Exchange Email DSAR Redaction Guide

Email Is the Largest Source of DSAR Data

In most organizations, Exchange Online mailboxes contain the highest volume and widest variety of personal data. Microsoft estimates that over 90% of organizational data stored in Microsoft 365 is authored in Office applications, with a substantial portion residing in or attached to email. For DSAR purposes, email is almost always the primary data source — and the most complex to redact.

A single mailbox can contain years of correspondence with dozens or hundreds of contacts. Each email thread weaves together the personal data of multiple individuals: sender and recipient addresses, CC and BCC fields, signature blocks with phone numbers and addresses, forwarded messages from third parties, and attachments containing their own embedded personal data. Extracting the data subject's information while protecting everyone else's requires systematic processing that manual review struggles to deliver at scale.

Export Formats: PST vs. Individual Messages

Purview eDiscovery offers two export options for Exchange data. PST format packages all messages from a mailbox into a single archive file. Individual message export produces separate EML or MSG files for each message, organized by folder structure.

For DSAR redaction purposes, choose the PST export. SafeRedact processes PST archives directly in the browser: the archive is expanded locally, messages and folder structure are recovered, and attachments embedded in the mailbox are extracted and scanned for personal data like any other file, with an inline placeholder recorded for anything that cannot be extracted so no attachment is silently dropped. A PST can be up to 2GB per file, so set the Purview package size to 1 to 2GB when exporting large mailboxes. Individual EML files also work well and their embedded attachments are parsed. The one option to avoid for attachment-bearing mail is individual MSG export: MSG files are processed via binary extraction that recovers message text and metadata strings, but the content of attachments embedded inside an MSG file is not scanned, which makes PST or EML the covered path for detection.

PII Hotspots in Email Messages

Headers and Routing Data

Every email contains a header block with sender and recipient information, routing data, and message identifiers. The To, CC, and BCC fields contain email addresses — and often display names — of third parties whose data must be redacted. Reply chains accumulate additional addresses with each exchange. The From field of forwarded messages reveals the original sender's identity.

Signature Blocks

Corporate email signatures routinely include full name, job title, direct phone number, mobile number, physical office address, and sometimes personal pronouns or social media handles. In a long email thread, signature blocks appear after every reply — multiplying the number of third-party data points that need redaction.

Email Body Content

The message body itself may reference other individuals by name, include phone numbers, share addresses, discuss financial details, or contain any other category of personal data. Contextual personal data — information that becomes personal when combined with other details in the thread — adds another layer of complexity.

Attachments

Attachments are frequently the most data-dense elements in an email export. Spreadsheets with employee records, PDFs of contracts with personal details, presentations referencing clients by name — each attachment requires its own redaction pass. A single email with five attachments effectively represents six documents to review.

SafeRedact's Email Processing Pipeline

SafeRedact processes email exports with format-specific handling for the structure of email data. The system parses email headers to identify and redact third-party addresses in To, CC, BCC, and From fields while preserving the data subject's address. Body content is analyzed through the multi-layer detection engine — regex patterns catch structured identifiers while AI analysis identifies contextual personal data.

Because SafeRedact processes the full text of each email — including all signature blocks repeated throughout a thread — PII in signatures receives the same detection treatment as body content. The multi-layer engine catches names, phone numbers, and addresses in signatures just as it does in message text, avoiding the common manual-review problem of inconsistent redaction across different sections of an email. Attachments travel with the messages: files embedded in a PST archive or inside individual EML messages are extracted and processed through the appropriate file-type handler, and when Purview also saves attachments as separate files in the export, those are processed independently as well. The exception is attachments embedded inside individual MSG files, whose content is not scanned, so prefer PST or EML exports when attachments matter.

Microsoft, Microsoft 365, Office 365, Teams, SharePoint, Exchange Online, OneDrive, Outlook, and Purview are trademarks of Microsoft Corporation. SafeRedact is not affiliated with or endorsed by Microsoft.