Microsoft Purview Data Governance: Comprehensive Term Definitions and Industry Mapping

Sensitivity Labels

Persistent classification markers applied to documents, emails, and files that define protection policies. These labels travel with the content, enforcing encryption, access restrictions, and visual markings. Examples include "Confidential", "Highly Confidential", and "Public".

Use: Applied manually by users or automatically based on content detection rules to ensure consistent protection.

Information Types

Pre-defined or custom patterns that identify specific categories of sensitive data, such as credit card numbers, national insurance numbers, or medical records. These types use pattern matching, checksums, and proximity rules to detect sensitive information accurately.

Use: Configure automatic labelling policies and data loss prevention rules based on detected information types.

Trainable Classifiers

Machine learning models that identify content based on semantic meaning rather than simple pattern matching. These classifiers learn from examples to recognise documents like contracts, source code, or financial statements, even without specific keywords.

Data Catalogue

A searchable inventory of all data assets within your organisation, enriched with metadata, classifications, and business context. The catalogue enables data discovery through business glossaries and facilitates collaboration between technical and business users.

Industry Mapping: Aligns with DAMA-DMBOK metadata management and ISO 8000 data quality principles.

Data Lineage

Visual representation of data movement and transformation across systems, showing source origins, processing steps, and consumption points. Lineage tracking helps identify impact of changes, troubleshoot data quality issues, and demonstrate compliance.

Industry Mapping: Supports GDPR Article 30 record-keeping and SOX compliance requirements for data traceability.

Data Estate

The complete collection of data assets under management, spanning on-premises databases, cloud storage, SaaS applications, and file shares. Understanding your data estate scope is crucial for comprehensive governance coverage.

Data Policies

Declarative rules that govern how data assets can be accessed, shared, and used. Policies define permissions at various levels—from entire data sources down to individual columns—enabling fine-grained control. They integrate with Azure Active Directory and support delegation to data owners.

Use: Implement least-privilege access and enable self-service data access with governance guardrails.

Mapping: ISO 27001 A.9.4 (System and Application Access Control), NIST AC-3 (Access Enforcement).

Role-Based Access Control (RBAC)

Authorization approach that assigns permissions based on user roles rather than individual identities. Purview defines roles like Data Reader, Data Curator, and Data Source Administrator, each with specific capabilities aligned to job functions and responsibilities.

Use: Simplify permission management and ensure consistent access control across your data estate.

Mapping: NIST RBAC model, GDPR principle of data minimization in access permissions.

Conditional Access

Dynamic access policies that evaluate contextual factors—such as user location, device compliance state, and risk level—before granting access to sensitive data. These policies enable adaptive security that responds to changing threat conditions.

Compliance Score

Quantitative measure of your organisation's compliance posture based on implemented controls and risk assessments. Provides actionable recommendations for improvement aligned with regulatory frameworks.

Data Loss Prevention (DLP)

Protective measures that detect and block unauthorized sharing of sensitive information. DLP policies monitor content in emails, documents, and applications, preventing accidental or malicious data exfiltration.

Retention Policies

Rules that govern how long data must be kept and when it should be deleted. Ensures compliance with legal hold requirements whilst reducing storage costs and privacy risks from outdated data.

Data Sources

Systems and repositories that store data, including Azure services, on-premises databases, SaaS applications, and file shares. Purview supports 200+ data source types through native connectors and extensible scanning frameworks.

Scan Rules

Configuration templates that define what should be scanned, how often, and which classification rules to apply. Scan rules balance comprehensive discovery with performance impact and cost considerations.

Collection Hierarchies

Organizational structure within the catalogue that groups related data sources, reflecting business domains or geographical boundaries. Collections enable delegated management and scoped access control.

GDPR Alignment

• Sensitivity Labels → Art. 32 (Security measures)
• Data Catalogue → Art. 30 (Records of processing)
• DLP Policies → Art. 5 (Data protection principles)
• Retention Policies → Art. 17 (Right to erasure)

ISO 27001 Mapping

• RBAC → A.9.2 (User access management)
• Information Types → A.8.2 (Information classification)
• Scan Rules → A.8.1 (Responsibility for assets)
• Data Policies → A.9.4 (Access control)

NIST Framework Correlation

• Data Estate → ID.AM (Asset Management)
• Trainable Classifiers → ID.RA (Risk Assessment)
• Conditional Access → PR.AC (Identity Management)
• Compliance Score → ID.GV (Governance)
• Data Lineage → DE.AE (Anomalies & Events)

These mappings enable organisations to leverage Purview capabilities whilst demonstrating compliance with multiple frameworks simultaneously, reducing audit burden and ensuring consistent governance approaches.

Data Stewardship

Designated ownership and accountability for specific data domains. Data stewards ensure quality, resolve access requests, and maintain business glossaries. They bridge technical implementation and business requirements, serving as subject matter experts.

Mapping: DAMA-DMBOK Data Stewardship principles, ISO 8000 data quality roles.

Approval Processes

Formal workflows requiring authorization before sensitive actions occur, such as granting access to confidential data or modifying classification policies. Approval chains ensure appropriate oversight and create audit trails for compliance.

Mapping: SOX segregation of duties requirements, ISO 27001 A.9.2.1 user registration.

Policy Enforcement

Automated mechanisms that prevent policy violations in real-time, such as blocking emails containing sensitive data or denying access to restricted resources. Enforcement ensures governance rules translate into tangible protection rather than recommendations.