What you walk away with
Sample reports across HIPAA, GDPR, and PCI DSS.
Priivacy exports standalone HTML reports designed for the people who'll actually read them — boards, executives, IT teams, and compliance officers. Each sample below uses anonymised ACME INC data and shows how the same evidence can be framed for different regulatory obligations.
The priivacy Rating
One headline score. Five privacy pillars. Trended over time.
Every Priivacy estate gets a single 0-100 score — the priivacy Rating. Think Bitsight for privacy. It blends five weighted pillars into one defensible number with a tier badge for quick read. Recomputes automatically every time a scan completes; trajectory chart shows movement over time.
Methodology version is pinned to each rating so historical scores stay comparable when the methodology evolves.
Sensitive Data
30%Volume and severity of sensitive PII findings.
Access Exposure
30%Files with broken inheritance, anonymous shares, oversharing.
Retention & Hygiene
15%Stale data, ROT (redundant/obsolete/trivial), aged files with PII.
Ownership
15%Orphaned content, phantom owners, off-boarded user data.
External Sharing
10%Guest access, external collaborators, oversharing trends.
The sample report set
Built for the audiences who actually read them.
Privacy Exposure Assessment
CEOs, CFOs, executive committees, business owners — any organisation that needs a single defensible deliverable
The primary client deliverable. Jurisdiction-aware narrative, risk posture, compliance impact, PII exposure breakdown, file analysis, retention warnings, and prioritised actions.
Compliance Deep-Dive
GRC team, compliance officers, auditors, regulator-facing
Maps findings to the selected framework — including GDPR, HIPAA, PCI DSS, APP, CCPA/CPRA, and others. Article-level risk, evidence per article, and recommended actions. The deliverable for a regulator or audit review.
Estate Exposure
IT teams, data stewards, department heads
Shows where personal data concentrates across sources, owners, document types, data age, and PII combinations. The detailed view for the people doing the remediation work.
Executive Overview
Boards, trustees, ELT briefings
The leadership summary. Risk headline, posture, what was found, compliance impact, and top actions. Designed to fit an executive pack without losing the evidence trail.
Reports can be generated for a single scan, one source, or an estate-wide view. Pick the scope and framework that match your audience.
A separate report for tenant configuration risk.
PII scans answer "where is sensitive data?" The Privacy Posture report answers "how is the tenant configured to protect that data?" 35 read-only tests run across Microsoft 365 — SharePoint (13), OneDrive (3), Exchange (7), Entra ID / Identity (5), and PII-aware compliance (7). Seven of the 35 tests cross-reference tenant exposure against the sensitive data actually found in your environment, so an anonymous sharing link only fires as a real finding when it's actually sitting on a file containing PII, not just a theoretical risk.
The report grades your tenant on a five-tier scale — Healthy, Generally Healthy, Review Recommended, Attention Needed, Action Required — and lists every affected item with step-by-step remediation guidance.
Regulator-grade Subject Access disclosures, on demand.
When a data subject files a Subject Access Request under GDPR Article 15 or the Australian Privacy Act APP 12, Priivacy generates the response pack for you.
SAR Export — Quick response
A streamlined GDPR Article 15 PDF dossier generated per individual from existing estate scans. Cover, summary, processing purposes, evidence table with redacted snippets, third-party masking, rights boilerplate. Audit log captures every generation.
DSAR Workflow — Full statutory pipeline
The full 10-stage workflow for incoming statutory requests. Identity verification, jurisdiction-locked, Graph search across mailboxes and SharePoint, AI-assisted triage via local LLM, per-finding DPO decisions, sealed PDF dispatch. Every stage audit-logged and regulator-defensible.
Every export. Every format. No vendor lock-in.
Beyond the interactive reports, Priivacy generates raw exports for downstream systems and analysis. Use the right one for your audience.
Your reports. Your branding. Your distribution.
Standalone HTML
Every interactive report exports as a single self-contained HTML file. No login required. Opens offline in any browser. Travels by email. Print-to-PDF works out of the box — the print stylesheet forces every collapsible section open so the printed copy is complete.
Schedulable
Any scan can be set on a recurring schedule (daily, weekly, monthly, or interval). Each run produces a fresh standalone report. Useful for board cycles, audit reviews, or executive standups.
Brandable
Reports can be re-branded with your institution's logo and color scheme. Useful when forwarding to boards or auditors who expect to see your branding, not ours.
Common questions about reporting.
Want to see the reports against your own data?
The fastest way to evaluate Priivacy is to see a Discovery report generated against a sample of your real environment. Our team can run a scoped scan against one department, one mailbox, or one file share and walk you through the output. Forty-five minutes. No commitment.