2023 – 2024 · Microsoft Priva

AI-Powered Privacy
Manager (Copilot)

Microsoft Priva · Security Copilot · IAPP Global Summit 2024

Interaction Lead Conversational UX AI-Human Interaction Rapid Prototyping IAPP 2024 Demo

Shipped Privacy Manager Copilot landing screen with an Ask me anything prompt bar and Summarize, Find, Regulations, and Learn more suggestion cards

Project Details

TL;DR

Privacy officers working across Microsoft Priva's five products faced a consistent challenge: the tools existed, but navigating across five distinct products to answer a single compliance question was slow and cognitively demanding. With generative AI maturing rapidly inside Microsoft, the question became what it looks like when an AI assistant orchestrates privacy operations — not just answers questions.

I led this design, with a key focus on the core interaction model — how the AI surfaces suggestions, how users keep control over AI-generated content, and how the assistant moves between conversational responses and native product UI.

Two constraints shaped everything: AI suggestions had to be attributable, editable, and interruptible, and we would not recreate product UI inside Copilot. A task that previously took manual research and form-filling was reduced to a review-and-confirm.

The prototype was demoed live at the IAPP Global Summit in April 2024 and became an internal blueprint — interaction patterns from it closely resemble what shipped later in Microsoft's Security Copilot roadmap.

Interactive prototype Walk all four Copilot scenarios yourself Rebuilt in code from the original Figma files — real DOM, not a video or a click-through of screenshots. Follow the highlighted step. Open the prototype

Project Details

The Details

The Problem

Microsoft Priva is a suite of five privacy products — subject rights requests, consent management, privacy risk management, assessments, and tracker scanning — that together cover an organisation's privacy compliance workflow. Privacy officers working across that suite faced a consistent challenge: the tools existed, but navigating across five distinct products to answer a single compliance question was slow and cognitively demanding.

Understanding consent requirements across jurisdictions, initiating a data subject request, and reviewing risk patterns required expert knowledge of where everything lived. With generative AI maturing rapidly inside Microsoft, the question became: what does it look like when an AI assistant orchestrates privacy operations — not just answers questions?

Wide bird's-eye view of the Figma exploration board showing dozens of dated iterations across multiple days — A snapshot of one of many such exploration boards

Alternate Privacy Manager home layout, Priva-branded, with a large search bar, compliance issue cards, and an expandable recent-conversations panel showing a status stepper — One direction tested and set aside — conversation-history-first, with a status stepper for multi-step AI-assisted tasks.

Alternate Privacy Manager home layout, Purview-branded, with a sidebar of system-generated views and an expandable AI summary panel with a chart — Another, from before the Priva rebrand — a sidebar of system-generated views with an inline AI summary panel.

Research

An AI-forward privacy solution was unheard of at the time — there was no reference implementation to borrow from, so the interaction model had to be derived from scratch and tested continuously. I paid close attention to that core interaction model: how the AI surfaces suggestions, how users keep control over AI-generated content, and how the assistant moves between conversation and native product UI.

We ran RITE studies — rapid iterative testing and evaluation, revising the prototype between sessions rather than waiting for a full round to finish — alongside regular internal UX and product team reviews. Each pass narrowed which patterns privacy officers actually trusted with a real compliance decision.

The board shows the volume that took: dated, dense, iterated on daily. Most of what's on it didn't ship — that discarded work is how the final patterns got settled.

Early sketch exploring a Copilot-assisted flow for learning about privacy laws and creating a data inventory, with open questions annotated in pink — Copilot answering a regulatory question, then walking the user toward a concrete next action. Pink annotations are open questions, not settled answers.

Early sketches exploring Magic Spotlight applied broadly to SRR tasks and tracker scan results, not just charts — Magic Spotlight's scope — applied to SRR tasks and tracker scan results, not just charts. Close to what actually shipped.

Insight & Decisions

Underlying every pattern were two constraints: AI suggestions needed to be attributable, editable, and interruptible, or privacy officers wouldn't trust the system with real compliance decisions — and don't recreate UI inside Copilot itself, leverage the product's existing UI rather than making users re-learn flows they already know.

Smart wizard automation. Rather than filling 11+ fields manually, the user got a wizard pre-populated with Copilot's suggestions, each one editable and clearly labeled as a suggestion rather than a locked answer.

Magic Spotlight. The vision was to let a user click into any artifact they had a question about — not just a chart — and ask Copilot directly.

Shipped consent model wizard with 11 fields pre-populated by Copilot, each editable and labeled as a Copilot suggestion — Copilot-suggested fields, each editable before the user saves. Reduces complex creation flows to a simple review and submit process

Shipped Privacy Manager home screen populated with the user's history, showing compliance-issue cards each with a small Copilot icon in the corner — A Copilot icon on each card — Tracker, Subject Rights Requests, Privacy Risk Assessment — not just on charts.

Outcome

A task that previously took manual research and form-filling was reduced to a review-and-confirm. The Magic Spotlight vision shipped largely as designed — once a user's home populates with their history, a Copilot icon surfaces a contextual answer without leaving the page.

One direction we explored further, an inline expansion that turned a card into a small embedded chat panel, was ultimately not shipped: accessibility and technical feasibility concerns ruled it out in favor of the simpler icon-triggered pattern.

Shipped Copilot response to a California privacy law question, with three numbered sourced citations and a suggested action card for Priva Consent Management — Attribution in practice — every regulatory claim traces to a numbered source, and the response ends in a concrete suggested action rather than just information.

Impact

The prototype was demoed live at the IAPP Global Summit on April 3, 2024. Response from privacy professionals was strongly positive — generative AI applied specifically to privacy compliance was still uncommon to see live at that point, and the demo landed as a credible, production-ready vision rather than a research concept.

It became an internal blueprint: interaction patterns from this project — particularly the trust model and the smart wizard flow — closely resemble what shipped later in Microsoft's broader Security Copilot roadmap.

1 / 5

Interactive prototype See these four flows running, not described Open the prototype

← Purview DSPM & AI Observability Microsoft Priva – Privacy management →

AI-Powered PrivacyManager (Copilot)