# Designing Compliance and Data Lifecycle Governance

> Chapter 6 of the Courseiva SC-100 curriculum — https://courseiva.com/learn/sc-100/compliance-and-data-lifecycle-governance

**Official objective:** 2.3 — Design solutions for data governance and compliance

## Introduction

Data governance and compliance are the rules and processes that ensure an organisation's data is handled legally, ethically, and securely from the moment it is created until it is permanently deleted. For a Cybersecurity Architect, designing these controls is critical because failing to comply with laws like GDPR or HIPAA can result in massive fines and loss of customer trust. This chapter will walk you through how to design those rules and why they matter for the SC-100 exam.

## The Restaurant Food Waste Audit Analogy

Because a restaurant kitchen produces different types of waste at different times of day, a head chef must create rules for how each type of waste is handled from the moment it is created until it is disposed of. This leads to a structured system that ensures food safety, reduces costs, and meets health department regulations.

Consider a busy restaurant kitchen. Raw vegetables arrive, get chopped, cooked, served, and sometimes returned. Each stage creates a different waste type: peelings, spoiled meat, customer leftovers, and expired dry goods. The chef can't just throw everything in one bin. Instead, she classifies each waste item based on its type (organic, hazardous, recyclable) and its sensitivity (raw chicken vs. lettuce trimmings). She then sets rules: peelings go to compost within 24 hours, raw meat waste is sealed in red bags and collected by a specialist company every Monday, and customer leftovers are donated to a local farm if untouched within two hours. She also keeps a logbook showing exactly what was wasted, when, and how it was disposed of. If a health inspector arrives, the chef can prove she followed every rule. This is exactly how data lifecycle governance works: data is classified when created, rules govern how it is stored and used, and when it's no longer needed, it is securely deleted or archived, with complete audit records.

## Core explanation

Data governance is the overall framework of policies, processes, and roles that decide how an organisation manages its data. Think of it as the rulebook for who can access data, how long it is kept, and how it must be protected. Compliance means following those rules, as well as external laws and industry standards.

Data lifecycle governance is the part of data governance that specifically manages data from its creation through to its deletion. The lifecycle has several stages: creation, storage, use, sharing, archiving, and deletion. Each stage has its own risks and requirements.

Why does this exist? Before modern governance, companies stored data forever with no plan. This led to huge storage costs, security risks from old data, and legal trouble when auditors asked ''Where is our customer data from 2012?'' Laws like the General Data Protection Regulation (GDPR) in Europe and the Health Insurance Portability and Accountability Act (HIPAA) in the US now require companies to control data carefully.

Key concepts you must know:

- Data classification: labelling data by sensitivity (e.g., public, internal, confidential, restricted). This decides which rules apply.
- Data retention policy: a rule that says how long each type of data must be kept before it is deleted or archived. For example, tax records must be kept for 7 years in many countries.
- Data deletion: permanently removing data so it cannot be recovered. This must be done securely to prevent leaks.
- Data residency: where data is physically stored. Some laws require data to stay within a specific country or region.
- Data sovereignty: the idea that data is subject to the laws of the country where it is stored.
- Data loss prevention (DLP): technologies that detect and block attempts to send sensitive data outside the organisation.
- Microsoft Purview: Microsoft's cloud-based data governance and compliance platform. It helps classify data, manage retention, and create audit trails.
- Audit trail: a record showing who accessed what data and when. This proves compliance to regulators.

How does a cybersecurity architect design these solutions?

First, you identify what data the organisation holds. This is called ''data discovery''. You use tools like Microsoft Purview Data Map to scan databases, file shares, and cloud storage to find sensitive data.

Second, you classify that data. Purview can automatically label data containing credit card numbers, medical records, or personal identification numbers (PII). You define rules: ''If a file contains 10 or more credit card numbers, mark it as 'Restricted'.''

Third, you create retention labels. These labels tell the system how long to keep the data and what to do when the time expires (delete it or archive it). For example, you might create a label called ''HR Records - 7 years'' that applies to all employee files.

Fourth, you implement DLP policies. These block users from emailing sensitive files to personal addresses or uploading them to unauthorised cloud services.

Fifth, you set up auditing and reporting. Microsoft Purview can log every access to sensitive data and produce reports for regulators.

All of this replaces the old approach of ''store everything forever, hope for the best''. It turns data management from a reactive nightmare into a proactive, automated system.

Finally, you need to test your controls. You run simulated attacks, review logs, and update policies as laws change. The goal is to prove to an auditor that you have a ''defence in depth'' — multiple layers of control that protect data even if one layer fails.

## Real-world context

A large healthcare organisation called HealthFirst operates hospitals across the UK and stores millions of patient records in Microsoft Azure. The IT team must comply with the UK Data Protection Act and GDPR, which require strict controls on personal health data.

First, the cybersecurity architect uses Microsoft Purview to scan all data sources: Azure SQL databases containing appointment records, SharePoint sites with clinical notes, and OneDrive folders used by doctors. Purview's automated scanning finds files containing National Health Service (NHS) numbers, diagnosis codes, and patient names. It tags these files with a ''Patient Data - Restricted'' sensitivity label.

Next, the architect creates retention labels for different data types. For example, patient records must be kept for 8 years after the last treatment (UK legal requirement), then securely deleted. The architect sets a retention label called ''Patient Record - 8 Year Retention'' and applies it to the classified files. Purview automatically triggers deletion after 8 years.

Then, the architect configures DLP policies. One policy blocks any user from emailing a file with the ''Patient Data - Restricted'' label to an external address. Another policy prevents uploading such files to a public cloud service like Dropbox. If a doctor tries to bypass this, the attempt is blocked and logged.

The architect also sets up data residency controls. Because the NHS demands patient data stay in the UK, they configure Azure Policy to prevent storing data in data centres outside the UK. Any attempt to create a resource in a non-UK region is automatically denied.

Finally, they enable audit logging. Every access to a ''Patient Data - Restricted'' file is recorded, including who accessed it, when, and from which device. When the Information Commissioner's Office (ICO) does an audit, the architect can produce a complete report within hours.

Without this governance, HealthFirst could face fines of up to 4% of annual global turnover for GDPR breaches. The architect's design turns a regulatory risk into a manageable, automated process.

## Exam focus

The SC-100 exam expects you to design data governance and compliance solutions for Microsoft 365 and Azure environments. You must know Microsoft Purview inside out: its components (Data Map, Data Catalog, Data Estate Insights), and how to configure sensitivity labels, retention labels, and DLP policies.

Key exam topics:

- Sensitivity labels vs. retention labels: Sensitivity labels protect data (encryption, access restrictions). Retention labels control how long data is kept. Exam questions often ask you to choose which label to use in a given scenario. For example, if a company wants to encrypt a document AND delete it after 5 years, you need both labels applied together.

- Information protection policies: How to classify data automatically using sensitive info types (credit card numbers, passport numbers) and trainable classifiers (machine learning models that identify patterns like confidential contracts).

- Data lifecycle management: Understanding adaptive and static policies. Static policies apply the same rule to everyone. Adaptive policies can change based on user or device properties (e.g., ''apply a 7-day retention only if the user is a contractor'').

Common traps:

- Confusing ''retention'' with ''preservation''. Retention keeps data for a minimum period. Preservation holds data forever (or until a legal hold is lifted) for litigation purposes. Exam questions may say ''a company needs to keep emails for 5 years'' — that's a retention policy. If they say ''a company is being sued and cannot delete any emails'' — that's a preservation (legal hold) policy.

- Assuming all regions have the same data residency rules. Exam scenarios often test whether you know that GDPR applies to EU citizens' data even if the company is based in the US.

- Forgetting that DLP policies can be applied to endpoints (Windows 10/11 devices) as well as to cloud services. A typical question: ''Users are saving sensitive files to USB drives — what do you configure?'' Answer: An endpoint DLP policy.

Key definitions to memorise:

- Microsoft Entra ID: the identity service that controls who can access governed data.
- Data Loss Prevention (DLP): technology that detects and blocks unauthorised sharing of sensitive data.
- Records management: a subset of governance where data is declared a ''record'' (cannot be changed or deleted without authorisation).
- Audit (Standard and Premium): Standard audit logs for 90 days; Premium for up to 10 years.\
Misconceptions around ''Delete'' vs. ''Archive'' are common — archive means moving to cheaper storage with no intention to delete; delete means permanently erasing. Know the difference.

Finally, practise designing solutions for hybrid scenarios where data is both on-premises and in the cloud. Microsoft Purview can extend governance to on-premises SQL Server databases using the Azure Arc agent.

## Step by step

1. **Data Discovery** — Use Microsoft Purview Data Map to scan all data sources (Azure SQL, SharePoint, OneDrive) and identify where sensitive data lives. This creates a complete inventory of data assets.
2. **Data Classification** — Define sensitivity labels (e.g., Public, Internal, Confidential, Restricted) and map them to data types. Use automated classifiers to scan for patterns like credit card numbers or medical record IDs.
3. **Policy Configuration** — Create retention labels (e.g., ''HR Records - 7 years'') and DLP rules (e.g., ''block emailing restricted data outside the company''). Configure adaptive policies if rules need to change based on user role or location.
4. **Policy Enforcement** — Publish labels and policies to users through Microsoft 365 apps (Outlook, Teams, SharePoint). Users see labels when creating or editing documents. Automated actions (block, warn, encrypt) happen without user intervention.
5. **Monitoring and Auditing** — Enable audit logging (Standard or Premium) to track who accessed sensitive data. Use Data Estate Insights dashboards to review activity, spot mislabelled data, and produce compliance reports for regulators.
6. **Review and Remediation** — Regularly review DLP alerts, respond to false positives (e.g., a legitimate email incorrectly blocked), and adjust policies. Periodically test with simulated attacks to ensure controls work.

## Comparisons

### Sensitivity Label vs Retention Label

**Sensitivity Label:**
- Controls protection: encryption, access restrictions, visual markings
- Applied at creation or by automated classification rules
- Does not affect how long data is kept

**Retention Label:**
- Controls how long data must be kept before deletion or archiving
- Applied automatically based on data type or manually
- Does not affect encryption or access rights

### Retention Policy vs Legal Hold

**Retention Policy:**
- Sets a minimum keep period (e.g., 7 years)
- Data can be deleted once the period ends if no hold applies
- Used for routine lifecycle management

**Legal Hold:**
- Prevents deletion to preserve data for litigation
- Overrides all retention policies
- Applied manually or by a legal team for specific users or data

### Data Residency vs Data Sovereignty

**Data Residency:**
- Physical location of data storage
- Decided by where Azure data centres are chosen
- Example: UK data cannot be stored in the US

**Data Sovereignty:**
- Which country's laws apply to the data
- Decided by the data subject's location or company's jurisdiction
- Example: EU data is subject to GDPR even if stored in the US

### Data Loss Prevention (DLP) vs Encryption

**Data Loss Prevention (DLP):**
- Blocks unauthorised sharing of data
- Applies to data in use and in transit
- Alerts or blocks based on content inspection

**Encryption:**
- Scrambles data so it is unreadable without a key
- Applies to data at rest and in transit
- Does not prevent authorised users from sharing data

### Static Policy vs Adaptive Policy

**Static Policy:**
- Applied uniformly to all users or all content of a type
- Easier to configure and manage
- Cannot customise based on user role or device

**Adaptive Policy:**
- Changes based on user attributes (e.g., department, device type)
- Requires more configuration but is more precise
- Can target e.g., ''apply stricter retention to contractors only''

## Diagram

_This diagram shows the data lifecycle governance process from creation through discovery, classification, policy enforcement, and eventual deletion or audit._

```mermaid
flowchart TD
    A[Data Created] --> B[Data Discovery - Purview Map]
    B --> C[Data Classification - Sensitivity Labels]
    C --> D[Policy Creation - Retention Labels & DLP]
    D --> E[Policy Enforcement - Auto Apply Labels]
    E --> F{Active Legal Hold?}
    F -->|Yes| G[Preservation Hold - Keep Forever]
    F -->|No| H[Retention Period Countdown]
    H --> I[Data Deletion or Archive]
    I --> J[Audit Logging & Reports]
    J --> K[Compliance Verification]
```

## Common misconceptions

- **Misconception:** Data governance is just about security — keeping data safe from hackers. **Reality:** Data governance also covers legal compliance, data quality, retention, and deletion — not just security. (Security is a part of governance, but governance is much broader. People often confuse the two because both involve 'protecting' data.)
- **Misconception:** Retention policies mean data is always deleted as soon as the period ends. **Reality:** Retention policies set a minimum period data must be kept. Data may be kept longer if a legal hold is active or if another policy overrides the deletion. (The word 'retention' sounds like 'keep', so beginners think it forces deletion. Actually, it prevents deletion before the period ends. Deletion only happens if no other rule forbids it.)
- **Misconception:** Compliance is achieved by buying a tool like Microsoft Purview and turning it on. **Reality:** Compliance requires configuring policies correctly, classifying data, training users, and regularly testing controls — onboarding a tool is only step one. (Vendors market tools as 'set and forget' solutions. In reality, proper governance needs ongoing human effort and change management.)
- **Misconception:** If data is encrypted, you don't need DLP policies. **Reality:** Encryption protects data at rest and in transit, but it doesn't prevent authorised users from sharing data inappropriately. DLP blocks that sharing. (Encryption is a technical control, while DLP is a behavioural control. Beginners often expect one technology to solve all problems.)
- **Misconception:** GDPR only applies to companies located in Europe. **Reality:** GDPR applies to any organisation that processes personal data of EU residents, regardless of where the company is based. (This is a common territorial misunderstanding. US-based companies serving EU customers must comply too, which surprises beginners.)
- **Misconception:** Data residency and data sovereignty mean the same thing. **Reality:** Data residency is about physical storage location. Data sovereignty is about which country's laws apply to the data. (The terms sound similar and are often used interchangeably in casual conversation, but they have distinct legal and technical implications.)

## Key takeaways

- Data governance is the rulebook for managing data, while compliance is following those rules and external laws.
- The data lifecycle includes creation, storage, use, sharing, archiving, and deletion — each stage needs specific controls.
- Sensitivity labels protect data (encryption, access) and retention labels control how long data is kept.
- Microsoft Purview is the primary tool for data governance in Microsoft 365 and Azure environments.
- Data Loss Prevention (DLP) policies block unauthorised sharing of sensitive data, even by authorised users.
- GDPR applies to any organisation processing EU residents' data, regardless of location.
- Data residency is where data is stored; data sovereignty is which country's laws apply to it.
- Retention policies set a minimum keep period — they don't force deletion at the end of the period if another hold is active.

## FAQ

**What is the difference between a sensitivity label and a retention label?**

A sensitivity label controls protection (encryption, access restrictions), while a retention label controls how long data is kept before deletion or archiving. You can apply both labels to the same data.

**Does GDPR apply to my company if we are based in the US?**

Yes, if your company processes personal data of EU residents — for example, if you have European customers or employees. The law applies based on the data subject's location, not the company's.

**What is Microsoft Purview used for?**

Microsoft Purview is a cloud platform for data governance, compliance, and risk management. It helps you classify data, manage retention, enforce DLP policies, and produce audit reports.

**What is data residency?**

Data residency means physically storing data in a specific geographic location, such as within the UK or the EU. Some laws require certain data to never leave a country.

**What does a DLP policy do?**

Data Loss Prevention (DLP) detects and blocks attempts to share sensitive data (like credit card numbers or patient records) through email, cloud storage, or removable devices.

**What is a legal hold?**

A legal hold (or preservation hold) prevents deletion of data that might be relevant to a lawsuit or investigation. It overrides any retention policy that would otherwise allow deletion.

**What is the difference between archive and delete?**

Archiving moves data to cheaper, long-term storage (still accessible if needed). Deleting permanently erases data so it cannot be recovered. They serve different purposes in the lifecycle.

## Check your understanding

1. **What is the difference between a sensitivity label and a retention label in Microsoft Purview?**

   Answer: Sensitivity labels protect data (encryption, access control), while retention labels control how long data is kept before deletion or archiving.

2. **Your company has customers in the EU. Does GDPR apply even if your company is headquartered in the US?**

   Answer: Yes. GDPR applies to any organisation that processes personal data of EU residents, regardless of where the company is located.

3. **What does a Data Loss Prevention (DLP) policy do?**

   Answer: A DLP policy detects and blocks unauthorised sharing of sensitive data, such as emailing credit card numbers outside the organisation or saving patient records to a USB drive.

4. **What is the difference between data residency and data sovereignty?**

   Answer: Data residency is where data is physically stored (e.g., UK data centres). Data sovereignty is which country's laws apply to that data (e.g., GDPR applies to EU data regardless of storage location).

5. **If a legal hold is active on a user's mailbox, can a retention policy automatically delete their emails?**

   Answer: No. A legal hold overrides retention policies and prevents deletion of any data covered by the hold until the hold is lifted.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/sc-100/compliance-and-data-lifecycle-governance