---
title: "What is the safest approach (actions) to GDPR data?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-is-the-safest-approach-actions-to-gdpr-data"
language: "en"
last_updated: "2026-05-28T22:06:28.117Z"
---

# What is the safest approach (actions) to GDPR data?

When building a GDPR compliance program, "safest" refers to actions that provide high governance value with low risk of business disruption or accidental data loss.

For GDPR, the safest approach follows a "Crawl, Walk, Run" methodology, starting with non-destructive metadata actions before moving to automated enforcement.

## 1\. The Safest Starting Action: "Notify"

Notification is the lowest-risk action because it does not modify the data at all. It focuses on **Accountability** (GDPR Article 5).

-   **How it works:** Spirion sends an automated email to the file owner or a privacy officer when GDPR data is found.
-   **Why it’s safe:** It puts the responsibility on the human who knows the context of the data. It cannot "break" an application or lock a user out of a critical file.
-   **GDPR Value:** Demonstrates that you are actively monitoring for sensitive data and educating staff.

## 2\. The Safest Governance Action: "Classify" (Metadata)

Classification is "safe" because it marks the data for future handling without necessarily restricting access immediately.

-   **NTFS ADS (Alternate Data Streams):** This is the safest form of classification for Windows environments. It writes the "GDPR-PII" tag to the file's metadata *without* changing the file's primary content or hash.
-   **Why it’s safe:** It is invisible to the end-user and doesn't interfere with most applications, but it allows security tools (like DLP) to see the tag and apply rules later.
-   **GDPR Value:** Establishes a "Governed State," proving to auditors that you know exactly where your GDPR data resides.

## 3\. The Safest Protection Action: "MIP Labeling" (Microsoft)

If you use the Microsoft 365 ecosystem, applying a **Microsoft Information Protection (MIP)** label is safer than a "hard" delete or move.

-   **How it works:** Spirion applies a label like "Internal Only" or "General."
-   **Why it’s safe:** If a label is applied incorrectly, it can be changed or removed by an administrator. It provides "soft" protection (like watermarking or basic permission sets) that is easier to roll back than a quarantine action.
-   **GDPR Value:** Meets the "Security of Processing" requirement (Article 32) by ensuring data is encrypted or restricted to authorized users.

* * *

## Actions to Use with Caution (The "Unsafe" List)

While these are powerful for GDPR, they carry higher operational risk:

-   **Shred / Delete:** **High Risk.** If Spirion identifies a system file or a critical database flat file as "PII" and deletes it, you could crash an application.
-   **Quarantine (Move):** **Medium Risk.** Moving a file breaks the "file path." If a business process or script expects a file to be in `C:\Reports` and Spirion moves it to `S:\Vault`, that process will fail.
-   **Redact:** **Medium Risk.** Redaction modifies the actual bits inside the file. While great for privacy, it is permanent. If you redact a value that wasn't actually PII (a false positive), the original data is lost unless you have a backup.

* * *

## Recommended "Safe" GDPR Workflow

If you are just starting your GDPR journey, configure your Scan Playbook in this order:

1.  **Action 1: Classify** (Apply a `GDPR-Identified` tag via NTFS ADS).
2.  **Action 2: Notify** (Email the user: *"We found potential EU Personal Data in \[File\_Path\]. Please ensure this is stored according to policy."*).
3.  **Action 3: Manual Review** (Set the Playbook to **Manual** mode so a human must click "Approve" before any stronger actions like Quarantine are taken).

## Summary

The safest actions are **Notify** and **Classify (Metadata)**.

They provide the audit trail required for GDPR without the risk of breaking business workflows.