Using Microsoft Purview DLP to Secure PII File Sharing in Financial Services

The Challenge

A financial services organisation handled sensitive personally identifiable information between itself and banking partners. Most reporting and data exchange was managed through a dedicated application; however, there were occasions where that platform was unavailable or could not support a specific operational requirement.

In those situations, staff relied on manual file-sharing workarounds, including password-protected zip files and email-based transfer. While this approach provided a basic level of protection, it was difficult to govern consistently, created friction for users, and increased the risk of accidental data leakage through misdirected emails, incorrectly handled attachments, or inconsistent encryption practices.

The organisation already held Microsoft 365 E5 licensing, but was not fully using the information protection and data loss prevention capabilities available through Microsoft Purview. This created an opportunity to reduce risk using technology the organisation had already licensed, while improving the way sensitive PII files were classified, protected, shared, and monitored.

The Approach

Reviewing the Existing Process

• Reviewed the existing manual file-sharing process used when the primary reporting application was unavailable.
• Identified key risks associated with password-protected zip files, email attachments, inconsistent encryption, and accidental data leakage.

Piloting Microsoft Purview Capabilities

• Demonstrated how Microsoft Purview sensitivity labels could be used to classify and encrypt sensitive files before they were shared.
• Showed how protected files could be securely shared with both internal Microsoft 365 users and external recipients using personal email addresses.
• Designed a pilot approach for applying sensitivity labels to PII files requiring secure transfer.
• Demonstrated how Microsoft 365 E5 capabilities could reduce reliance on manual password-based file protection.

DLP Configuration & Operational Uplift

• Provided guidance on Microsoft Purview DLP policy configuration to detect and protect sensitive information.
• Trained junior staff on the practical implementation of sensitivity labels, encryption controls, and DLP policy procedures.
• Documented the recommended operating procedure for securing PII files and reducing accidental data leakage.
• Supported the organisation in moving from ad hoc file protection practices toward a more governed, auditable, and policy-driven information protection model.

Lessons for Australian Businesses

Many Australian organisations licensed for Microsoft 365 E5 are not using the information protection and data loss prevention capabilities included in that licence. Sensitivity labels, encryption, and DLP policies are often left unconfigured - leaving staff to rely on manual workarounds like password-protected zip files or unencrypted email attachments to handle sensitive data.

This gap is particularly relevant for financial services and other regulated sectors, where personally identifiable information moves between internal systems and external partners on a regular basis. The approach used in this case - piloting Microsoft Purview DLP using capability already included in existing licensing - reflects a broader pattern Pyneora sees across Australian businesses: the tools to reduce risk are frequently already paid for, just not switched on.