Series: This is Part 6 of 7 in my series on Microsoft Purview Insider Risk Management. New to the series? Start with the series guide, which summarises every part.
This is the question security leaders and data protection officers ask me most: is insider risk management something we have to do by law, or is it just a service Microsoft provides?
The short answer
No law names it. No Irish or EU law says you must use Microsoft Purview Insider Risk Management, or any particular product. It is a Microsoft service.
But the results it delivers are expected. The main rules and standards – GDPR, NIS2, DORA and ISO 27001 – all expect you to stop data leaking out, manage the security risk of people joining and leaving, and spot unusual activity. At the same time, data protection law sets strict rules on how you monitor employees. Insider Risk Management sits between those two pressures: protecting personal data, while respecting the privacy of the people who handle it.
Important: I am a security architect, not a lawyer. This section explains how the frameworks relate to Insider Risk Management. Get advice from your DPO and legal team on your own obligations.
What the laws and standards expect
| Law or standard | What it expects | How Insider Risk Management helps |
|---|---|---|
| GDPR Article 32 (security of personal data) | Suitable technical and organisational measures to protect personal data, including from being shared without permission. Pseudonymisation is named as an example. | Spots insiders moving personal data out, and hides the identities of the people it monitors. |
| GDPR Articles 33 and 34 (breach reporting) | Tell the Data Protection Commission within 72 hours of becoming aware of a personal data breach, and tell the people affected if the risk to them is high. | Alerts and timelines tell you a breach has happened and show what left, when and how. |
| NIS2 Article 21(2)(i) (EU cybersecurity law) | Security around staff, control over who can access what, and managing company assets. Management boards are held accountable. | Links HR events such as resignations to data activity, and adjusts access automatically for risky people. |
| DORA (EU law for banks, insurers and other financial firms) | Managing IT risk, including quickly spotting unusual activity. Applies from January 2025. | Spots unusual behaviour and sends alerts to the security team. |
| ISO/IEC 27001:2022 (international security standard) | Controls 6.5 (security when people leave or change role), 8.12 (preventing data leaks) and 8.16 (monitoring for unusual activity). | Evidence for all three controls when auditors ask. |
| NIST SP 800-53 PM-12 (US government security standard) | An insider threat programme – one of the few standards that asks for one by name. Relevant if you supply the US government. | Provides the technology at the heart of an insider threat programme. |
NIS2 in Ireland: NIS2 is an EU cybersecurity law that Ireland has not yet written into Irish law. A draft outline of the National Cyber Security Bill was published in August 2024, and in July 2026 the European Commission took Ireland to the EU Court of Justice over the delay. The National Cyber Security Centre is set to be the main regulator. The obligations are coming, and organisations it will apply to should be preparing now.
The PII gap
PII stands for personally identifiable information – anything that identifies a person, such as a name, address or PPS number. Most Purview projects focus on protecting that data directly: finding it, labelling it and stopping it leaving with DLP. That protects the data. It does not tell you when a trusted person, who is allowed to see that data, starts behaving in a way that puts it at risk. That is the gap Insider Risk Management fills.
But there is a second side to the gap. Monitoring employees means collecting information about them, which is itself covered by data protection law. The Data Protection Commission’s 2023 guidance for employers makes four points clear. Workplace monitoring must be open and proportionate – no more than is needed. Employers will find it hard to justify monitoring simply because it is in their business interest (known as “legitimate interests”). A data protection impact assessment (DPIA) – a written assessment of the privacy risks – is essential before monitoring starts. And secret monitoring should be avoided wherever possible. European court rulings point the same way: employees should be told in advance that monitoring may take place.
This is where Insider Risk Management is genuinely different from a surveillance tool. Its design lines up closely with those principles:
| Data protection principle | How Insider Risk Management supports it |
|---|---|
| Transparency – be open about it | Policies watch activities you can describe to staff in your IT acceptable use policy and privacy notice. Built-in notice templates help you communicate with them. |
| Proportionality – no more than needed | People are only scored after an event such as a resignation. Policies can be limited to specific groups. |
| Pseudonymisation – hide identities | On by default. Names are only revealed to authorised investigators. |
| Limit who can see what | Separate role groups for the people who set it up, review alerts, investigate and audit. |
| Accountability – keep a record | Every action inside Insider Risk Management is logged, and a dedicated Auditors role group can review that log. |
| Purpose limitation – only use it for the stated reason | Each policy template has one clear purpose – data theft, data leaks, security breaches or risky AI use. |
| No secret monitoring by default | It uses activity that is already recorded, such as audit logs. It does not record keystrokes. Forensic evidence (screen recording) is optional and needs approval – treat it with particular care in your DPIA. |
What you need to do
- Complete a DPIA before switching on Insider Risk Management, and update it when you add new policies or features.
- Write down your legal basis – the legal reason you are allowed to do this – and, if it is legitimate interests, show how you weighed your needs against employees’ privacy.
- Update your IT acceptable use policy and employee privacy notice so staff know what activity may be monitored and why.
- Involve HR, legal, the DPO and employee representatives early. The HR connector makes HR a stakeholder anyway.
- Keep pseudonymisation on and keep the Investigators role group small.
- Set retention for alerts and cases in line with your records policy.
- Link it to the standards you follow – for example ISO 27001 controls 6.5, 8.12 and 8.16, NIS2 Article 21 and DORA – so the evidence is ready when auditors ask.
My view
No regulator will ask you whether you have switched on Insider Risk Management by name. But every standard above expects you to spot and deal with the risk it covers, and data protection law expects you to do it fairly and proportionately. Few tools do both as well.
And here is the uncomfortable question: after a departing employee walks out with a customer database, how do you explain to the Data Protection Commission that the control designed to catch it was already licensed, already paid for – and switched off?
The rest of the series
- Series guide: Insider Risk Management with Microsoft Purview
- Part 1: The Purview workload everyone skips
- Part 2: From Ignite 2019 to AI agents
- Part 3: Licensing, prerequisites and pay-as-you-go
- Part 4: Creating your first policy
- Part 5: Adaptive Protection with DLP
- Part 7: Insider risk in Conditional Access and the Data Security Triage Agent
References
- NIS2 Directive Article 21 – cybersecurity risk-management measures
- NIS2 in Ireland – transposition status
- Irish Data Protection Commission issues guidance for employers – Lewis Silkin
- ISO 27001:2022 Annex A 8.12 Data leakage prevention – ISMS.online
- Learn about Insider Risk Management – Microsoft Learn
Seán O’Farrell | cloud-secure.ai
