DSAR and Subject Access Requests: finding Microsoft 365 data

MICROSOFT 365 REFERENCE GUIDE · NOT AN APP FEATURE · Fictional examples · Updated October 2026

What does a DSAR or SAR require?

Under UK data protection law, individuals can request access to personal information about them. The organisation normally needs to respond without undue delay and within one month, subject to the applicable rules on identity, clarification and complex requests. Follow your data-protection lead’s instructions and the latest ICO guidance.

How Microsoft 365 eDiscovery can help

Appropriately authorised staff can use Microsoft Purview eDiscovery / Content Search to locate potentially relevant messages and documents. Depending on licensing, permissions, chosen data sources and supported content, eDiscovery can search Exchange Online, Teams-related content, OneDrive and SharePoint.

A practical DSAR search workflow

1. Record the request, its receipt date, scope and the identity-verification requirements.
2. Ask the data protection officer or responsible privacy team to approve the search approach.
3. Identify likely systems, mailboxes, custodians and date ranges; Microsoft 365 may be only part of the data held.
4. Create carefully scoped eDiscovery searches with relevant names, identifiers and date conditions.
5. Review the results; remove duplicates and evaluate context, not just keyword hits.
6. Identify third-party personal data, applicable exemptions, privileged material and any redactions that may be required.
7. Prepare a secure disclosure and document how the organisation responded, including information held outside Microsoft 365.

Key DSAR pitfalls

• A search hit is not necessarily personal data about the requester.
• A keyword search alone may miss personal information stored under other identifiers.
• The right of access is to personal data, not automatically every whole document in its original form.
• Do not export or disclose entire mailboxes indiscriminately.
• Search access and legal disclosure decisions should remain with properly authorised staff.

Can TenantPilot process subject access requests?

No. TenantPilot does not currently provide eDiscovery, DSAR collection, legal review or redaction workflows. This guide is educational and points administrators to Microsoft Purview and the UK Information Commissioner’s Office.