In short: The question is rarely whether SharePoint and OneDrive are “GDPR compliant”. It is what's in them and who can open it. Microsoft 365 Business Basic and Standard don't include Purview DLP, which can find CPR numbers automatically, so most small companies have no overview.
Is OneDrive GDPR compliant?
Microsoft is the processor for your Microsoft 365 and there is a data processing agreement. But you, as controller, are responsible for the content: a basis for the CPR numbers you keep, restricted access, and deletion when the purpose is fulfilled (GDPR Articles 5 and 32). Secure storage doesn't help if a payroll list is shared with “anyone with the link”.
Where CPR numbers hide
- Old exports from payroll, accounting, CRM and membership systems.
- Personal OneDrive folders: a copy of a contract or payslip shared with an external accountant years ago.
- Teams files: files shared in a channel live in SharePoint and inherit its access, guests included.
- Hidden places: spreadsheet tabs, comments, headers, speaker notes and PDF signatures.
Sharing is the risk
| Sharing | Who can open | Risk |
|---|---|---|
| Anyone with the link | Anyone the link is forwarded to | High |
| People in your organisation | All staff with the link | Medium |
| Specific people, incl. external | Those named, e.g. a former accountant | Depends on who |
What about Microsoft's own tools?
Microsoft Purview has a built-in “Denmark personal identification number” type that DLP policies can use. But Purview DLP for SharePoint and OneDrive comes with Microsoft 365 Business Premium, E3 and E5, not Business Basic or Standard. Even with Premium, seeing where the numbers sit today (Content Explorer) typically needs E5 or an add-on, and setup is often consultant work.
Getting started without DLP
- Start with sharing. In the SharePoint admin center you can review and tighten sharing settings per site, e.g. turn off “anyone with the link”. For a single file, “Manage access” shows who it is shared with.
- Spot-check. Take the obvious files (payroll, HR, members, applications) and check them for CPR numbers in your browser.
- Clean up. Delete what you don't need, move the rest to a restricted library, remove old links.
- Repeat. New exports appear every month; a one-off check doesn't last.
Sporlock for Microsoft 365
We are building a version that scans SharePoint and OneDrive in your tenant, shows who can open each file with CPR numbers, and locks sharing down in one click, made for companies on Business Basic and Standard. The first scan is free; fixing starts at DKK 19 per user per month.Join the early-access list.
Sources
- Microsoft Learn: Microsoft Purview service description (licensing)
- Microsoft Learn: Denmark personal identification number (Purview sensitive information type)
- Datatilsynet: Klage over offentliggørelse af personnummer på kommunal hjemmeside (2021)
- Datatilsynet: Rettighedsstyring
- Databeskyttelsesloven § 11 (danskelove.dk)
- Databeskyttelsesforordningen (GDPR), forordning (EU) 2016/679 (EUR-Lex)
Not legal advice: this article is general information and does not replace an assessment of your specific situation. Ask a lawyer or your data protection officer if in doubt.