Microsoft
Microsoft
Priva
Cloud Solution Partner
- 30+Priva tenants
- GDPRWorkflow ready
- PDPLUAE-aligned
- 24/7Coverage
What Priva delivers
Five privacy disciplines, one platform.
Priva is the privacy operationalisation layer on top of Purview. Discover personal data, assess risk, automate subject-rights requests, and document the evidence regulators look for.
Privacy Risk Management
Continuous discovery of personal data across the M365 estate. Risk policies for over-retention, over-exposure, transfers across boundaries. Daily anomaly alerts to compliance team.
Subject Rights Requests
Automated workflow for data-subject access requests, deletion requests, portability requests. Search across the M365 corpus, redact, package, deliver inside regulatory deadlines.
Cross-border data flows
Visibility into where personal data sits and where it moves. Transfer-impact assessment support, data-residency monitoring, regulator-ready transfer registers.
Privacy assessments
Privacy-impact-assessment templates, data-processing-activity records, documentation aligned to GDPR Article 30, UAE PDPL, and other regional frameworks.
Consent management
Consent receipts, withdrawal workflows, audit trails for marketing communications, customer-data processing, and employee-data handling.
Compliance reporting
Privacy-posture dashboards, risk-trend reporting, subject-rights-request metrics, regulator-ready evidence packages.
Start here, not with the licence
You cannot protect personal data you cannot find.
Almost every privacy programme we inherit started by buying a tool and writing a policy, and stalled because neither answered the only question that matters first: where does personal data actually live in this organisation. The discovery work is unglamorous and it is the whole foundation.
- The obvious systems are never the problem. Everyone knows the CRM holds customer records. What causes the failed subject-rights request is the spreadsheet a departed employee exported in 2019, the mailbox containing eight years of correspondence, the Teams channel where an operations discussion included passport scans, and the line-of-business system that predates everyone currently employed.
- Discovery has to cover systems outside Microsoft 365 as well, because that is where the gaps sit. The accounting platform, the marketing tool, the recruitment system, the visa and PRO records, the CCTV retention, and anything a department bought on a card without telling IT. A data map that only covers your tenant will fail the first request that reaches beyond it.
- The output is a data map: for each system, what personal data it holds, whose, why you hold it, the lawful basis, how long you keep it, and who can access it. It is a document rather than a product, it takes a few weeks, and it makes every subsequent decision straightforward instead of speculative.
- Once that exists, tooling becomes obvious. You will know whether Priva earns its licence, which retention policies are needed, where sensitivity labels matter, and what a subject-rights request will actually involve. Organisations that skip this step spend more and get less, because they configure a tool against an estate they have not described.
Why GR IT for Priva
Four reasons clients pick us for the deployment.
Priva sits in a niche between Purview and full privacy-management platforms. Most clients underuse it; the workflow value comes from disciplined deployment.
30+ Priva tenants
Pattern recognition matters. We have deployed Priva across financial services, healthcare, and retail. Common subject-rights-request patterns, common consent-tracking gaps.
GDPR + UAE PDPL aware
Priva schemas designed for both EU GDPR and UAE Personal Data Protection Law. Cross-border transfer registers, retention timelines, regulator-aligned documentation.
Tuned, not just enabled
Privacy-risk policies tuned to your environment. Subject-rights-request workflows configured per regulatory framework. Templates for common privacy assessments.
Dubai-based privacy engineers
Compliance engineers with CIPP/E, CIPM, and ISO 27001 LA credentials. Same team that deploys Priva supports ongoing privacy operations.
Industries using Priva
Priva deployments by sector.
Six sectors where Priva provides material privacy-workflow uplift over manual processes.
Financial services
DIFC and ADGM-licensed firms using Priva for customer subject-rights requests, cross-border transfer visibility, audit-ready privacy evidence.
Healthcare
Hospitals, clinics, medical groups using Priva for PHI subject-rights requests, parent/guardian consent management, DHA-compliant privacy posture.
Professional services
Law firms and consultancies using Priva for client-data subject-rights requests, matter-based PII discovery, ethical-wall enforcement.
Tech and SaaS
SaaS companies using Priva for customer-data subject-rights requests, GDPR portability, internal-employee subject requests.
Retail and e-commerce
Retail groups using Priva for customer-loyalty data subject-rights requests, marketing-consent management, PCI DSS-aligned PII handling.
Education
Schools and universities using Priva for student-record subject-rights requests, parental-consent management, alumni-data retention.
Obligation to control
What the obligation asks for, and what actually delivers it.
Mapping duties to mechanisms, because the common failure is buying a product and assuming the obligation is discharged. Most rows need a governance decision from you before any technology helps. Take legal advice on interpretation; this is the technical mapping we work to.
| Obligation | Technical control | Governance decision you own | Evidence produced | |
|---|---|---|---|---|
| Know what personal data you hold | Purview classification and Priva discovery | Which systems are in scope, including non-Microsoft | Data map and classification report | |
| Lawful basis for processing | Recorded against processing activities | The basis itself, taken with counsel | Records of processing | |
| Respond to subject rights requests | Priva SRR workflow across M365 | Named owner, response clock, out-of-tenant systems | Request record with actions taken | |
| Retain no longer than necessary | Purview retention and disposal | How long, per data category, and why | Disposition records | |
| Restrict access appropriately | Entra conditional access, sensitivity labels | Who legitimately needs which category | Access review sign-off | |
| Detect and assess a breach | Defender and Purview audit, alerting | Who declares, who decides on notification | Incident record and scope assessment | |
| Manage processors and vendors | Third-party risk assessment | Contract terms and acceptance of residual risk | Vendor assessment records | |
| Demonstrate accountability | Reporting and evidence pack | Named privacy owner with authority | Board-level privacy reporting |
Priva vs manual subject-rights workflows
Why automated subject-rights handling matters.
Most organisations handle data-subject requests manually: someone searches inboxes, copies attachments, redacts in Word, emails to the requester. The honest comparison:
Time per subject-rights request
Manual workflow8-40 hours
Microsoft Priva1-4 hours
Search across M365 estate
Manual workflowManual
Microsoft PrivaAutomated
Redaction
Manual workflowManual
Microsoft PrivaAssisted
Deadline tracking
Manual workflowSpreadsheet
Microsoft PrivaBuilt-in
Audit trail of request handling
Manual workflowLimited
Microsoft PrivaFull chain of custody
Risk of missed deadline
GDPR is 30 days; UAE PDPL has similar timelines.
Manual workflowHigh
Microsoft PrivaLow
Cost per request (mid-volume)
Manual workflowAED 2,000-5,000
Microsoft PrivaAED 200-500
| Feature | Manual workflow Per-request improvisation | Microsoft Priva Automated, audited |
|---|---|---|
Time per subject-rights request | 8-40 hours | 1-4 hours |
Search across M365 estate | Manual | Automated |
Redaction | Manual | Assisted |
Deadline tracking | Spreadsheet | Built-in |
Audit trail of request handling | Limited | Full chain of custody |
Risk of missed deadline GDPR is 30 days; UAE PDPL has similar timelines. | High | Low |
Cost per request (mid-volume) | AED 2,000-5,000 | AED 200-500 |
How a deployment runs
From privacy audit to managed Priva operations.
Every Priva engagement runs the same path. Documented, evidenced, deliverable on a fixed timeline.
- 1
Privacy audit
2-3 weeks
Current-state privacy posture, regulatory mapping (GDPR, PDPL, sector-specific), data-flow assessment. Output: gap report and deployment plan.
- 2
Schema design
1-2 weeks
Privacy risk policies, subject-rights-request templates, consent receipt schemas, cross-border transfer register design. Reviewed and signed off before build.
- 3
Deployment
3-5 weeks
Risk policies activated, SRR workflows configured, integration with Purview labels, dashboards built, training delivered to compliance team.
- 4
Operate
Continuous
Ongoing risk monitoring, subject-rights-request handling, quarterly policy reviews, audit evidence kept current. Same team that deployed operates.
“We process 12-20 subject-rights requests a year and each one used to take a week of an associate's time. GR IT deployed Priva with proper search and redaction workflows, integrated with our retention labels, and the average request now takes 3 hours. We also have audit-ready evidence of every request, redaction, and deadline. The next regulator review will be a non-event.”
Hassan Al Suwaidi
Data Protection Officer · B2C SaaS company, GDPR-applicable
Subject-rights requests from 1 week to 3 hours
Common questions
Microsoft Priva, frequently asked.
Not necessarily. Purview covers most data-protection use cases (DLP, retention, eDiscovery, sensitivity labels). Priva adds privacy-specific workflows: privacy-risk policies, subject-rights-request automation, consent management, privacy-impact assessments. Most clients on E5 Compliance get value from Priva when they handle 5+ subject-rights requests per year, or when they need defensible privacy posture for GDPR or PDPL.
Workflow runs through stages: intake, identity verification, search across M365, review and redact, package and deliver, document the response. Deadline tracking automatic. Audit trail maintained for regulator review. We configure the workflow per regulatory framework you operate under.
The platform is regulator-agnostic; we configure workflows aligned to your regulator. UAE PDPL has subject-rights, retention, transfer-restriction, and consent obligations similar to GDPR but with UAE-specific provisions. Our deployment includes UAE PDPL-aligned templates and documentation.
Three risk types out of the box: data overexposure (too many people with access to PII), data hoarding (PII retained beyond purpose), data transfer (PII moving across geographic or organisational boundaries). Each policy is tuned to your environment to avoid alert fatigue.
Priva includes templates and tooling for privacy-impact assessments, but DPIAs are a documented decision process that requires your DPO or privacy team to operate. Priva accelerates the work; it does not replace the accountability.
Priva captures consent receipts, tracks withdrawal, and integrates with marketing platforms. We typically integrate with Dynamics 365 or HubSpot for marketing-consent workflows; for ad-hoc consent, the Priva native tooling is sufficient.
Yes. Common takeover work: privacy-risk policy tuning, subject-rights-request workflow refinement, integration with existing privacy management platforms (OneTrust, TrustArc). Most takeovers complete in 3-4 weeks.
For clients on OneTrust, TrustArc, or DataGuard: Priva handles the M365-native discovery, search, and SRR workflows; the third-party platform handles consent and assessment workflows. We design the integration to avoid duplicated processes.
Federal Decree-Law 45 of 2021 establishes a set of obligations that are recognisable to anyone who has dealt with GDPR, though the detail differs and you should take legal advice on interpretation rather than ours. Practically, the technical work falls into five areas. You need to know what personal data you hold and where it lives, which is a discovery problem before it is a policy problem. You need a lawful basis recorded for processing it. You need to be able to respond to a data subject exercising their rights within the required period, which means being able to find every copy of one person data across mail, files, chat and line-of-business systems. You need to retain data only as long as you have a reason to, which means retention policies that actually delete. And you need to be able to detect and report a breach. Priva and Purview together cover the technical half of that; the governance half is yours.
This is the request that exposes whether privacy work was done properly, and for most organisations the honest first answer is no, not completely. Personal data spreads: the CRM record is obvious, but there are also mailboxes containing correspondence, files in OneDrive and SharePoint, chat history in Teams, exports someone made to a spreadsheet, the accounting system, the marketing platform, backups, and often a line-of-business system nobody thought of. Priva subject-rights requests find it across Microsoft 365 and produce a defensible record of what was found and actioned. The parts outside Microsoft 365 need to be mapped in advance, which is why the data map matters more than the tooling. Backups are their own conversation, because most retention frameworks accept that a backup will age out rather than being surgically edited, but you have to be able to state that position rather than discover it under pressure.
Four to eight weeks for a mid-sized organisation, and the technical configuration is the smaller part. Weeks one and two are discovery: running the data scans, seeing what personal data actually exists and where, which is usually the moment somebody discovers a spreadsheet of customer records in a shared folder from 2019. Weeks three to five are policy: privacy risk policies tuned so they surface genuine issues rather than thousands of false positives, subject-rights-request workflows built with named owners and an agreed response clock, and retention aligned to what you have decided you need. Weeks six to eight are operationalising it, which means training the people who will actually run a request and testing the process end to end with a dummy request. What we need from you is a named privacy owner who can make decisions, and access to the systems outside Microsoft 365 for the data map.
Out of the box it will over-report, and treating every alert as equally urgent is how organisations abandon the tool in month three. The triage we apply is by exposure and sensitivity. Personal data shared externally or through an anyone-with-the-link URL is the top tier, because it is both sensitive and already outside your control. Personal data sitting in locations with broad internal access is second. Data being transferred across a boundary you care about is third. Data simply existing in a place you would expect it to exist is usually not a risk at all, and tuning those out is most of the first month of work. The goal is a small number of alerts a week that a human genuinely reviews, not a dashboard nobody opens.
Often not as a product, and we will say so. If you are twenty people, hold a modest amount of customer data, and can genuinely enumerate where it lives, then good retention policies, sensitivity labels for the categories that matter, and a written subject-rights process will meet the obligation at a fraction of the cost and complexity. Priva earns its place when the estate is large enough that nobody can answer where personal data lives without a tool, when you handle special categories of data, when you receive subject-rights requests with any regularity, or when a regulator or a major customer expects to see systematic evidence rather than a policy document. We would rather scope you out of a licence you do not need and keep the relationship.
Somebody who can make decisions, and specifically not IT alone, which is the most common structural mistake. Privacy questions are business questions wearing technical clothing: how long should we keep customer records, what is our lawful basis for this processing, do we accept the risk of this data sitting in this location. IT can implement any answer but should not be choosing it. The workable pattern in UAE mid-market is a named privacy owner in legal, compliance or operations who holds the decisions, with us providing the technical implementation, the evidence and the monthly reporting. Where there is genuinely nobody to fill that role, a virtual privacy or CISO arrangement works, and that is a service we provide rather than a gap we ignore.
You will be operating against a clock, which is why the preparation matters more than the tooling. The technical sequence is contain first, then establish scope: what data, whose data, how many records, and whether it left the organisation. Priva and Purview audit data help enormously with the scope question, and that question is the one that takes longest without them, because you cannot report what you cannot describe. In parallel there is a notification decision, which is a legal judgement rather than a technical one, so your privacy owner and your counsel lead it. The practical advice is to rehearse this before you need it, because the difference between an organisation that has run a tabletop and one that has not is measured in days at exactly the point where days matter.
They overlap deliberately and the split is easy to state. Purview is about data governance broadly: classification, sensitivity labels, data loss prevention, retention, eDiscovery, insider risk. Priva sits on top of that specifically for privacy: privacy risk management and subject-rights requests, using the same underlying classification Purview provides. So Priva depends on Purview classification being in place, which is why deploying Priva into an estate with no labelling and no classification produces disappointing results. If you are doing one first, do the Purview foundation. If your driver is specifically PDPL or GDPR obligations and subject-rights requests, Priva is what turns that foundation into a privacy programme.
The licence is rarely the main expense and quoting on it alone is misleading. Priva is licensed per user and sits on top of Microsoft 365 licensing that already includes the Purview classification it depends on, so for organisations already on E5 the incremental licence cost is modest. The larger costs are the discovery and data mapping work, which is genuinely weeks of effort and cannot be skipped, the policy tuning needed to stop the tool producing noise, and the ongoing operation of triaging alerts and running requests. We quote those separately and transparently so you can see what is one-off project work and what is recurring. For a smaller organisation the honest total is often lower than expected because the discovery is quicker; for a large estate with many non-Microsoft systems it is higher, and we would rather you knew that at the scoping call.
Yes, and employee data is frequently the larger exposure in a UAE business, which surprises people who assumed privacy work was about customers. A typical employer holds passport and visa copies, Emirates ID scans, medical insurance records, salary and bank details, performance documentation, and often the same for family members on dependant visas. Much of that qualifies as special category data and a good deal of it sits in mailboxes and shared folders rather than a controlled HR system, because it was emailed during onboarding and never cleaned up. Priva discovery finds it, sensitivity labels and DLP restrict it, and retention disposes of it once the reason for holding it ends. The governance question you have to answer first is how long you need to keep records after someone leaves, and that is a decision to take with counsel rather than a default to accept.
Yes, and for most clients this is the more useful half. Deploying Priva is a project; operating a privacy programme is a monthly rhythm. The ongoing service covers triaging privacy risk alerts so somebody genuinely reviews them, running subject-rights requests end to end when they arrive, keeping the data map current as new systems appear, quarterly retention and policy review, evidence maintained for audits and customer assessments, and reporting that a board or a privacy owner can act on. The alternative, which we see often, is a well-configured tenant where nobody has opened the privacy dashboard in eight months, which satisfies nothing and no one.
You can, and we would usually advise against leading with it. Priva discovery will itself surface a great deal of what belongs in the data map, so there is a chicken-and-egg argument for running them together, and for a Microsoft-only estate that works well. Where it goes wrong is treating the Priva view as complete when a third of your personal data sits in an HR system, an accounting platform and a recruitment tool that Priva never sees. The pragmatic sequence we use is to run Priva discovery early for the Microsoft 365 estate, map the non-Microsoft systems manually in parallel, and hold off on subject-rights workflows until both halves are known. Otherwise the first genuine request exposes the gap at the worst possible moment.
Privacy readiness
Twelve questions a UAE PDPL readiness review will ask you.
Work through these before anyone sells you a licence. If you can answer the first group confidently, you are further ahead than most organisations we assess. If you cannot, that is where the work starts, and no product will substitute for it.
Do you know what you hold
- Can you list every system holding personal data, including outside Microsoft 365?The accounting platform, the recruitment system, the visa records, the CCTV. Not just the CRM.
- Do you know which of it is special category data?Health, biometric, financial. The consequences of getting it wrong are different.
- Is there a recorded lawful basis for each processing activity?A basis chosen after the fact is much harder to defend than one recorded at the start.
- Do you know where data physically resides, including backups?The copies are what get missed, and an auditor will ask about them specifically.
Can you act on it
- Could you find every copy of one person data within the response period?Test it with a dummy request before a real one arrives.
- Is there a named owner for subject-rights requests?Not a team, a person, with a deputy for when they are on leave.
- Do retention policies actually delete, or just describe deletion?A policy nobody enforces is evidence against you, not for you.
- Can you evidence what was deleted and when?The record of action matters as much as the action.
What happens when it goes wrong
- Has the breach process been rehearsed, not just written?The scope question is the slow one. Practise answering it.
- Who decides whether to notify, and how fast can they be reached?A legal judgement on a clock. Know the name and the number.
- Do your vendor contracts cover their obligations on your data?Your processors are your exposure. Check what the contract actually says.
- Is anyone reviewing privacy alerts weekly?The most common end state is a well-configured dashboard nobody opens.
Further reading
Resources for privacy leads.
Microsoft Purview
Data-protection foundation that Priva builds on. Sensitivity labels, DLP, retention, audit logging.
Compliance Manager
Compliance assessment platform that scores your privacy posture against GDPR, PDPL, and sector frameworks.
Cybersecurity audit
Independent privacy posture audit. Subject-rights workflow review, GDPR/PDPL gap analysis, written remediation programme.
Ready to deploy Priva properly?
Talk to a privacy specialist.
Three-minute form. Our privacy team gets back the same business day to schedule a discovery call. We will tell you whether Priva fits your privacy-workflow volume before you commit licensing.
Related Services
Explore more solutions that work great with this service