU from
5	Purview - confirm licensing before designing.
6
7	## When to use
8	Use this skill when the user has a privacy programme obligation (GDPR, CCPA, LGPD, UK DPA) and
9	needs to reduce personal-data risk or respond to subject rights requests at scale.
10
11	Do not use this skill for security DLP (use `purview-dlp-policy`), eDiscovery for litigation
12	(use `purview-ediscovery`), or AI prompt data (use `purview-dspm-ai`).
13
14	## Pick the right Priva solution
15
16	Priva is two distinct solutions sold under one brand. Pick the row that matches the trigger.
17
18	\| If the goal is... \| Solution \| Typical first policy \|
19	\|---\|---\|---\|
20	\| Find and reduce personal data overexposure across SPO/OneDrive \| Privacy Risk Management — Overexposure \| All-org overexposure of high-confidence personal SITs \|
21	\| Stop personal data transfers across borders or departments \| Privacy Risk Management — Transfer \| Cross-region transfer of personal data outside EU \|
22	\| Reduce data hoarding (long-retained personal data) \| Privacy Risk Management — Minimisation \| Inactive personal data older than retention obligation \|
23	\| Respond to GDPR Article 15 / CCPA Right to Know requests \| Subject Rights Requests (SRR) \| Access request workflow with redaction \|
24	\| Fulfil deletion / erasure requests \| SRR (Delete request type) \| Erasure with reviewer approval \|
25	\| Send privacy nudges to users producing risky behaviour \| Privacy Risk Management — user notifications \| Inline tip when sharing personal data externally \|
26
27	> Rule of thumb: start with Privacy Risk Management - overexposure before SRR. You will
28	> get more SRRs than you can handle if your tenant is already leaking personal data; fix the
29	> leak first, then operationalise the request flow.
30
31	## Approach
32
33	Order matters. Each step gates the next.
34
35	1. Classification prerequisite — Priva detects personal data using Purview SITs and trainable
36	classifiers. Confirm at least the built-in personal-data SITs (national ID, passport, IBAN,
37	driving licence, email, phone) match real items in your tenant via *Purview → Content
38	Explorer*. Without this, Priva policies fire on nothing or on noise.
39	*Verify: Content Explorer shows non-zero hits for at least 3 personal-data SITs relevant to
40	your region (e.g. UK NINO, EU national ID, IBAN).*
41	2. Confirm licensing — Priva Privacy Risk Management and Priva Subject Rights Requests are
42	separate add-on SKUs, not bundled in M365 E5 Compliance. SRR is licensed per request
43	(paid bundles); Privacy Risk Management is per-user per-month. Buy before you build.
44	Verify: portal shows Priva tile under Microsoft 365 admin centre with active SKU.
45	3. Privacy Risk Management — pilot in audit mode — Create your first overexposure policy in
46	Test mode on a small site collection for 7-14 days. Review match volume and false-positive
47	rate before turning on user notifications or remediation.
48	4. User notifications carefully — When you flip from Test to Active, notifications go to
49	users who shared the data. This is your privacy programme talking to your workforce - get
50	comms and HR sign-off on the wording first.
51	5. Subject Rights Requests workflow — Configure the SRR template: data sources (Exchange,
52	SPO, OneDrive, Teams), reviewers, conflict-of-interest exclusions, redaction reviewer role,
53	and secure delivery method. Test with a fake request before publishing the intake form.
54	*Verify: a dry-run SRR for a test user returns expected items and the reviewer can redact and
55	approve before delivery.*
56	6. Report & operate — Track SRR SLAs (GDPR = 30 days, extendable by 60), policy match
57	trends, and user-notification dismissal rate. Feed insights back to the classification team.
58
59	## Guardrails
60	- Priva depends on classification accuracy. Deploy after at least basic Purview SITs are
61	validated; otherwise policies are noise.
62	- Coordinate with legal and privacy office before going live. SRR fulfilment is a regulated
63	process - inadvertent disclosure of third-party personal data inside a response is a breach.
64	- Apply least privilege. SRR content is highly sensitive (the most sensitive in the tenant
65	during the request window). Use scoped Privacy Management role groups, not Compliance
66	A

People who liked this also viewed

6 picks

Type

microsoft-priva

161stars34forks

View on GitHub

How to install microsoft-priva?

vinayaklatthe/microsoft-security-skills/microsoft-priva

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill microsoft-priva

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Priva
2
3	Microsoft Priva helps organisations manage privacy risk and fulfil data subject (privacy) rights
4	requests for personal data held in Microsoft 365 and beyond. Priva is a separate SKU from
5	Purview - confirm licensing before designing.
6
7	## When to use
8	Use this skill when the user has a privacy programme obligation (GDPR, CCPA, LGPD, UK DPA) and
9	needs to reduce personal-data risk or respond to subject rights requests at scale.
10
11	Do not use this skill for security DLP (use `purview-dlp-policy`), eDiscovery for litigation
12	(use `purview-ediscovery`), or AI prompt data (use `purview-dspm-ai`).
13
14	## Pick the right Priva solution
15
16	Priva is two distinct solutions sold under one brand. Pick the row that matches the trigger.
17
18	\| If the goal is... \| Solution \| Typical first policy \|
19	\|---\|---\|---\|
20	\| Find and reduce personal data overexposure across SPO/OneDrive \| Privacy Risk Management — Overexposure \| All-org overexposure of high-confidence personal SITs \|
21	\| Stop personal data transfers across borders or departments \| Privacy Risk Management — Transfer \| Cross-region transfer of personal data outside EU \|
22	\| Reduce data hoarding (long-retained personal data) \| Privacy Risk Management — Minimisation \| Inactive personal data older than retention obligation \|
23	\| Respond to GDPR Article 15 / CCPA Right to Know requests \| Subject Rights Requests (SRR) \| Access request workflow with redaction \|
24	\| Fulfil deletion / erasure requests \| SRR (Delete request type) \| Erasure with reviewer approval \|
25	\| Send privacy nudges to users producing risky behaviour \| Privacy Risk Management — user notifications \| Inline tip when sharing personal data externally \|
26
27	> Rule of thumb: start with Privacy Risk Management - overexposure before SRR. You will
28	> get more SRRs than you can handle if your tenant is already leaking personal data; fix the
29	> leak first, then operationalise the request flow.
30
31	## Approach
32
33	Order matters. Each step gates the next.
34
35	1. Classification prerequisite — Priva detects personal data using Purview SITs and trainable
36	classifiers. Confirm at least the built-in personal-data SITs (national ID, passport, IBAN,
37	driving licence, email, phone) match real items in your tenant via *Purview → Content
38	Explorer*. Without this, Priva policies fire on nothing or on noise.
39	*Verify: Content Explorer shows non-zero hits for at least 3 personal-data SITs relevant to
40	your region (e.g. UK NINO, EU national ID, IBAN).*
41	2. Confirm licensing — Priva Privacy Risk Management and Priva Subject Rights Requests are
42	separate add-on SKUs, not bundled in M365 E5 Compliance. SRR is licensed per request
43	(paid bundles); Privacy Risk Management is per-user per-month. Buy before you build.
44	Verify: portal shows Priva tile under Microsoft 365 admin centre with active SKU.
45	3. Privacy Risk Management — pilot in audit mode — Create your first overexposure policy in
46	Test mode on a small site collection for 7-14 days. Review match volume and false-positive
47	rate before turning on user notifications or remediation.
48	4. User notifications carefully — When you flip from Test to Active, notifications go to
49	users who shared the data. This is your privacy programme talking to your workforce - get
50	comms and HR sign-off on the wording first.
51	5. Subject Rights Requests workflow — Configure the SRR template: data sources (Exchange,
52	SPO, OneDrive, Teams), reviewers, conflict-of-interest exclusions, redaction reviewer role,
53	and secure delivery method. Test with a fake request before publishing the intake form.
54	*Verify: a dry-run SRR for a test user returns expected items and the reviewer can redact and
55	approve before delivery.*
56	6. Report & operate — Track SRR SLAs (GDPR = 30 days, extendable by 60), policy match
57	trends, and user-notification dismissal rate. Feed insights back to the classification team.
58
59	## Guardrails
60	- Priva depends on classification accuracy. Deploy after at least basic Purview SITs are
61	validated; otherwise policies are noise.
62	- Coordinate with legal and privacy office before going live. SRR fulfilment is a regulated
63	process - inadvertent disclosure of third-party personal data inside a response is a breach.
64	- Apply least privilege. SRR content is highly sensitive (the most sensitive in the tenant
65	during the request window). Use scoped Privacy Management role groups, not Compliance
66	A

People who liked this also viewed

6 picks

Type