Language

🇬🇧English🇩🇰Dansk🇸🇪Svenska🇩🇪Deutsch

This page is not yet available in Svenska. Showing English version.

Microsoft Purview

Purview labels what it can parse. GDPR needs the rest.

Data & More is a GDPR classification and verified-deletion layer for Microsoft 365. It finds personal and Article 9 data Purview’s out-of-the-box classifiers miss, has the data owner confirm, then deletes or labels so Purview, DLP, and Copilot are not acting on junk.

See the platform

Benchmark

Measured on a public dataset. Not a slide.

89,521,

files in the synthetic set

73GB

total size, SharePoint-hosted

100%

manually validated ground truth

28

languages DAM classifies

The table

What Purview’s out-of-the-box classifiers did on 89,521 files

FeatureData & MorePurview OOTB
Passport classificationGDPR / Article 9 categories, including scans and images99.8% misclassified
Passport auto-labelOwner-verified label written into Purview98.1% unlabeled (1 file labelled)
Payment-card classificationSame engine as passports — not a separate regex pack91% misclassified
Payment-card auto-labelLabels follow verified classification, all file types we scan57% unlabeled

How to read this

This is not “Purview is useless.” Sensitivity labels, Microsoft DLP, and retention still sit in Purview. Everything those features do inherits classification. If classification is regex on a handful of English patterns, every downstream control inherits that error rate.

The dataset mirrors real unstructured mix (no live personal data). Method and files: /en/blog/real-world-purview-benchmark — reproduce on Hugging Face, dataset kbillesk/synthetic-privacy. Purview passport classifier at medium confidence, data in SharePoint.

Purview has no real GDPR/privacy classification out of the box: a few imprecise samples, limited languages. National certificates, health, union, political and sexual orientation, tax, salary, CVs, consents — missing. To get actual GDPR coverage you would custom-build classifiers for 28+ languages.

Error rate

The same four numbers, as bars

Higher bar = more of the ground-truth set Purview got wrong or failed to label.

Passport classificationmisclassified
99.8%
Passport auto-labelunlabeled
98.1%
Payment-card classificationmisclassified
91%
Payment-card auto-labelunlabeled
57%

Honest split

Purview, Data & More, together

01

Purview is best at

The Microsoft control plane

Sensitivity labels, auto-labelling policies, DLP, and retention inside the tenant you already pay for. Keep it. Do not rip E5 out to “replace Purview.”

02

Data & More is best at

GDPR classification and verified deletion

Personal and Article 9 data across mail, SharePoint, OneDrive, Teams, and file shares, in 28 languages. A human confirms before anything is deleted or labelled.

03

Together

We classify. Purview enforces.

Verified findings become Purview labels and a smaller corpus. Copilot, DLP, and retention then act on data that still has a purpose — not the pentest in a 2019 inbox.

How it works

Find. Verify. Delete or label.

The same three steps as the rest of the platform. Purview is a destination for labels, not the classifier we trust for GDPR.

1

Find

Classify unstructured data in Exchange, SharePoint, OneDrive, Teams, and file shares. GDPR and Article 9 categories, 28 languages — including scans and images Purview regex never sees.

2

Verify

The data owner confirms. Not an auto-delete policy. Every decision is logged. That is what makes deletion defensible in front of a DPO or an auditor.

3

Delete or write a Purview label

Confirmed junk is deleted. What must stay can receive a Purview sensitivity label so Microsoft DLP and retention finally have a GDPR-accurate input.

Data & More for Purview

How classification and verified deletion sit next to Microsoft Purview.

Questions buyers actually type

Is Data & More an alternative to Microsoft Purview?+
It is a complement, not a rip-and-replace. Purview remains the Microsoft label, DLP, and retention plane. Data & More classifies GDPR and Article 9 data Purview’s out-of-the-box classifiers miss, then deletes or writes labels Purview can enforce. On 89,521 files, Purview misclassified 99.8% of passports and 91% of payment cards.
Does Data & More replace Purview sensitivity labels?+
No. We keep Purview labels. After the data owner verifies a finding, we can apply a Purview sensitivity label so auto-labelling, DLP, and retention inherit a GDPR-accurate classification instead of a regex guess.
Why did Purview miss passports in the benchmark?+
Out-of-the-box passport classification is largely regular expressions. That produces false positives on text that looks like an ID, and false negatives on passports stored as images or scans. Auto-labelling also supports only a limited set of file types — in this test, one passport file was labelled.
Can we reproduce the 89,521-file test?+
Yes. The synthetic set (73 GB, no live personal data) is on Hugging Face as kbillesk/synthetic-privacy. Load it into SharePoint, run Purview’s passport and payment-card classifiers at medium confidence, and compare to the published ground truth. Method: dataandmore.com/en/blog/real-world-purview-benchmark.
Which Microsoft 365 sources does classification cover?+
Exchange Online mail, SharePoint, OneDrive, and Teams documents, plus on-prem file shares and hybrid sources on the Hybrid plan. Chat and Teams channels are not fully scanned — see the prices page notes.
How does verified deletion relate to Purview retention?+
Retention keeps what still has a purpose. Deletion removes what does not. Purview retention cannot fix data that was never classified as personal. We delete or label first; Purview retention then applies to a smaller, honest corpus.

See it on your own mailboxes

Free privacy and security review — up to 250 mail accounts. No commitment. Related: Copilot privacy and the full platform.