GDPR Compliance – Cloud + Microsoft 365

Here is one of my recent IT consulting missions where I helped a European client strengthen their GDPR compliance posture across Microsoft 365 and cloud environments by auditing their data handling processes, securing sensitive information, and delivering actionable documentation.

Client: Aerolyte Cyberworks (Offensive Security & GDPR)
Consultant: Samuel Ndala – Cloud & Compliance Consultant
Duration: 7 days
Delivery Date: February 9, 2024
Project Type: GDPR Compliance Assessment & Remediation (Microsoft 365 + Azure)

Project Summary

Aerolyte Cyberworks, a cybersecurity firm operating across multiple EU countries, needed to ensure that their cloud-based systems—particularly Microsoft 365 and Azure workloads—complied with the GDPR framework. This mission aimed to audit existing configurations, close compliance gaps, and create clear documentation for legal and IT use.

Objectives

  • Perform a GDPR-focused security audit of Microsoft 365 and Azure

  • Ensure data subject rights (access, deletion, portability) are respected

  • Validate data retention, consent tracking, and encryption policies

  • Secure personal data storage across Exchange, OneDrive, SharePoint

  • Deliver a PDF compliance report + remediation plan + internal policy pack

Architecture Overview

Compliance Audit Scope

  • ✅ Microsoft 365 Security & Compliance Center reviewed

  • ✅ Microsoft Purview (formerly Compliance Manager) score analyzed

  • ✅ Azure logs checked for data transfer outside EEA

  • ✅ DLP policies simulated and enforced

  • ✅ Exchange Online, OneDrive, SharePoint reviewed for PII visibility

Key Deliverables

  • 📄 GDPR Compliance Audit Report (.PDF with risk score + screenshots)

  • 📘 Internal GDPR Playbook (Rights requests, retention rules, team checklists)

  • 📊 Remediation Tracker (Excel with status per system & risk level)

  • 🔐 Updated M365 DLP + Encryption policies

  • 💡 Security Awareness Kit (template for internal IT & HR)

Results & Impact

✅ Compliance Score improved from 58% → 81.5% →94%
✅ 14 misconfigured data-sharing links corrected
✅ DSR (Data Subject Request) process reduced to 48h
✅ OneDrive & Exchange now enforce encryption + logging

Technologies Used

  • Microsoft 365: Security & Compliance Center, Purview, Exchange, SharePoint, OneDrive

  • Azure: Azure AD, Audit Logs, Conditional Access, Defender for Cloud

  • Tools: Compliance Score, DLP policy editor, PowerShell, Excel, Adobe PDF

  • Frameworks: GDPR, ISO 27001 references, Microsoft Privacy Controls

Conclusion

This mission helped Aerolyte Cyberworks demonstrate real accountability under the GDPR framework. Their Microsoft 365 and Azure environments are now aligned with data privacy principles, while internal teams are equipped with policies, tools, and training resources to maintain compliance.

Popular Projects

What is Cloud Computing ?

Cloud computing delivers computing resources (servers, storage, databases, networking, and software) over the internet, allowing businesses to scale and pay only for what they use, eliminating the need for physical infrastructure.


  • AWS: The most popular cloud platform, offering scalable compute, storage, AI/ML, and networking services.
  • Azure: A strong enterprise cloud with hybrid capabilities and deep Microsoft product integration.
  • Google Cloud (GCP): Known for data analytics, machine learning, and open-source support.