Data governance and compliance are the rules and processes that ensure an organisation's data is handled legally, ethically, and securely from the moment it is created until it is permanently deleted. For a Cybersecurity Architect, designing these controls is critical because failing to comply with laws like GDPR or HIPAA can result in massive fines and loss of customer trust. This chapter will walk you through how to design those rules and why they matter for the SC-100 exam.
Jump to a section
A simple way to picture Designing Compliance and Data Lifecycle Governance
Because a restaurant kitchen produces different types of waste at different times of day, a head chef must create rules for how each type of waste is handled from the moment it is created until it is disposed of. This leads to a structured system that ensures food safety, reduces costs, and meets health department regulations.
Consider a busy restaurant kitchen. Raw vegetables arrive, get chopped, cooked, served, and sometimes returned. Each stage creates a different waste type: peelings, spoiled meat, customer leftovers, and expired dry goods. The chef can't just throw everything in one bin. Instead, she classifies each waste item based on its type (organic, hazardous, recyclable) and its sensitivity (raw chicken vs. lettuce trimmings). She then sets rules: peelings go to compost within 24 hours, raw meat waste is sealed in red bags and collected by a specialist company every Monday, and customer leftovers are donated to a local farm if untouched within two hours. She also keeps a logbook showing exactly what was wasted, when, and how it was disposed of. If a health inspector arrives, the chef can prove she followed every rule. This is exactly how data lifecycle governance works: data is classified when created, rules govern how it is stored and used, and when it's no longer needed, it is securely deleted or archived, with complete audit records.
Data governance is the overall framework of policies, processes, and roles that decide how an organisation manages its data. Think of it as the rulebook for who can access data, how long it is kept, and how it must be protected. Compliance means following those rules, as well as external laws and industry standards.
Data lifecycle governance is the part of data governance that specifically manages data from its creation through to its deletion. The lifecycle has several stages: creation, storage, use, sharing, archiving, and deletion. Each stage has its own risks and requirements.
Why does this exist? Before modern governance, companies stored data forever with no plan. This led to huge storage costs, security risks from old data, and legal trouble when auditors asked ''Where is our customer data from 2012?'' Laws like the General Data Protection Regulation (GDPR) in Europe and the Health Insurance Portability and Accountability Act (HIPAA) in the US now require companies to control data carefully.
Key concepts you must know:
Data classification: labelling data by sensitivity (e.g., public, internal, confidential, restricted). This decides which rules apply.
Data retention policy: a rule that says how long each type of data must be kept before it is deleted or archived. For example, tax records must be kept for 7 years in many countries.
Data deletion: permanently removing data so it cannot be recovered. This must be done securely to prevent leaks.
Data residency: where data is physically stored. Some laws require data to stay within a specific country or region.
Data sovereignty: the idea that data is subject to the laws of the country where it is stored.
Data loss prevention (DLP): technologies that detect and block attempts to send sensitive data outside the organisation.
Microsoft Purview: Microsoft's cloud-based data governance and compliance platform. It helps classify data, manage retention, and create audit trails.
Audit trail: a record showing who accessed what data and when. This proves compliance to regulators.
How does a cybersecurity architect design these solutions?
First, you identify what data the organisation holds. This is called ''data discovery''. You use tools like Microsoft Purview Data Map to scan databases, file shares, and cloud storage to find sensitive data.
Second, you classify that data. Purview can automatically label data containing credit card numbers, medical records, or personal identification numbers (PII). You define rules: ''If a file contains 10 or more credit card numbers, mark it as 'Restricted'.''
Third, you create retention labels. These labels tell the system how long to keep the data and what to do when the time expires (delete it or archive it). For example, you might create a label called ''HR Records - 7 years'' that applies to all employee files.
Fourth, you implement DLP policies. These block users from emailing sensitive files to personal addresses or uploading them to unauthorised cloud services.
Fifth, you set up auditing and reporting. Microsoft Purview can log every access to sensitive data and produce reports for regulators.
All of this replaces the old approach of ''store everything forever, hope for the best''. It turns data management from a reactive nightmare into a proactive, automated system.
Finally, you need to test your controls. You run simulated attacks, review logs, and update policies as laws change. The goal is to prove to an auditor that you have a ''defence in depth'' — multiple layers of control that protect data even if one layer fails.
Data Discovery
Use Microsoft Purview Data Map to scan all data sources (Azure SQL, SharePoint, OneDrive) and identify where sensitive data lives. This creates a complete inventory of data assets.
Data Classification
Define sensitivity labels (e.g., Public, Internal, Confidential, Restricted) and map them to data types. Use automated classifiers to scan for patterns like credit card numbers or medical record IDs.
Policy Configuration
Create retention labels (e.g., ''HR Records - 7 years'') and DLP rules (e.g., ''block emailing restricted data outside the company''). Configure adaptive policies if rules need to change based on user role or location.
Policy Enforcement
Publish labels and policies to users through Microsoft 365 apps (Outlook, Teams, SharePoint). Users see labels when creating or editing documents. Automated actions (block, warn, encrypt) happen without user intervention.
Monitoring and Auditing
Enable audit logging (Standard or Premium) to track who accessed sensitive data. Use Data Estate Insights dashboards to review activity, spot mislabelled data, and produce compliance reports for regulators.
Review and Remediation
Regularly review DLP alerts, respond to false positives (e.g., a legitimate email incorrectly blocked), and adjust policies. Periodically test with simulated attacks to ensure controls work.
A large healthcare organisation called HealthFirst operates hospitals across the UK and stores millions of patient records in Microsoft Azure. The IT team must comply with the UK Data Protection Act and GDPR, which require strict controls on personal health data.
First, the cybersecurity architect uses Microsoft Purview to scan all data sources: Azure SQL databases containing appointment records, SharePoint sites with clinical notes, and OneDrive folders used by doctors. Purview's automated scanning finds files containing National Health Service (NHS) numbers, diagnosis codes, and patient names. It tags these files with a ''Patient Data - Restricted'' sensitivity label.
Next, the architect creates retention labels for different data types. For example, patient records must be kept for 8 years after the last treatment (UK legal requirement), then securely deleted. The architect sets a retention label called ''Patient Record - 8 Year Retention'' and applies it to the classified files. Purview automatically triggers deletion after 8 years.
Then, the architect configures DLP policies. One policy blocks any user from emailing a file with the ''Patient Data - Restricted'' label to an external address. Another policy prevents uploading such files to a public cloud service like Dropbox. If a doctor tries to bypass this, the attempt is blocked and logged.
The architect also sets up data residency controls. Because the NHS demands patient data stay in the UK, they configure Azure Policy to prevent storing data in data centres outside the UK. Any attempt to create a resource in a non-UK region is automatically denied.
Finally, they enable audit logging. Every access to a ''Patient Data - Restricted'' file is recorded, including who accessed it, when, and from which device. When the Information Commissioner's Office (ICO) does an audit, the architect can produce a complete report within hours.
Without this governance, HealthFirst could face fines of up to 4% of annual global turnover for GDPR breaches. The architect's design turns a regulatory risk into a manageable, automated process.
The SC-100 exam expects you to design data governance and compliance solutions for Microsoft 365 and Azure environments. You must know Microsoft Purview inside out: its components (Data Map, Data Catalog, Data Estate Insights), and how to configure sensitivity labels, retention labels, and DLP policies.
Key exam topics:
Sensitivity labels vs. retention labels: Sensitivity labels protect data (encryption, access restrictions). Retention labels control how long data is kept. Exam questions often ask you to choose which label to use in a given scenario. For example, if a company wants to encrypt a document AND delete it after 5 years, you need both labels applied together.
Information protection policies: How to classify data automatically using sensitive info types (credit card numbers, passport numbers) and trainable classifiers (machine learning models that identify patterns like confidential contracts).
Data lifecycle management: Understanding adaptive and static policies. Static policies apply the same rule to everyone. Adaptive policies can change based on user or device properties (e.g., ''apply a 7-day retention only if the user is a contractor'').
Common traps:
Confusing ''retention'' with ''preservation''. Retention keeps data for a minimum period. Preservation holds data forever (or until a legal hold is lifted) for litigation purposes. Exam questions may say ''a company needs to keep emails for 5 years'' — that's a retention policy. If they say ''a company is being sued and cannot delete any emails'' — that's a preservation (legal hold) policy.
Assuming all regions have the same data residency rules. Exam scenarios often test whether you know that GDPR applies to EU citizens' data even if the company is based in the US.
Forgetting that DLP policies can be applied to endpoints (Windows 10/11 devices) as well as to cloud services. A typical question: ''Users are saving sensitive files to USB drives — what do you configure?'' Answer: An endpoint DLP policy.
Key definitions to memorise:
- Microsoft Entra ID: the identity service that controls who can access governed data. - Data Loss Prevention (DLP): technology that detects and blocks unauthorised sharing of sensitive data. - Records management: a subset of governance where data is declared a ''record'' (cannot be changed or deleted without authorisation). - Audit (Standard and Premium): Standard audit logs for 90 days; Premium for up to 10 years.\ Misconceptions around ''Delete'' vs. ''Archive'' are common — archive means moving to cheaper storage with no intention to delete; delete means permanently erasing. Know the difference.
Finally, practise designing solutions for hybrid scenarios where data is both on-premises and in the cloud. Microsoft Purview can extend governance to on-premises SQL Server databases using the Azure Arc agent.
Data governance is the rulebook for managing data, while compliance is following those rules and external laws.
The data lifecycle includes creation, storage, use, sharing, archiving, and deletion — each stage needs specific controls.
Sensitivity labels protect data (encryption, access) and retention labels control how long data is kept.
Microsoft Purview is the primary tool for data governance in Microsoft 365 and Azure environments.
Data Loss Prevention (DLP) policies block unauthorised sharing of sensitive data, even by authorised users.
GDPR applies to any organisation processing EU residents' data, regardless of location.
Data residency is where data is stored; data sovereignty is which country's laws apply to it.
Retention policies set a minimum keep period — they don't force deletion at the end of the period if another hold is active.
These come up on the exam all the time. Here's how to tell them apart.
Sensitivity Label
Controls protection: encryption, access restrictions, visual markings
Applied at creation or by automated classification rules
Does not affect how long data is kept
Retention Label
Controls how long data must be kept before deletion or archiving
Applied automatically based on data type or manually
Does not affect encryption or access rights
Retention Policy
Sets a minimum keep period (e.g., 7 years)
Data can be deleted once the period ends if no hold applies
Used for routine lifecycle management
Legal Hold
Prevents deletion to preserve data for litigation
Overrides all retention policies
Applied manually or by a legal team for specific users or data
Data Residency
Physical location of data storage
Decided by where Azure data centres are chosen
Example: UK data cannot be stored in the US
Data Sovereignty
Which country's laws apply to the data
Decided by the data subject's location or company's jurisdiction
Example: EU data is subject to GDPR even if stored in the US
Data Loss Prevention (DLP)
Blocks unauthorised sharing of data
Applies to data in use and in transit
Alerts or blocks based on content inspection
Encryption
Scrambles data so it is unreadable without a key
Applies to data at rest and in transit
Does not prevent authorised users from sharing data
Static Policy
Applied uniformly to all users or all content of a type
Easier to configure and manage
Cannot customise based on user role or device
Adaptive Policy
Changes based on user attributes (e.g., department, device type)
Requires more configuration but is more precise
Can target e.g., ''apply stricter retention to contractors only''
Mistake
Data governance is just about security — keeping data safe from hackers.
Correct
Data governance also covers legal compliance, data quality, retention, and deletion — not just security.
Security is a part of governance, but governance is much broader. People often confuse the two because both involve 'protecting' data.
Mistake
Retention policies mean data is always deleted as soon as the period ends.
Correct
Retention policies set a minimum period data must be kept. Data may be kept longer if a legal hold is active or if another policy overrides the deletion.
The word 'retention' sounds like 'keep', so beginners think it forces deletion. Actually, it prevents deletion before the period ends. Deletion only happens if no other rule forbids it.
Mistake
Compliance is achieved by buying a tool like Microsoft Purview and turning it on.
Correct
Compliance requires configuring policies correctly, classifying data, training users, and regularly testing controls — onboarding a tool is only step one.
Vendors market tools as 'set and forget' solutions. In reality, proper governance needs ongoing human effort and change management.
Mistake
If data is encrypted, you don't need DLP policies.
Correct
Encryption protects data at rest and in transit, but it doesn't prevent authorised users from sharing data inappropriately. DLP blocks that sharing.
Encryption is a technical control, while DLP is a behavioural control. Beginners often expect one technology to solve all problems.
Mistake
GDPR only applies to companies located in Europe.
Correct
GDPR applies to any organisation that processes personal data of EU residents, regardless of where the company is based.
This is a common territorial misunderstanding. US-based companies serving EU customers must comply too, which surprises beginners.
Mistake
Data residency and data sovereignty mean the same thing.
Correct
Data residency is about physical storage location. Data sovereignty is about which country's laws apply to the data.
The terms sound similar and are often used interchangeably in casual conversation, but they have distinct legal and technical implications.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A sensitivity label controls protection (encryption, access restrictions), while a retention label controls how long data is kept before deletion or archiving. You can apply both labels to the same data.
Yes, if your company processes personal data of EU residents — for example, if you have European customers or employees. The law applies based on the data subject's location, not the company's.
Microsoft Purview is a cloud platform for data governance, compliance, and risk management. It helps you classify data, manage retention, enforce DLP policies, and produce audit reports.
Data residency means physically storing data in a specific geographic location, such as within the UK or the EU. Some laws require certain data to never leave a country.
Data Loss Prevention (DLP) detects and blocks attempts to share sensitive data (like credit card numbers or patient records) through email, cloud storage, or removable devices.
A legal hold (or preservation hold) prevents deletion of data that might be relevant to a lawsuit or investigation. It overrides any retention policy that would otherwise allow deletion.
Archiving moves data to cheaper, long-term storage (still accessible if needed). Deleting permanently erases data so it cannot be recovered. They serve different purposes in the lifecycle.
You've finished Designing Compliance and Data Lifecycle Governance. Continue through the SC-100 study guide to build a complete picture of the exam.
Done with this chapter?