Data Classification: The First Step Most Security Programs Skip

Data classification is the act of sorting your information by how sensitive it is, so you can apply the right protection to each tier. It is the step most security programs skip, and the reason so many of them are expensive and still leaky: you cannot protect what you have never bothered to identify.

Most SMEs treat every file the same. A lunch-order spreadsheet gets the same controls as a folder of client Tax File Numbers. That is how money gets spent in the wrong places and the genuinely sensitive material slips out the side door.

Why classification comes first

Every other security control assumes you already know what matters. Data Loss Prevention needs to know which data to stop leaving. Encryption needs to know which files are worth encrypting. Retention rules need to know which records have legal minimums. Even your cyber insurer’s questionnaire assumes you can describe where your sensitive data lives. Skip classification and all of these become guesswork — you end up either locking down everything (and the business grinds), or locking down nothing meaningful (and the breach finds you).

The point is not bureaucracy. It is focus. A small business has finite attention and budget. Classification tells you where to spend both. Once you know that 90 per cent of your files are mundane and 10 per cent would hurt if they leaked, you can put real controls on the 10 per cent instead of spreading effort thinly across everything.

A scheme an SME will actually use

Government departments run five- and six-tier classification schemes with handling caveats, dissemination markings and clearance requirements. Do not copy them. They are built for an environment you do not operate in, and if you impose that complexity on a 30-person business in Camberwell, staff will quietly ignore the lot and your scheme dies in a fortnight.

Four tiers is the sweet spot for almost every SME:

• Public — material you would happily put on your website. Brochures, published case studies, job ads. No restrictions.
• Internal — the default for ordinary business content. Project notes, internal emails, draft documents. Not secret, but not for outsiders. This is where most of your data lives.
• Confidential — information that would cause real harm if it leaked. Client records, contracts, financials, personal information, employee files. Encrypt it, control who can share it.
• Restricted — the small set of crown-jewel data: Tax File Numbers, Medicare numbers, health records, banking details, anything under a strict regulatory or contractual obligation. Tightest controls, smallest audience, full audit trail.

If four feels like too many, run three (Public, Internal, Confidential) and fold Restricted into Confidential with stricter handling. The exact labels matter far less than picking a set, defining each one in a sentence a non-technical person understands, and sticking to it.

Classification is useless without handling rules

A label that does not change behaviour is just decoration. The value comes from mapping each tier to concrete handling rules — where it can be stored, how it can be shared, whether it is encrypted, how long it is kept, and how it is destroyed. Write these down once, in plain language, and they become the operating manual for your whole data estate.

This is the part most people forget. Disposal and retention are as much a part of classification as protection. Holding a decade of old client files you no longer need is not caution — it is liability. The records exist to be stolen, subpoenaed or breached, and they serve no business purpose. Classification tells you what to keep, for how long, and what to destroy.

Making it real with Microsoft Purview

For the Melbourne SMEs we work with — almost all on Microsoft 365 — classification stops being a paper exercise the moment you turn it into sensitivity labels in Microsoft Purview. A sensitivity label is a tag that travels with the file or email wherever it goes, and it can enforce the handling rules above rather than just suggest them.

Map your four tiers straight onto four labels. A Confidential label can apply encryption automatically, so a file forwarded to the wrong address is unreadable to whoever receives it. A Restricted label can lock access to a named group and block external sharing outright. The classification scheme and the technical control become the same thing — which is exactly what you want.

Auto-labelling

Manual labelling depends on people choosing the right tag every time, and people are busy. Auto-labelling closes that gap. Purview can scan content against patterns — Tax File Numbers, Medicare numbers, credit card numbers, ABNs — and apply a label automatically, or recommend one to the user. A document with a dozen TFNs in it gets flagged as Confidential whether or not anyone remembered to mark it. Auto-labelling lives in the advanced Purview tier (E5 or the E5 Compliance add-on); manual labelling is included with Business Premium, which is enough to start.

What labels then power

Once data carries labels, the rest of your governance has something to act on. DLP can block a Confidential file from being emailed externally or copied to a USB stick. Retention policies can key off the label. And critically, labels govern what Microsoft 365 Copilot is allowed to surface — Copilot respects the protection on a labelled file, so a document marked Confidential and encrypted will not be casually summarised to someone who should not see it. This is why classification underpins AI governance and is not separate from it. We cover the labelling and DLP setup in depth in our guide to Microsoft Purview data governance, and the AI side in our piece on AI data governance for company data.

The human side: keep it simple or it dies

Here is the truth most vendors will not tell you. The biggest risk to a classification scheme is not the technology — it is asking people to think too hard. If staff have to choose between six labels with overlapping definitions, they will pick the default every time, or whatever is fastest, and your scheme becomes noise.

Four labels. One-sentence definitions. A sensible default (Internal) so the lazy choice is also a safe one. Reserve the friction — the encryption prompts, the sharing blocks — for the top tiers where it earns its keep. A scheme that 80 per cent of staff apply correctly without thinking beats a perfect scheme that everyone routes around. Simplicity is a security control, not a compromise.

Where classification meets Australian compliance

Classification is not just good hygiene — it is how you demonstrate compliance when someone asks. Under the Privacy Act 1988 and the Australian Privacy Principles, you are obliged to take reasonable steps to protect personal information (APP 11) and to not keep it longer than you need (and dispose of it when you do not). A working classification scheme, with labels and retention rules you can show, is exactly the kind of “reasonable steps” the Office of the Australian Information Commissioner (OAIC) expects to see. The privacy reforms moving through Parliament — tighter rules on data minimisation and automated decision-making — only sharpen that expectation.

The same scheme feeds your other obligations. DLP is meaningless without classification to tell it what to watch. Cyber insurers increasingly ask how you identify and protect sensitive data. And, as above, AI governance depends on it entirely. Classification is the foundation layer that makes the rest defensible rather than aspirational.

A Dandenong scenario

A logistics business in Dandenong we work with had grown from a handful of staff to around fifty, and its SharePoint had grown with it — no structure, broad permissions, everything in one bucket. Driver licences, customer contracts, payroll exports and old quotes all sat side by side, equally accessible. They wanted DLP and were about to switch on Copilot, and could not understand why we said classification had to come first.

We ran a discovery pass, agreed a four-tier scheme with their leadership, and built the matching Purview labels. Auto-labelling caught the TFN and licence data that manual marking would have missed. We applied encryption to the Confidential and Restricted tiers, set retention to purge expired quotes and old onboarding documents, then layered DLP on top — which now had a clear target. Only then did Copilot go live, on data that was actually governed. The whole exercise gave them a defensible answer for their insurer and a SharePoint that no longer leaked by default.

TechAssist has run Microsoft 365 for Melbourne SMEs since 2008, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma. The classification-first review has become one of the more common first steps we run before any DLP or AI rollout.

A phased rollout that works

Do not attempt to classify everything in one weekend. It fails every time. Phase it:

1. Define the scheme. Agree four tiers and one-sentence definitions with leadership. This is a half-day workshop, not a project.
2. Map handling rules. Decide storage, sharing, encryption, retention and disposal for each tier. Write it down.
3. Build the labels. Create the matching Purview sensitivity labels, starting cosmetic (markings only) so people get used to choosing one.
4. Add enforcement to the top tiers. Switch on encryption and sharing controls for Confidential and Restricted once labelling is a habit.
5. Turn on auto-labelling and DLP. Run DLP in audit-only mode for a fortnight, tune out false positives, then move to blocking. Auto-labelling catches what users miss.
6. Then enable AI. With data labelled and protected, Copilot or another sanctioned tool can be turned loose safely.

Each phase delivers value on its own. You are never left with a half-finished mess that protects nothing.

Frequently asked questions

How many classification levels should an SME have?

Four is ideal for most: Public, Internal, Confidential and Restricted. Three works if four feels heavy — fold Restricted into Confidential with stricter handling. Avoid the five- and six-tier government schemes; the extra complexity makes staff disengage, and a scheme people ignore protects nothing.

Do I need an expensive licence to start classifying data?

No. Manual sensitivity labels are included with Microsoft 365 Business Premium, which is enough to define your scheme, apply labels and enforce encryption on the top tiers. Auto-labelling and endpoint DLP sit in the advanced Purview tier (E5 or the E5 Compliance add-on), worth adding once the basics are bedded in.

What is the difference between data classification and a sensitivity label?

Classification is the scheme — the tiers and the rules that decide how each type of data is handled. A sensitivity label is the technical mechanism in Microsoft Purview that puts that scheme into effect, tagging files and enforcing the rules. The classification is the decision; the label is how the decision sticks to the data.

Why does Copilot need data classification first?

Microsoft 365 Copilot surfaces any data the asking user can already access, and respects the protection on labelled files. Without classification, over-permissioned sensitive data — a payroll spreadsheet in a shared site — becomes easy for Copilot to expose. Labelling and protecting that data first is what makes an AI rollout safe rather than a quiet exposure incident.

Where to start

Pick four tiers, write a one-line definition for each, and agree the handling rules. Build the matching Purview labels, start cosmetic, then add encryption to the top two. That alone puts you ahead of most SMEs and gives you the foundation every other control — DLP, retention, AI governance — depends on.

If you would like a hand defining a classification scheme, building the Purview labels and getting your data governed before you switch on DLP or Copilot, talk to our cyber security team, or get in touch with TechAssist. We will tell you plainly what to classify first and what you can safely leave alone.

AI data governance is how you stop staff pasting confidential, customer or regulated information into public AI tools where it can be retained and reused. The fix is not banning AI. It is steering people onto sanctioned, commercially protected tools and putting technical controls around the data itself.

Every Melbourne SME we work with has the same quiet problem: people are already using ChatGPT, Gemini and Copilot, whether or not anyone approved it. The data has already started moving. Governance is about catching up to that reality before it bites.

The actual risk: your data ends up in someone else’s model

When a staff member pastes a slab of text into a free, consumer AI tool, that text leaves your control. Depending on the product and the account tier, it may be stored on the provider’s servers, reviewed by humans for quality, and used to train future versions of the model. That is the part that catches people out — not a dramatic breach, just an employee trying to work faster.

The realistic scenarios are mundane and that is what makes them common:

• A bookkeeper pastes a payroll export into a free chatbot to “summarise the anomalies” — names, salaries and Tax File Numbers go with it.
• A lawyer drops a draft settlement deed in to “tighten the language” — privileged client material, now sitting on an external service.
• A sales rep uploads the full customer list to “write a follow-up campaign” — personal information of hundreds of people, handed to a third party with no agreement in place.
• A clinic manager pastes patient correspondence in to “make it sound friendlier” — health information, the most sensitive category there is.

None of these people are reckless. They are using a tool that is genuinely useful, on data they handle every day, without realising the back end works differently to Office or their line-of-business app. That is the gap governance closes.

Consumer AI vs commercial AI: the difference that matters

Not all AI tools treat your data the same way, and the difference is entirely about which account you are signed into. This is the single most important thing to get staff to understand.

Consumer tiers — a free ChatGPT account, a personal Gmail’s Gemini, a chatbot someone signed up for with their own email — generally reserve the right to retain prompts and use them to improve the model. The provider’s consumer terms, not a commercial contract, govern what happens to your data.

Enterprise and business tiers — the paid, commercially licensed versions tied to your organisation — come with explicit data-protection commitments. Prompts are not used to train the underlying models, data stays within a contractual boundary, and you get administrative controls. The same brand can sit on either side of that line depending on the plan.

The practical instruction for staff is short: if AI work involves anything that is not already public, it goes through the sanctioned, organisation-signed-in tool — never a personal or free account. Microsoft 365 Copilot in particular sits inside the same service boundary as your existing Microsoft 365 data, which is why it is the natural starting point for most Melbourne SMEs already on Business Premium. Our guide to what is included with Microsoft 365 support in Melbourne covers where Copilot fits.

The Australian regulatory angle

This is not just a tidiness issue. Feeding personal information into an uncontrolled AND offshore service can put you on the wrong side of the Privacy Act 1988.

Under the Australian Privacy Principles (APPs), you must take reasonable steps to protect personal information (APP 11) and you carry obligations when personal information crosses borders to an overseas recipient (APP 8). Most consumer AI services process data offshore, which means an employee pasting customer data into a free tool can quietly trigger a cross-border disclosure you never assessed or agreed to.

The privacy reforms passed in late 2024 sharpened the picture. They introduced a statutory tort for serious invasions of privacy, strengthened enforcement powers for the Office of the Australian Information Commissioner (OAIC), and signalled tighter expectations around automated decision-making and transparency. The direction of travel is clear: regulators expect organisations to know where personal information goes and to be able to show they controlled it.

Sensitive information — health, biometric, and similar categories — attracts a higher bar again. A health service that lets staff paste patient details into a consumer chatbot has a genuine problem, not a theoretical one. If you operate in that space, our note on healthcare IT support and OAIC obligations is worth a read. The point for everyone else: regulated and customer data needs governance before it goes anywhere near a model.

The technical controls that actually work

A policy document on its own changes nothing. The control that holds is the one that does not depend on every employee remembering a rule at the moment they are busy. Here is the stack we put in place, roughly in order.

An AU-aligned AI acceptable use policy

You still need the policy — it sets the expectation, names the sanctioned tools, and gives you something to point to. The key is that it must be specific to your tools and your obligations, not a generic template. We have written separately about building an acceptable use policy that staff actually follow; the short version is that it should name which tools are approved, what data must never go into any AI tool, and who to ask when unsure. Treat the policy as the starting line, not the finish.

Sanctioned tools, properly licensed

Give people a good, approved option and most of the problem evaporates. Staff reach for free tools because nothing better was offered. Roll out Microsoft 365 Copilot or Gemini for Workspace on the right licence, sign them in under the organisation account, and the data stays inside the commercial boundary by default. Sanctioning a tool is cheaper than cleaning up after an uncontrolled one.

Microsoft Purview sensitivity labels and DLP

This is where governance gets teeth. Sensitivity labels tag and can encrypt your most sensitive files, and Data Loss Prevention (DLP) inspects content and acts on it. A DLP policy can warn or block when someone tries to send a document full of Tax File Numbers or Medicare numbers to an external destination — including, increasingly, paste actions into a browser-based AI tool via endpoint DLP. Labelling and DLP are also what govern what Copilot itself is allowed to surface internally. We cover the full setup in our piece on Microsoft 365 data governance, but the headline is that labels plus DLP are the data-layer control that does not rely on goodwill.

Conditional access

Identity controls decide who can reach the sanctioned tools and from where. Conditional access policies let you require a managed, compliant device and an MFA-verified identity before someone touches the corporate AI tools, and let you block access from unmanaged personal devices where you have no visibility. This is the difference between “we hope people use the right account” and “the wrong account simply cannot reach our data”.

Staff training

Controls reduce the blast radius; training reduces how often the trigger gets pulled. People need to understand, in plain terms, why a free chatbot is different from the signed-in corporate one, and what counts as data they must not paste. A fifteen-minute briefing that shows the consumer-versus-commercial difference does more than a fifty-page policy nobody reads.

Govern before you adopt

The mistake we see most is enthusiasm-first: a business rolls AI out across the company, then thinks about data governance when something goes wrong. Reverse it. Decide what data is sensitive, label and protect it, set DLP rules, pick and license your sanctioned tools, lock access with conditional access, then turn AI loose. Governance first is not slower — it is the only version that does not generate a clean-up project six months later.

A Box Hill scenario

An accounting firm in Box Hill we work with came to us after a partner noticed staff using personal ChatGPT accounts to draft client letters — pasting in figures, names and TFNs as they went. Nobody had done anything malicious; the firm had simply never offered an approved tool or said where the line was. We rolled out Microsoft 365 Copilot under their existing Business Premium licences, applied Confidential sensitivity labels with encryption to their client folders, set DLP rules on TFNs and Medicare numbers, and used conditional access so the corporate tools only worked from managed devices. We paired it with a short staff session on the consumer-versus-commercial difference. The firm now has a faster, sanctioned tool and a defensible answer if the OAIC or their professional indemnity insurer ever asks how client data is controlled.

TechAssist has run Microsoft 365 for Melbourne SMEs since 2008, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma. The govern-then-adopt review has quietly become one of the more common pieces of work we do as AI tools spread through workplaces.

Frequently asked questions

Is it safe to use ChatGPT for work?

It depends entirely on the account. A free or personal ChatGPT account may retain your prompts and use them to improve the model, so it is not appropriate for confidential, customer or regulated data. ChatGPT Team or Enterprise, signed in under your organisation, does not use your prompts for training and is a reasonable sanctioned tool. The rule of thumb: anything not already public goes only through the approved, organisation-licensed tool.

Does Microsoft 365 Copilot use our data to train its models?

No. Microsoft 365 Copilot operates under commercial data-protection commitments. Your prompts, responses and organisational data are not used to train the underlying foundation models and stay within the Microsoft 365 service boundary. That is precisely why it is a safer default than a personal AI account for business data.

Can staff pasting data into AI tools breach the Privacy Act?

It can. Pasting personal information into a consumer AI service that processes data offshore can amount to a cross-border disclosure under APP 8 and a failure to take reasonable security steps under APP 11. Sensitive information such as health data raises the bar further. Sanctioned tools, sensitivity labels and DLP are how you keep that data inside controls you can demonstrate to the OAIC.

How do we stop people using free AI tools without banning AI entirely?

You give them a good sanctioned alternative and put controls around the data. License a commercial tool such as Microsoft 365 Copilot or Gemini for Workspace, apply Purview sensitivity labels and DLP, enforce conditional access so the corporate tools only work from managed devices, and back it with a short, specific acceptable use policy and training. Most uncontrolled use stops once a better, approved option exists.

Where to start

You do not need to solve everything at once. Decide which data is genuinely sensitive, license one sanctioned AI tool, switch on a couple of DLP rules in audit mode, and run a fifteen-minute staff briefing. That alone moves you from “people are doing whatever” to a defensible, governed position.

If you would like a hand scoping an AI data governance rollout — sanctioned tools, Purview labels and DLP, conditional access and a policy that fits your obligations — talk to our cyber security team, or get in touch with TechAssist. We will tell you plainly what to lock down first and what you can safely leave alone.

Microsoft Purview is Microsoft’s data governance and compliance suite inside Microsoft 365 — the rebranded, expanded successor to what used to be called the Microsoft 365 Compliance Centre. It is how you classify, protect, retain and audit your organisation’s data, and it is the layer that decides what Copilot is allowed to see.

For a Melbourne SME, the practical question is not “what is Purview” but “which bits do I already pay for, and what should I switch on first?” This post answers both, without the marketing gloss.

What Microsoft Purview actually is

Purview is an umbrella brand. Under it sit a set of tools that used to be scattered across separate portals. They are now grouped at purview.microsoft.com and broadly cover two jobs: knowing where your sensitive data is, and controlling what happens to it.

The capabilities that matter to most small and mid-sized businesses are:

• Sensitivity labels — tags like Confidential or Internal that travel with a file or email and can enforce encryption and access rules.
• Data Loss Prevention (DLP) — rules that stop sensitive data, such as credit card or Tax File Numbers, from leaving the organisation by email, Teams or to USB.
• Retention policies and labels — rules that keep records for a set period and delete them when they expire, which is how you meet records-keeping obligations without hoarding everything forever.
• eDiscovery — the ability to search across mailboxes, SharePoint and Teams to find content for a legal matter, dispute or regulator request.
• Audit — a searchable log of who did what: who opened a file, who deleted a mailbox item, who changed a permission.
• Insider risk management — analytics that flag risky behaviour, such as a departing employee mass-downloading client files.
• Communication compliance — monitoring of internal messaging for harassment, code-of-conduct breaches or regulated-industry conduct rules.

You will not use all of these on day one, and you should not try to. The point is that Purview is where data governance lives once you decide to take it seriously.

What you get with Business Premium, and what needs E5

This is where most decisions get made, because the licensing split is real and it is easy to overspend or assume you have features you do not.

Microsoft 365 Business Premium — the plan most Melbourne SMEs land on — includes a genuinely useful slice of Purview. You get manual sensitivity labels, basic DLP for Exchange, SharePoint, OneDrive and Teams, basic retention policies, standard audit logging, and basic eDiscovery (search and export). For a business under 300 seats, that is enough to make a real difference.

The advanced tier sits behind Microsoft 365 E5, the E5 Compliance add-on, or standalone Purview add-ons. That is where you find automatic labelling, DLP that extends to endpoints and browsers, communication compliance, insider risk management, eDiscovery (Premium) with legal hold and review sets, and longer audit retention.

The honest advice: do not buy E5 because the feature list looks impressive. Buy it when you have a specific obligation — a regulator, an insurer, a contract — that needs automatic labelling, endpoint DLP or insider risk. Most SMEs get years of value out of the Business Premium tier first. If you are weighing up the plans, our guide to what is included with Microsoft 365 support in Melbourne sets out where the lines fall.

What to do first: labels and DLP

If you take one thing from this post, take this. Start with sensitivity labels and DLP. They give you the most protection for the least effort, and everything else builds on them.

Sensitivity labels

A sensitivity label is a tag a user applies to a document or email. A typical SME set is three or four labels: Public, Internal, Confidential, and perhaps Highly Confidential. The label can be cosmetic (a footer marking) or it can enforce real controls — encryption, a watermark, blocking external sharing.

Start cosmetic, get people used to choosing a label, then add enforcement to the top one or two. A label that encrypts Confidential files means a document forwarded to the wrong address is unreadable to the recipient. That single control has saved more SMEs than any firewall rule.

Data Loss Prevention

DLP inspects content against patterns and conditions you set, then acts. The patterns Australian businesses care about are built in or easy to define: Tax File Numbers, Medicare numbers, credit card numbers, ABNs, driver licence details. A starter DLP policy might warn a user — or block outright — when they try to email a spreadsheet containing more than a handful of TFNs to an external address.

Begin every DLP rule in audit-only mode. Let it run for a fortnight, see what it would have flagged, and tune out the false positives before you switch to blocking. Turn DLP straight to block on day one and you will have the finance team locked out of legitimate work by Tuesday. DLP sits naturally alongside the rest of your cyber security services stack — it is the data-layer complement to identity controls like conditional access.

Retention, eDiscovery and audit: the records side

The governance half of Purview is about keeping the right things for the right length of time, and being able to find them.

Retention answers a question every business eventually faces: how long do we keep this? Some records have legal minimums — employee records under the Fair Work Act, financial records under the Corporations Act, health records under state health-records legislation. Retention policies enforce those minimums automatically and, just as importantly, delete data once the obligation lapses so you are not holding a decade of client files that are now pure liability.

eDiscovery earns its keep the day you receive a subpoena, a Fair Work claim or an OAIC enquiry. Instead of an engineer manually trawling mailboxes, you run a content search across Exchange, SharePoint and Teams and export exactly what is in scope. Standard eDiscovery in Business Premium handles most SME needs.

Audit is the quiet hero. When something goes wrong — a deleted file, a mailbox rule someone did not set, a permissions change — the audit log tells you who and when. It is also frequently the first thing a cyber insurer or incident responder asks for. If you are thinking about coverage, audit logging is part of what makes a claim defensible; our cyber insurance guide for Australian SMEs covers the broader picture.

Governance before AI: Purview and Copilot

This is the use case pushing Purview up the priority list for 2026. Microsoft 365 Copilot answers questions using your organisation’s data — every file, email and chat the asking user already has permission to see. That is the catch. Copilot does not break permissions; it surfaces what loose permissions already expose.

If your SharePoint has a “Company” site everyone can read, and someone parked the payroll spreadsheet there three years ago, Copilot will happily summarise salaries when an employee asks. The file was always accessible — nobody ever browsed to it. Copilot removes that friction.

This is why governance comes before AI, not after. Sensitivity labels let you mark and encrypt the data Copilot should never reuse. DLP and retention reduce the volume of stale, mislabelled data sitting in shared locations. Auditing tells you what Copilot has been asked. Switching on Copilot without doing this first is how a tidy-looking rollout becomes a quiet data-exposure incident.

The same logic applies to the Privacy Act 1988. Under the Australian Privacy Principles, you are obliged to take reasonable steps to protect personal information and to not keep it longer than needed. Reforms now working through Parliament are tightening those expectations, including around automated decision-making and data minimisation. Purview’s labelling, DLP and retention are precisely the “reasonable steps” the Office of the Australian Information Commissioner (OAIC) expects you to be able to demonstrate.

A Hawthorn scenario

A professional services firm in Hawthorn we work with wanted to roll out Copilot across forty staff. Before flicking it on, we ran a labelling and permissions review. We found three SharePoint sites with broad read access holding client financials and a folder of scanned passports from an old onboarding process. We applied Confidential labels with encryption to the sensitive sites, tightened the permissions, set a DLP rule on TFNs and Medicare numbers, and added a retention policy that purged the passport scans that should have been deleted years earlier. Copilot went live two weeks later — on data that was actually governed. The firm now has something concrete to show their professional indemnity insurer.

That sequence — govern, then enable — is the whole game. TechAssist has run Microsoft 365 for Melbourne SMEs since 2008, with thirteen Australian-employed engineers and a 24/7 NOC in Tecoma, and the Purview-before-Copilot review has become one of the more common pieces of work we do.

Frequently asked questions

Is Microsoft Purview a separate product I have to buy?

No. Purview is the brand for governance and compliance tools built into Microsoft 365. A meaningful set is already included with Business Premium. You only pay extra — through E5 or the E5 Compliance add-on — for advanced features such as automatic labelling, endpoint DLP and insider risk management.

What is the difference between sensitivity labels and retention labels?

Sensitivity labels control protection — encryption, access and markings on a file. Retention labels control lifecycle — how long an item is kept and when it is deleted. They solve different problems and you typically use both: sensitivity to protect, retention to keep or dispose.

Do I need Purview before turning on Copilot?

You should. Copilot surfaces anything the asking user can already access, so existing over-permissioned data becomes far easier to stumble across. Sorting out labels, permissions and DLP first stops Copilot turning a hidden exposure into an obvious one.

Does Purview help with the Privacy Act?

It helps you demonstrate compliance. The Australian Privacy Principles require reasonable steps to protect personal information and to not retain it beyond need. Purview’s DLP, sensitivity labels and retention policies are practical, auditable controls that show the OAIC you have taken those steps.

Where to start

Do not boil the ocean. Pick three or four sensitivity labels, switch on a couple of DLP rules in audit mode, and set retention on your one or two most regulated record types. That alone puts you ahead of most SMEs and gives you a defensible governance baseline — and the foundation you need before any AI tool touches your data.

If you would like a hand scoping a Purview rollout, sorting your Microsoft 365 licensing, or running a governance review before you enable Copilot, get in touch with TechAssist. We will tell you plainly what you already have, what is worth turning on, and what you can safely leave alone.