---
title: "Priivacy Reports — Sample HIPAA, GDPR & PCI DSS Outputs"
url: https://uscdata.com/priivacy/reports
description: "Sample Priivacy HTML reports across HIPAA, GDPR, and PCI DSS, with executive, compliance, privacy exposure, and estate-wide views."
lang: en-US
---

What you walk away with

# Sample reports across HIPAA, GDPR, and PCI DSS.

Priivacy exports standalone HTML reports designed for the people who'll actually read them — boards, executives, IT teams, and compliance officers. Each sample below uses anonymised ACME INC data and shows how the same evidence can be framed for different regulatory obligations.

See sample reports →
Book a demo to walk through them live: https://uscdata.com/contact

The priivacy Rating

## One headline score. Five privacy pillars. Trended over time.

Every Priivacy estate gets a single 0-100 score — the priivacy Rating. Think Bitsight for privacy. It blends five weighted pillars into one defensible number with a tier badge for quick read. Recomputes automatically every time a scan completes; trajectory chart shows movement over time.

priivacy Rating

82

Healthy

Methodology v1.2

Tier badges Strong Healthy (75+) Concerning Critical

Methodology version is pinned to each rating so historical scores stay comparable when the methodology evolves.

### Sensitive Data

30%

Volume and severity of sensitive PII findings.

### Access Exposure

30%

Files with broken inheritance, anonymous shares, oversharing.

### Retention & Hygiene

15%

Stale data, ROT (redundant/obsolete/trivial), aged files with PII.

### Ownership

15%

Orphaned content, phantom owners, off-boarded user data.

### External Sharing

10%

Guest access, external collaborators, oversharing trends.

The sample report set

## Built for the audiences who actually read them.

Sample preview

### Privacy Exposure Assessment

CEOs, CFOs, executive committees, business owners — any organisation that needs a single defensible deliverable

The primary client deliverable. Jurisdiction-aware narrative, risk posture, compliance impact, PII exposure breakdown, file analysis, retention warnings, and prioritised actions.

HIPAA sample: https://uscdata.com/sample-reports/privacy-exposure-assessment-hipaa.html
GDPR sample: https://uscdata.com/sample-reports/privacy-exposure-assessment-gdpr.html

Sample preview

### Compliance Deep-Dive

GRC team, compliance officers, auditors, regulator-facing

Maps findings to the selected framework — including GDPR, HIPAA, PCI DSS, APP, CCPA/CPRA, and others. Article-level risk, evidence per article, and recommended actions. The deliverable for a regulator or audit review.

HIPAA sample: https://uscdata.com/sample-reports/compliance-hipaa.html
GDPR sample: https://uscdata.com/sample-reports/compliance-gdpr.html
PCI DSS sample: https://uscdata.com/sample-reports/compliance-pci-dss.html

Sample preview

### Estate Exposure

IT teams, data stewards, department heads

Shows where personal data concentrates across sources, owners, document types, data age, and PII combinations. The detailed view for the people doing the remediation work.

HIPAA sample: https://uscdata.com/sample-reports/estate-exposure-hipaa.html
GDPR sample: https://uscdata.com/sample-reports/estate-exposure-gdpr.html

Sample preview

### Executive Overview

Boards, trustees, ELT briefings

The leadership summary. Risk headline, posture, what was found, compliance impact, and top actions. Designed to fit an executive pack without losing the evidence trail.

HIPAA sample: https://uscdata.com/sample-reports/executive-overview-hipaa.html
GDPR sample: https://uscdata.com/sample-reports/executive-overview-gdpr.html

Reports can be generated for a single scan, one source, or an estate-wide view. Pick the scope and framework that match your audience.

## A separate report for tenant configuration risk.

PII scans answer "where is sensitive data?" The Privacy Posture report answers "how is the tenant configured to protect that data?" 35 read-only tests run across Microsoft 365 — SharePoint (13), OneDrive (3), Exchange (7), Entra ID / Identity (5), and PII-aware compliance (7). Seven of the 35 tests cross-reference tenant exposure against the sensitive data actually found in your environment, so an anonymous sharing link only fires as a real finding when it's actually sitting on a file containing PII, not just a theoretical risk.

The report grades your tenant on a five-tier scale — Healthy, Generally Healthy, Review Recommended, Attention Needed, Action Required — and lists every affected item with step-by-step remediation guidance.

Request a Posture walkthrough: https://uscdata.com/contact

## Regulator-grade Subject Access disclosures, on demand.

When a data subject files a Subject Access Request under GDPR Article 15 or the Australian Privacy Act APP 12, Priivacy generates the response pack for you.

### SAR Export — Quick response

A streamlined GDPR Article 15 PDF dossier generated per individual from existing estate scans. Cover, summary, processing purposes, evidence table with redacted snippets, third-party masking, rights boilerplate. Audit log captures every generation.

### DSAR Workflow — Full statutory pipeline

The full 10-stage workflow for incoming statutory requests. Identity verification, jurisdiction-locked, Graph search across mailboxes and SharePoint, AI-assisted triage via local LLM, per-finding DPO decisions, sealed PDF dispatch. Every stage audit-logged and regulator-defensible.

## Every export. Every format. No vendor lock-in.

Beyond the interactive reports, Priivacy generates raw exports for downstream systems and analysis. Use the right one for your audience.

Findings CSV

Every detected PII finding with sensitivity, identifiability, and risk level.

Findings JSON

Same data, structured for downstream tools.

Compliance Report CSV

Audit ledger of every file touched, no raw PII values, safe to share with auditors.

Compliance Report JSONL

Same audit ledger in JSONL format with a summary header.

Duplicates CSV

Same-content files grouped across the estate.

Affected Persons CSV

Identity-resolved person profiles from the Persons tab.

Full Scan JSONL

Flat one-record-per-file format with raw PII values for re-import or detection tuning. Share with care.

## Your reports. Your branding. Your distribution.

### Standalone HTML

Every interactive report exports as a single self-contained HTML file. No login required. Opens offline in any browser. Travels by email. Print-to-PDF works out of the box — the print stylesheet forces every collapsible section open so the printed copy is complete.

### Schedulable

Any scan can be set on a recurring schedule (daily, weekly, monthly, or interval). Each run produces a fresh standalone report. Useful for board cycles, audit reviews, or executive standups.

### Brandable

Reports can be re-branded with your institution's logo and color scheme. Useful when forwarding to boards or auditors who expect to see your branding, not ours.

## Common questions about reporting.

### Can we keep the reports if we don't extend or upgrade?

### Can we generate reports ourselves, or does USC Data run them for us?

### Can we schedule recurring reports?

### Are the reports editable?

### What's the difference between the Compliance Report and the Full Scan JSONL?

## Want to see the reports against your own data?

The fastest way to evaluate Priivacy is to see a Discovery report generated against a sample of your real environment. Our team can run a scoped scan against one department, one mailbox, or one file share and walk you through the output. Forty-five minutes. No commitment.

Book a sample Discovery →: https://uscdata.com/contact

Email connect@uscdata.com: connect@uscdata.com

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "Can we keep the reports if we don't extend or upgrade?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. Every report your team generates is yours to keep. HTML files have no DRM and no expiration. PDFs are PDFs."
        }
      },
      {
        "@type": "Question",
        "name": "Can we generate reports ourselves, or does USC Data run them for us?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Your team generates them. Any user with the right role can produce any report. Standard reports render in seconds against a typical environment."
        }
      },
      {
        "@type": "Question",
        "name": "Can we schedule recurring reports?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes. Any scan can be put on a recurring schedule, and the reports can be exported automatically on each run."
        }
      },
      {
        "@type": "Question",
        "name": "Are the reports editable?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "The underlying data is fixed — that's what makes them defensible. Branding, logos, color schemes, and which sections to include are configurable per report."
        }
      },
      {
        "@type": "Question",
        "name": "What's the difference between the Compliance Report and the Full Scan JSONL?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Compliance Report is the audit ledger — every file we touched and what we did with it, no raw PII values, safe to share with auditors. Full Scan JSONL is the detection-engine interop format — raw PII values for re-import or detection tuning. Treat the JSONL with care; it contains the actual sensitive content."
        }
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uscdata.com/#organization",
    "name": "USC Data",
    "url": "https://uscdata.com/",
    "logo": "https://uscdata.com/usc-data-logo.png",
    "description": "USC Data cleans, governs, and restructures business data so AI, Copilot, audits, automation, and growth are safe — not risky.",
    "founder": {
      "@type": "Person",
      "name": "Shane Reid"
    },
    "email": "connect@uscdata.com",
    "telephone": "+1-844-988-1444",
    "sameAs": [
      "https://www.linkedin.com/company/usc-data"
    ],
    "address": {
      "@type": "PostalAddress",
      "streetAddress": "7700 Windrose",
      "addressLocality": "Plano",
      "addressRegion": "TX",
      "postalCode": "75024",
      "addressCountry": "US"
    },
    "areaServed": [
      {
        "@type": "Country",
        "name": "United States"
      },
      {
        "@type": "Country",
        "name": "Australia"
      },
      {
        "@type": "Country",
        "name": "United Kingdom"
      },
      {
        "@type": "Country",
        "name": "New Zealand"
      }
    ],
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "telephone": "+1-844-988-1444",
        "email": "connect@uscdata.com",
        "areaServed": [
          "US",
          "CA"
        ],
        "availableLanguage": [
          "en"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "telephone": "+61-1300-80-95-80",
        "email": "connect@uscdata.com",
        "areaServed": [
          "AU",
          "NZ"
        ],
        "availableLanguage": [
          "en"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "customer support",
        "email": "connect@uscdata.com",
        "availableLanguage": [
          "en"
        ]
      }
    ],
    "knowsAbout": [
      "Data Governance",
      "PII Discovery",
      "Data Quality",
      "Metadata Management",
      "Data Integration",
      "Data Migration",
      "Compliance",
      "AI Readiness"
    ]
  }
]
```