The Privacy Implications of DLP and Insider Risk Management

It is easy to view DLP and IRM as a purely technical deployment. Policies are switched on, indicators are selected, and alerts start flowing. However, these tools scan the content of emails, Teams messages and documents, track file activity and browsing, correlate signals from HR systems, and assign risk scores to individuals. From a data protection perspective, that places them firmly in the territory of workplace monitoring and profiling. 

With the main data protection provisions of the Data (Use and Access) Act 2025 (DUAA) now in force alongside the UK GDPR, it is a good time to revisit how these tools are deployed. In this blog, we'll explore the key privacy considerations organisations should address before, and after, switching on DLP and IRM capabilities. 

Treat It as High-Risk Processing 

In almost every deployment, DLP and IRM will be high-risk processing. The activity typically involves several of the factors that indicate high risk, including: 

• Systematic monitoring of individuals' behaviour across email, messaging, endpoints and cloud services
• Profiling and risk scoring, where activity is correlated over time to assign a risk level to a person
• Vulnerable data subjects, as there is an inherent power imbalance between employer and worker
• Large-scale processing, often covering the entire workforce and the third parties they communicate with
• Innovative technology, including machine learning classifiers and, increasingly, AI-driven triage 

The ICO's guidance on monitoring workers is clear that monitoring likely to result in a high risk requires a Data Protection Impact Assessment (DPIA) under Article 35 of the UK GDPR. It specifically calls out the monitoring of emails and messages as an example. Even where you conclude a DPIA isn't strictly required, the ICO recommends completing one as good practice. The DUAA has not removed this requirement. 

Completing the DPIA 

Your DPIA should be completed before policies go live, not retrospectively once alerts start appearing. As a minimum, it should: 

1. Describe each Purview capability in scope (for example, endpoint DLP, communication compliance, IRM policy templates, Adaptive Protection) and the data each one processes
2. Set out the specific purposes and why the monitoring is necessary to achieve them
3. Assess whether less intrusive alternatives would achieve the same outcome
4. Identify risks to individuals, including chilling effects, inaccurate risk scores and unfair disciplinary outcomes
5. Record the mitigations you'll apply and the residual risk that remains
6. Involve your Data Protection Officer (DPO) and, where appropriate, seek the views of workers or their representatives 

If high residual risk remains that you cannot mitigate, you'll need to consult the ICO before processing begins. 

The DPIA shouldn't be a one-off exercise. New policy templates, indicators and features are added to Purview regularly, so treat each material configuration change as a trigger to review it. 

Identifying Your Lawful Basis 

Consent is rarely appropriate for workplace monitoring, as the power imbalance means it is unlikely to be freely given. Most organisations will rely on legitimate interests, supported by a documented Legitimate Interests Assessment (LIA). 

The DUAA now lists ensuring the security of network and information systems as an example of a legitimate interest, which supports the case for DLP. It has also introduced a set of 'recognised legitimate interests', including detecting, investigating or preventing crime, which do not require a balancing test. However, be cautious here. Much DLP and IRM activity relates to policy compliance rather than crime, and the processing must still be necessary. Neither change removes the need for transparency, a DPIA or proportionate configuration. 

Be Transparent with Your People 

Workers have a right to be informed about how their personal data is used, and the ICO expects them to understand the nature, extent and reasons for any monitoring. A generic line in an employee privacy notice stating that 'systems may be monitored' is unlikely to be sufficient for DLP and IRM. 

Your transparency information should explain, in plain language: 

• What is monitored (for example, email and Teams content, file downloads, USB transfers, printing, cloud uploads, browsing activity)
• Why it is monitored, and which behaviours are not permitted
• Whether individuals are risk scored, and what can happen as a result
• Who can see alerts and investigation data, and how long it is kept
• Whether data from other sources, such as HR systems, is combined with activity data
• How individuals can exercise their rights or raise a complaint 

This information should be reflected consistently across your privacy notice, acceptable use policy, information security policy and disciplinary procedure. Consider just-in-time notices too. Purview's DLP policy tips, which explain to a user why an action has been blocked or flagged, are a useful way of reinforcing transparency in the moment. 

Acceptable Use of Work Devices and BYOD 

Employees can only be fully informed about monitoring if they're clear on what acceptable use looks like in the first place. Your acceptable use policy and supporting guidance should set out clear expectations for both corporate devices and personal devices used for work (bring your own device, or BYOD), including: 

• Personal use of work devices: Whether it is permitted, to what extent, and that personal activity on a monitored device (such as personal email, browsing or messaging) may be captured by DLP and IRM
• Permitted tools and services: Which applications, cloud storage, removable media and AI tools are approved for handling work data, and which are not
• Handling sensitive data: How information should be classified, labelled and shared, with practical examples of what would trigger a policy match
• BYOD boundaries: What the organisation can and cannot see on a personal device. For example, whether controls apply only to work apps and data (such as through app protection policies) or to the device as a whole
• Consequences: What happens when a policy match occurs, and how it may lead to investigation or disciplinary action 

BYOD deserves particular care. Expectations of privacy are higher on a personal device, so monitoring should be limited to work data and work applications wherever possible, and the DPIA should assess this separately. Employees should understand exactly what they are agreeing to before enrolling a personal device. 

Policy alone isn't enough. Support it with practical guidance, onboarding and regular training, and make sure policies are easy to find. If employees genuinely understand the rules, they are less likely to trigger alerts in the first place, and any monitoring that follows is far easier to justify as fair. 

Covert monitoring should be the exception. It is only likely to be justified in limited circumstances, such as a specific investigation into suspected criminal activity where telling the individual would prejudice it. Make sure the circumstances in which it may occur are set out in policy and that each instance is authorised and documented. 

Finally, from 19 June 2026, the DUAA requires controllers to have a process for handling data protection complaints, including acknowledging them within 30 days. Monitoring is a likely source of complaints, so make sure your transparency information explains how to raise one. 

Configure for Necessity and Proportionality 

Purview offers a wide range of policy templates and well over 100 risk indicators. The fact that a capability is available doesn't mean it is necessary to use it. Your configuration choices are where data minimisation is won or lost. 

Some practical questions to ask include: 

• Scope: Does every policy need to apply to every user, or can it be targeted at specific roles, departments or high-risk events (such as a leaver's notice period)? Where 'priority user groups' are used, can you justify why those individuals are subject to greater scrutiny?
• Indicators: Is each indicator linked to a defined risk in your DPIA? Indicators such as browsing activity or sentiment in communications are more intrusive and need a stronger justification.
• Thresholds: Are thresholds tuned to reduce false positives, so that people aren't drawn into investigations unnecessarily? 

Avoiding Function Creep 

Data collected for one purpose shouldn't be quietly reused for another. Activity data gathered to prevent data exfiltration shouldn't become a tool for productivity monitoring or performance management, unless that purpose has been separately assessed and communicated. Record the agreed purposes in your DPIA and revisit them when new requests for the data arise. 

Keep Humans Meaningfully Involved in Decisions 

Since 5 February 2026, Article 22 of the UK GDPR has been replaced by new Articles 22A to 22D. Rather than a general prohibition, solely automated 'significant decisions' (those with legal or similarly significant effects) are now permitted, provided safeguards are in place. These include giving individuals information about the decision, allowing them to make representations, enabling them to obtain human intervention, and allowing them to contest it. 

Tighter restrictions remain where significant decisions are based on special category data. This is relevant to DLP and IRM, as the content being scanned can easily reveal information about health, trade union membership or religious beliefs. 

A decision is treated as solely automated where there is no meaningful human involvement, and the extent to which profiling is used must be considered. For DLP and IRM, this means looking carefully at where automation could affect an individual: 

• Adaptive Protection automatically applies stricter DLP or Conditional Access controls to users based on their insider risk level. Blocking a single file transfer is unlikely to be significant, but restricting someone's access in a way that prevents them doing their job could be.
• Disciplinary outcomes should never flow directly from a risk score or alert. An investigator should review the evidence, consider context and reach their own conclusion.
• AI-assisted triage can help prioritise alerts, but reviewers must be able to understand and challenge its output rather than simply accepting it. 

Meaningful human involvement means the reviewer has the authority, competence and information to change the outcome. A person who rubber-stamps every automated recommendation does not provide it. Document where human review sits in your workflow and train investigators accordingly. 

False positives deserve particular attention. DLP and IRM tools work on patterns, and a legitimate business activity can look identical to exfiltration. Building in a step where the individual can explain the activity before any action is taken is both fair and good practice. 

Other Key Considerations 

Special Category and Criminal Offence Data 

Even where it isn't the purpose of monitoring, DLP and IRM will inevitably process special category data. A flagged email may relate to a medical appointment, a grievance or union activity. You'll need an Article 9 condition (commonly the employment condition in Schedule 1 of the Data Protection Act 2018) and, in most cases, an Appropriate Policy Document. If investigations may uncover suspected criminal activity, consider your Article 10 position for criminal offence data too. 

Retention Periods 

Alerts, cases, user activity reports, evidence and exported content all need defined retention periods. These should reflect your purposes, not simply the product defaults. Alerts dismissed as false positives should be kept for a much shorter period than evidence supporting a disciplinary outcome, which should align with your HR retention schedule. Remember that exports and evidence held outside Purview, such as in case management or HR systems, need the same discipline. 

Access Controls and Pseudonymisation 

Purview IRM pseudonymises usernames by default, so reviewers see a randomised identifier rather than a name. We'd recommend keeping this enabled, and only revealing identities once an alert is escalated for investigation. Use Purview's role groups to separate analysts from investigators, restrict access to a small, trained team, and regularly review audit logs of who has accessed what. The individuals reviewing alerts will see highly sensitive information about colleagues, so confidentiality obligations and training are essential. 

Individual Rights 

Monitoring data is personal data and is within scope of subject access requests. The DUAA confirms that you're only required to conduct reasonable and proportionate searches, but you'll still need to be able to locate and retrieve IRM and DLP data relating to an individual. Exemptions, such as where disclosure would prejudice the prevention or detection of crime, must be applied case by case. Consider how you'll handle objections to processing based on legitimate interests, too. 

Third Parties 

DLP scans communications in both directions, so customers, suppliers and other external contacts will be caught. Make sure your external privacy notices reflect this. 

Processors and International Transfers 

Microsoft will act as your processor. Review the contractual terms, understand where Purview data is stored, and assess any international transfers. The same applies to any managed service provider that triages alerts on your behalf. 

Interception of Communications 

Monitoring communications in transit engages the Investigatory Powers Act 2016 and the associated Lawful Business Practice Regulations. These permit interception for certain business purposes, but only where you've made reasonable efforts to inform users that their communications may be monitored. Public sector organisations should also consider the right to privacy under Article 8 of the European Convention on Human Rights. 

Engaging Workers and HR 

Involving HR, legal, works councils or trade unions early helps build trust and surfaces concerns you may not have considered. It also ensures your disciplinary processes are ready to handle outcomes from IRM investigations fairly and consistently. 

A Practical Checklist 

• Before switching on, or expanding, DLP and IRM capabilities, make sure you have:
• Completed and signed off a DPIA, with DPO input
• Documented your lawful basis, LIA and Article 9 condition
• Updated your privacy notices, acceptable use and disciplinary policies, with clear guidance on work devices and BYOD
• Scoped policies and indicators to what is necessary
• Kept username pseudonymisation enabled and restricted access via role groups
• Defined where meaningful human review sits before any significant decision
• Set retention periods for alerts, cases and evidence
• Tested your ability to respond to subject access requests and complaints
• Reviewed processor terms and international transfers
• Scheduled periodic reviews of configuration against your DPIA 

Balancing Security and Privacy 

DLP and IRM tools are a valuable part of a modern security programme, and data protection law doesn't prevent you from using them. But they need to be deployed with the same care as any other high-risk processing activity. The organisations that get this right treat privacy as a design input from the start, rather than a box to tick once the policies are live. Doing so not only supports compliance, but builds the trust that makes monitoring sustainable. 

If you're planning a Purview deployment, or want to review the privacy posture of an existing one, our Data Privacy and Microsoft Purview teams can help, from DPIAs and policy design through to configuration. Get in touch with one of our team to find out more.