Microsoft Purview
Purview labels what it can parse. GDPR needs the rest.
Data & More is a GDPR classification and verified-deletion layer for Microsoft 365. It finds personal and Article 9 data Purview’s out-of-the-box classifiers miss, has the data owner confirm, then deletes or labels so Purview, DLP, and Copilot are not acting on junk.
Benchmark
Measured on a public dataset - available on Hugging face
89,521,
files in the synthetic set
73GB
total size, SharePoint-hosted
100%
manually validated ground truth
28
languages DAM classifies
Passports
Purview got almost every passport wrong.
Out-of-the-box classification on 89,521 manually validated files. 99.8% of passports came back wrong.
The table
What Purview’s out-of-the-box classifiers did on 89,521 files
| Feature | Data & More | Purview OOTB |
|---|---|---|
| Passport classification | GDPR / Article 9 categories, including scans and images | 99.8% misclassified |
| Passport auto-label | Owner-verified label written into Purview | 98.1% unlabeled (1 file labelled) |
| Payment-card classification | Same engine as passports — not a separate regex pack | 91% misclassified |
| Payment-card auto-label | Labels follow verified classification, all file types we scan | 57% unlabeled |
How to read this
This is not “Purview is useless.” Sensitivity labels, Microsoft DLP, and retention still sit in Purview. Everything those features do inherits classification. If classification is regex on a handful of English patterns, every downstream control inherits that error rate.
The dataset mirrors real unstructured mix (no live personal data). Method and files: /en/blog/real-world-purview-benchmark — reproduce on Hugging Face, dataset kbillesk/synthetic-privacy. Purview passport classifier at medium confidence, data in SharePoint.
Purview has no real GDPR/privacy classification out of the box: a few imprecise samples, limited languages. National certificates, health, union, political and sexual orientation, tax, salary, CVs, consents — missing. To get actual GDPR coverage you would custom-build classifiers for 28+ languages.
Error rate
The same four numbers, as bars
Higher bar = more of the ground-truth set Purview got wrong or failed to label.
Honest split
Purview, Data & More, together
Purview is best at
The Microsoft control plane
Sensitivity labels, auto-labelling policies, DLP, and retention inside the tenant you already pay for. Keep it. Do not rip E5 out to “replace Purview.”
Data & More is best at
GDPR classification and verified deletion
Personal and Article 9 data across mail, SharePoint, OneDrive, Teams, and file shares, in 28 languages. A human confirms before anything is deleted or labelled.
Together
We classify. Purview enforces.
Verified findings become Purview labels and a smaller corpus. Copilot, DLP, and retention then act on data that still has a purpose — not the pentest in a 2019 inbox.
How it works
Find. Verify. Delete or label.
The same three steps as the rest of the platform. Purview is a destination for labels, not the classifier we trust for GDPR.
Find
Classify unstructured data in Exchange, SharePoint, OneDrive, Teams, and file shares. GDPR and Article 9 categories, 28 languages — including scans and images Purview regex never sees.
Verify
The data owner confirms. Not an auto-delete policy. Every decision is logged. That is what makes deletion defensible in front of a DPO or an auditor.
Delete or write a Purview label
Confirmed junk is deleted. What must stay can receive a Purview sensitivity label so Microsoft DLP and retention finally have a GDPR-accurate input.
Data & More for Purview
How classification and verified deletion sit next to Microsoft Purview.
Questions buyers actually type
Is Data & More an alternative to Microsoft Purview?+
It is a complement, not a rip-and-replace. Purview remains the Microsoft label, DLP, and retention plane. Data & More classifies GDPR and Article 9 data Purview’s out-of-the-box classifiers miss, then deletes or writes labels Purview can enforce. On 89,521 files, Purview misclassified 99.8% of passports and 91% of payment cards.
Does Data & More replace Purview sensitivity labels?+
No. We keep Purview labels. After the data owner verifies a finding, we can apply a Purview sensitivity label so auto-labelling, DLP, and retention inherit a GDPR-accurate classification instead of a regex guess.
Why did Purview miss passports in the benchmark?+
Out-of-the-box passport classification is largely regular expressions. That produces false positives on text that looks like an ID, and false negatives on passports stored as images or scans. Auto-labelling also supports only a limited set of file types — in this test, one passport file was labelled.
Can we reproduce the 89,521-file test?+
Yes. The synthetic set (73 GB, no live personal data) is on Hugging Face as kbillesk/synthetic-privacy. Load it into SharePoint, run Purview’s passport and payment-card classifiers at medium confidence, and compare to the published ground truth. Method: dataandmore.com/en/blog/real-world-purview-benchmark.
Which Microsoft 365 sources does classification cover?+
Exchange Online mail, SharePoint, OneDrive, and Teams documents, plus on-prem file shares and hybrid sources on the Hybrid plan. Chat and Teams channels are not fully scanned — see the prices page notes.
How does verified deletion relate to Purview retention?+
Retention keeps what still has a purpose. Deletion removes what does not. Purview retention cannot fix data that was never classified as personal. We delete or label first; Purview retention then applies to a smaller, honest corpus.
See it on your own mailboxes
Free privacy and security review — up to 250 mail accounts. No commitment. Related: Copilot privacy and the full platform.