Notifications
Clear all
Topic starter
20/08/2026 5:56 pm
TL;DR: SharePoint can store personal data in files, scans, versions, and synced copies without deleting it automatically, creating retention and compliance gaps, according to Strac. The practical issue is not storage but governed deletion across the full document lifecycle, including historical versions and external shares.
NHIMG editorial — based on content published by Strac: How to Delete PII in SharePoint Automatically
Questions worth separating out
Q: What breaks when SharePoint deletion is limited to the main file only?
A: Historical versions, synced copies, external shares, and embedded content can still preserve personal data after the visible file is removed.
Q: Why do privacy teams need content-aware deletion in document systems?
A: Because personal data often sits inside scans, PDFs, spreadsheets, and images where folder-level controls cannot see it.
Q: How do organisations know if PII discovery is actually working?
A: They should measure coverage across data sources, false-positive rates, and the time between discovery and remediation.
Practitioner guidance
- Inventory all PII-bearing SharePoint locations Map libraries, folders, synced OneDrive content, shared links, and archival areas where personal data can persist outside standard review cycles.
- Extend deletion policy beyond the primary file Require workflows to remove historical versions, attachments, and synced copies whenever retention or privacy rules trigger deletion.
- Use content-aware detection before removal Apply OCR and classification to scans, PDFs, spreadsheets, and images so deletion targets actual personal data rather than only file names or paths.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step detection and deletion flow for PII inside SharePoint libraries and synced OneDrive content
- Examples of policy choices such as auto-delete, alert-and-delete, and approval-based deletion
- Handling for PDFs, scans, spreadsheets, ZIP archives, and historical file versions
- Audit logging and compliance evidence details for privacy review
👉 Read Strac's guide to automatically deleting PII in SharePoint →
SharePoint PII deletion gaps: are retention controls keeping up?
Explore further
20/08/2026 6:36 pm
Automated PII deletion is a lifecycle control, not a storage feature. SharePoint can retain content, but retention governance requires the ability to remove personal data from files, versions, and synced copies on policy trigger. The deeper issue is that many programmes still treat document systems as repositories rather than lifecycle engines. That assumption breaks once privacy obligations require deletion on request or on expiry. Practitioners should treat content deletion as an enforceable control boundary, not an afterthought.
A question worth separating out:
Q: Who is accountable when regulated data persists in a collaboration platform?
A: Accountability usually spans workspace administrators, compliance owners, and the teams that approved the retention model. If bots or automated workflows can introduce PHI, their permissions and outputs must also be governed. Under HIPAA-style controls, the organisation remains accountable even when a third-party platform stores the data.
👉 Read our full editorial: Automated PII deletion in SharePoint closes retention blind spots
