Conducting searches for personal data

Under GDPR, compliance administrators are obliged to respond to any requests by users for access to any personal data relating to them that is stored in the Microsoft 365 tenant. In order to provide the required information, the Content search feature can be used. Content searches use built-in sensitive information types, which can be found in the Security & Compliance Center under Classification | Sensitive info types.

We have discussed these sensitive information types in previous chapters of this book when we talked about DLP and Azure Information Protection (AIP). DLP is particularly useful in protecting your organization against personal data loss as it is capable of detecting personal data in transit in an Exchange Online email and can act accordingly with policy tips, and DLP policies and rules. We will examine this in further detail later on in this chapter.

First, let's take a look at how you can use content searches to...