A payroll analyst needs to send October's payroll to the outside accountant. She exports the Excel file, attaches it to an email and hits send. The file has national ID numbers (RUT), salaries, bank accounts and, in a column nobody remembers adding, the reason behind each employee's sick leave. Nothing stops her, because as far as Microsoft 365 is concerned, that file is no different from meeting notes.
That is where Microsoft Purview data protection starts: teaching Microsoft 365 which files and emails contain personal data, so it can warn, label or block before they leave. It's the part of Chile's Law 21.719 that lives in email, OneDrive, SharePoint and Teams, and many companies have it half configured without realizing it. Below we look at how sensitive information types, sensitivity labels and Microsoft 365 DLP fit together, and what each license includes.
Where the law stands today
Law 21.719 is set to take effect on December 1, 2026. On October 28, the Senate approved a bill that would push that date to October 15, 2027 (Diario Financiero), and it now goes to the Chamber of Deputies. Until it is published, December is still the legal date.
For what follows, the date barely matters. The law requires security measures proportionate to the type of data and the risk, and that's hard to do with files nobody knows contain personal data. We covered how to inventory that data in ERP, CRM and backups in Law 21.719 in IT systems. Purview handles the other side: documents, spreadsheets and email.
The three parts of Purview that matter here
Purview has a lot of modules. To classify personal data in Microsoft 365 you only need to understand three:
| Component | What it does | Example |
|---|---|---|
| Sensitive information types | Detect patterns inside content (a RUT, a credit card, a passport number) | Find every SharePoint file containing valid RUTs |
| Sensitivity labels | Mark a file or email by sensitivity level and can encrypt it, watermark it or restrict who opens it | A "Confidential - Personal data" label that only lets people in the company open the file |
| DLP (data loss prevention) | Inspects what gets shared or sent and acts: warns, asks for a justification or blocks | Block an external email containing more than ten RUTs |
You can use them separately, but the point is to combine them: the information type finds the RUT, the label stays with the file even after it's downloaded, and DLP steps in when someone tries to send it out.
How Purview recognizes a Chilean RUT
Purview ships with a sensitive information type called Chile identity card number. It looks for seven or eight digits with optional periods, a hyphen and a check digit (a number or K), and it validates that check digit. If it also finds words like "RUT", "RUN" or "cédula de identidad" within 300 characters, the match gets high confidence. Without them, it's medium confidence.
In practice, start with high confidence for rules that block and keep medium confidence for rules that only audit. A collections spreadsheet with a "RUT" column header will match nicely. A stray number in a scanned PDF probably won't.
For data without a fixed format (a medical record, a diagnosis buried in a note, a performance review), the RUT isn't enough. You can create custom information types with your own keywords and regular expressions, for example for codes from your payroll system or the names of your internal forms.
Sensitivity labels: few and easy to understand
The most common mistake with labels is designing a twelve-level taxonomy nobody understands. For a mid-sized company, something like this is usually enough:
- Public: material that can go out freely.
- Internal: general use inside the company.
- Confidential: business information that shouldn't leave without authorization.
- Confidential - Personal data: files with identifiable customer, employee or supplier data. Encrypted, with access restricted to the organization.
The fourth label is the one tied to the law. If a file carrying it gets forwarded to a personal account, encryption keeps it from opening outside the company.
Watch the licensing. According to the Microsoft Purview service description, manual labeling is included in Microsoft 365 Business Premium, E3 and E5. Automatic labeling, both the kind that suggests a label in Word or Excel and the kind that applies it in SharePoint, OneDrive and Exchange, requires Microsoft 365 E5 or add-ons such as Microsoft Purview Suite or E5 Information Protection and Governance.
So with Business Premium or E3, classification depends on people applying labels. That works if there are few, clear labels and a default label so nothing stays unclassified.
DLP in Microsoft 365: what each license covers
Without DLP, classification mostly tells you where the problem is. A typical policy says: if an email or a file shared externally contains RUTs with high confidence, or carries the personal data label, show the user a tip and ask for a justification; above a certain count, block it.
Coverage depends on the license:
| Location | Business Premium / E3 | E5 |
|---|---|---|
| Exchange Online (email) | Yes | Yes |
| SharePoint and OneDrive | Yes | Yes |
| Files shared in Teams | Yes (they live in SharePoint/OneDrive) | Yes |
| Teams chat and channel messages | No | Yes |
| Content explorer and activity explorer | No | Yes |
Sources: Microsoft Purview service description and DLP and Microsoft Teams.
Back to the opening scene: with Business Premium, an Exchange DLP policy that detects RUTs would have warned the analyst before sending, or asked for a justification. You don't need E5 to get that first control in place.
Microsoft recommends rolling policies out in simulation mode first. For a few weeks the policy logs what it would have blocked without blocking anything, so you can tune thresholds before bothering anyone. Skip that step and you'll probably end up with the sales team asking you to turn the whole thing off.
If you're getting ready for Copilot, this matters even more. Copilot only shows what each person can already open and honors label encryption, but a payroll folder shared with the whole company will show up in its answers just like it shows up in search. We cover other baseline settings in Microsoft 365 security for business.
A work order that holds up
- Check which licenses you have, per user. Plenty of companies have Business Premium or E3 and never turned on the labels or DLP they already pay for.
- Decide what counts as personal data in your company: RUT, bank details, employee health data, customer data. Create custom information types for whatever the RUT doesn't cover.
- Publish three or four labels, with one set as default, and explain on a single page when to use each.
- Create a DLP policy for Exchange, SharePoint and OneDrive in simulation mode, focused on high-confidence RUTs and the personal data label.
- Tune it for two to four weeks, reviewing false positives with the teams that share the most information externally.
- Turn on tips and justifications first, and blocking only where the risk calls for it.
- Consider E5 or Purview Suite if you need automatic labeling, DLP in Teams chats or visibility through content explorer.
Frequently asked questions
Does Purview detect Chilean RUTs out of the box?
Yes. It includes a sensitive information type for the Chilean identity card number that validates the check digit and raises confidence when it appears near words like RUT or RUN. What you do have to set up are the policies that use it.
Do I need Microsoft 365 E5 to comply with Law 21.719?
Not necessarily. Business Premium and E3 include manual labeling and DLP for email, SharePoint and OneDrive, which cover a good share of the risk. E5 adds automatic labeling, DLP in Teams chats and more visibility. No license makes you compliant on its own.
Does Purview help with data in the ERP or CRM?
For whatever leaves those systems and lands in Microsoft 365, yes: exports, reports and attachments. Data inside the ERP or CRM databases needs separate work, with an inventory and controls in each system.
How we can help
At Disrupsoft we start by reviewing what you already have in Microsoft 365 and which licenses cover it. Then we define labels and DLP policies with your teams, implement them and keep supporting you once they're in production. If you want to know how close you are to protecting the personal data moving through your email and documents, let's talk about Microsoft security.
