Before you turn it on: privacy Microsoft 365 logs user activity by default, and Insider Risk Management scores each user automatically based on those logs. Both need a legal basis and the risk assessments national law requires, in the EU and EEA a DPIA under GDPR. Usernames are pseudonymized by default under Settings, Insider Risk Management, Privacy, but pseudonymized is not anonymized: metadata often reveals who it is, and admins can turn the setting off. Role groups, approval of forensic evidence and an audit log control the people who use the tool. The employee notices nothing until an analyst sends a notice email. W INSIDER RISK MANAGEMENT Before you turn it on: privacy Ada Admin Eli Employee TWO LAYERS OF MONITORING It starts with the logs you already have 1 Microsoft 365 logs user activity On by default. Who opened, shared and sent what, and when. 2 Insider Risk Management scores people It analyzes the same logs, automatically and per user. That can feel even more intrusive. Both layers need a legal basis and a risk assessment. THE LEGAL GROUNDWORK Four things to sort out first PSEUDONYMIZED, NOT ANONYMIZED It's easy to work out who it is CONTROLS ON THE CONTROLLERS Who watches the watchers? Microsoft Purview Overview Alerts Cases Policies Settings › Insider Risk Management Privacy We understand how important privacy is to you and your users. For users who perform activities matching your insider risk policies, decide whether to show their actual names or use pseudonymized versions to mask their identities. Show pseudonymized versions of usernames We'll show a pseudonymized version of usernames across all insider risk management features(policies, alerts, cases, and so on). AAnonyIS8-988 Do not show pseudonymized versions of usernames We'll show the actual display names for all users who perform activities matching your insiderrisk policies. GTGrace Taylor Alerts USERPOLICYSEVERITYSTATUS THE USER EXPERIENCE What does Eli notice? Eli is in scope of a Data leaks policy. Outlook Inbox Compliance team Reminder: handling customer data Hi Eli, we'd like to remind you of… Reminder: handling customer data Compliance team · To: Eli Employee Hi Eli, We'd like to remind you of our guidelines for customer data. Customer files stay in our systems, and aren't sent to private email addresses. Read the guidelines on the intranet, or contact us if you have questions. Kind regards, Compliance team Good to know 1/7 INSIDER RISK MANAGEMENT Before you turn it on: privacy Microsoft 365 already logs what people do. Insider Risk Management goes further and scores each user. We cover the legal groundwork, the privacy setting, and what the employee actually notices. informasjonsbeskyttelse.no