2020 – 2024 · Microsoft Priva

Microsoft Priva –
Privacy management

Microsoft Priva · DSR · Consent · Risk · Assessments · Tracker Scanning

Scaling Lead Designer GDPR / CCPA 5 Products Enterprise Privacy Microsoft 365

Shipped full-screen consent model customization view in Microsoft Purview Consent Management, showing the live device preview and styling controls

Project Details

TL;DR

Privacy operations at large enterprises were running on duct tape — subject rights requests tracked in shared spreadsheets, consent models managed through disconnected third-party tools, risk assessments emailed as questionnaires. Microsoft's opportunity was to replace all of it with a unified platform built natively into the Microsoft 365 ecosystem.

Priva started as two PMs and me, with a hypothesis and no funded product. It all started with extensive customer research that took the shape of months of cold-calling privacy professionals on LinkedIn to learn about their privacy and compliance workflows, pain points and ideal solutions. We initiated these conversations with no existing product to anchor the conversation.

I led end-to-end UX design across all five privacy products over four years, developed largely in parallel rather than sequentially, from initial concept through public launch — and defined the unified navigation and home experience that tied them together.

All five launched together as Microsoft Priva at the IAPP Global Summit in April 2024 — a single coordinated suite, not a rolling series of feature drops. Priva is now available to all Microsoft 365 customers.

Project Details

The Details

The Problem

Privacy operations at large enterprises were running on duct tape. Subject rights requests were tracked in shared spreadsheets. Consent models were managed through third-party tools that didn't connect to internal data. Privacy risk assessments meant emailing questionnaires and waiting weeks for responses.

Microsoft's opportunity was to replace all of this with a unified, automated privacy operations platform built natively into the Microsoft 365 ecosystem that millions of enterprise customers already used.

Original Babylon Privacy pitch deck slide showing the Assess, Control, Trust framework used to define privacy features — The original framework slide — organising every privacy need we'd heard on customer calls into three jobs-to-be-done: Assess, Control, Trust.

Research

Priva started as two PMs and me, with a hypothesis and no funded product — one of several workstreams running inside the broader, multi-year Babylon effort.

I was involved in customer research directly: cold-calling privacy professionals on LinkedIn — a months-long effort, with no existing product to anchor the conversation and no warm introductions, just questions about how they handled compliance today.

That research wasn't scoping a feature. It became the foundation for an entire product suite — the five distinct privacy products that launched as Microsoft Priva, and which I led design for end to end.

Insight

Two patterns showed up in nearly every call. Everything was manual — Excel trackers, offline processes, no system of record.

And everything was disconnected — a privacy officer juggling five separate processes with no single place to see status across any of them.

Low-fidelity wireframe from the original pitch deck showing a persona named Charlie publishing a new consent model — Charlie, a Data Privacy Officer persona, publishing a new consent model and selecting a template.

Low-fidelity wireframe from the original pitch deck showing Charlie creating a new cookie scanning project — Charlie creating a new cookie scanning project — before any real cookie or lineage data existed to design against.

Decisions

The team wrote a white paper synthesising what we'd heard. I built the case for it visually — low-fidelity PowerPoint walkthroughs with wireframes, structured around a fictional company and named personas, each with their own scenario walked step by step.

Kept deliberately rough so we could socialise the idea quickly and iterate without over-investing before we knew the concept had legs. That pairing got us funded, specifically for Consent Management and DSR.

Shipped DSR case detail view showing a status stepper from Queued through Complete, request properties, and scope fields — Subject Rights Requests

Shipped consent model customization panel with a live device preview of a cookie notification banner — Consent Management

Shipped Alerts dashboard with an alert status donut chart, an active alerts over time trend chart, and a filterable alert list — Privacy Risk Management

Shipped Assessment builder with question configuration and a conditional logic panel — Privacy Assessments

Shipped tracker lineage view showing a website, script, and cookie graph with classification labels — Tracker Scanning

The Five Products

Subject Rights Requests. Case management at scale — intake, automated discovery across connected systems, fulfilment, audit logging. Integration with Purview's data catalog turned a days-long manual search into an automatic one.

Consent Management. A wizard for cookie consent banners — text, behaviour, regional rules (GDPR vs CCPA), CDN deployment — customisable for brand while enforcing the legal elements compliance required.

Privacy Risk Management. Insight pages surfacing risk patterns — data shared externally, overshared SharePoint sites, excessive retention — each paired with a recommendation workflow from detection to action.

Privacy Assessments. Replaced annual questionnaire cycles with a continuously updated record, auto-populated using Purview's data map.

Tracker Scanning. Scan results categorising trackers — advertising, analytics, functional — alongside compliance gaps like missing notices. Readable at a glance, actionable at a click.

Photo from the Microsoft Priva product launch — Microsoft Priva launching publicly — the culmination of the four-year arc from cold-call research to a coordinated five-product suite.

Outcome

DSR and Consent, the first two funded, ran in private preview with 10+ customers from mid-2021, validating the automated discovery and consent workflows against real usage well before public availability.

Rather than releasing each product individually as it was completed, all five launched together as Microsoft Priva at the IAPP Global Summit in April 2024 — a single coordinated suite, not a rolling series of feature drops.

Impact

The largest design challenge across four years was ensuring five distinct, complex products felt like one coherent tool. Shared visual patterns — identical table layouts, status chips, filter panels — meant that once a user learned one, they could navigate any of them without relearning.

Privacy teams using the platform moved from disconnected manual workflows to a single managed environment — with continuous monitoring replacing static annual snapshots, and automated data discovery replacing multi-day manual searches. Priva is now available to all Microsoft 365 customers.

1 / 7

← AI-Powered Privacy Manager Project Babylon — Azure Purview →

Microsoft Priva –Privacy management