What Microsoft Viva Insights actually monitors
Viva Insights is Microsoft’s workplace analytics product, included with M365 Business Premium, E3, and E5 licences. It analyses signals from M365 services — primarily Exchange (email and calendar), Teams, and SharePoint — to surface insights about how employees and teams work.
The core analytics capabilities:
- Collaboration load: How many hours per week employees spend in meetings, calls, and email. Viva Insights surfaces “meeting overload” signals and helps managers understand where time goes.
- Focus time: Uninterrupted blocks in the calendar not occupied by meetings. Viva Insights can reserve focus blocks and track whether employees have adequate deep-work time.
- Network analytics: Who employees collaborate with most, how broad their internal network is, and whether they have adequate connection to senior leaders and cross-functional peers.
- Manager insights: How frequently managers meet with direct reports, response time to emails, and team engagement patterns inferred from M365 signal density.
- Wellbeing signals: After-hours email volume, weekend work patterns, and recovery time. Viva Insights surfaces these to encourage managers to model healthy work patterns.
These are genuinely useful metrics. For M365-heavy organisations, Viva Insights is a low-friction way to get a baseline view of how teams spend their time — without installing an additional agent or reconfiguring existing tools. The problem for India IT teams is not the analytics themselves; it is the compliance architecture that wraps them.
The DPDP compliance gap: three structural issues
India’s DPDP Act 2023 established specific requirements for how employers collect, process, and manage employee data. Viva Insights was not designed to satisfy these requirements. Here are the three structural gaps that India IT legal and compliance teams consistently flag:
1. Data residency outside India
Microsoft processes M365 data in regional data centres assigned at tenant creation. For Indian M365 tenants, the assigned geography is typically Asia Pacific — meaning Singapore, Hong Kong, or Japan data centres — not India. Microsoft has expanded its India data centre regions (Central India, South India, West India) for several core M365 workloads, but Viva Insights data processing geography is not guaranteed to align with the India region for all tenants.
Under DPDP Act 2023, the Rules on data localisation and cross-border transfer restrictions for specific categories of personal data are expected to be notified separately. However, given the direction of DPDP rulemaking — and the parallel precedent of SEBI and RBI data localisation mandates for their regulated sectors — India IT teams with formal compliance programmes should verify and document the exact data residency of every employee monitoring tool in their stack, including Viva Insights. Verify with counsel.
2. No DPDP consent collection workflow
DPDP Act 2023 Sections 5 and 6 require employers to obtain informed, specific, and freely given consent from employees before processing their personal data for monitoring purposes, and to provide a clear privacy notice before or at collection. The consent must be granular (separately given for each processing purpose), revocable, and as easy to withdraw as to give.
Viva Insights does not provide a configurable DPDP consent workflow. Microsoft’s data processing is governed by the M365 Data Processing Agreement (DPA) and Microsoft’s Privacy Statement, which operate between Microsoft and the enterprise customer — not between the employer and the individual employee. The employee does not give DPDP-format consent to Viva Insights monitoring; they agree to the employer’s general employment terms. Whether that constitutes adequate DPDP consent for workforce monitoring analytics is a compliance question that must be answered by counsel, not assumed from the M365 subscription.
3. No Data Principal rights management
DPDP Chapter II grants employees (as Data Principals) the rights to access their personal data, request corrections, request erasure, and nominate a successor to exercise data rights. Employers must have a mechanism to receive, track, and respond to these requests.
M365 provides General Data Protection tools via the Microsoft 365 Compliance Centre (Purview), which supports some data subject request workflows for GDPR. However, these are not tailored for DPDP Data Principal rights, do not provide an India-specific employee-facing portal for filing requests, and do not generate the type of audit trail that demonstrates DPDP compliance to the Data Protection Board of India in an enforcement review. For the purposes of DPDP compliance, employers need a system designed specifically for DPDP obligations — not GDPR tools repurposed for India.
For a full breakdown of what DPDP requires from employee monitoring vendors, see the DPDP Act India workforce monitoring buyer guide.
10-criterion comparison: Microsoft Viva Insights vs gStride for India
This table maps both products against the ten compliance and capability criteria that matter most for India IT, GCC, and BPO buyers. All Viva Insights claims are based on publicly available Microsoft product documentation and privacy policies as of June 2026 — verify current product capabilities and data residency with Microsoft before acting on this comparison.
| Criterion | Microsoft Viva Insights | gStride AI |
|---|---|---|
| Data residency (India) | Processed in M365 regional data centres; no dedicated India Viva Insights data centre as of June 2026. Residency depends on tenant geography — verify current configuration in your M365 admin centre and Microsoft’s data residency documentation. | India-region deployment with data residency in India. Employee data processed and stored on India cloud infrastructure. |
| DPDP consent workflow | No dedicated per-employee DPDP consent collection, management, or revocation feature. Governed by enterprise M365 DPA between Microsoft and the employer organisation. | Built-in DPDP consent management with per-employee consent ledger, granular purpose-based consent, and revocation with audit record. |
| DPDP Section 5 privacy notice | Standard Microsoft Privacy Statement; no employer-configurable DPDP-format notice to employees for workforce monitoring activity as required by DPDP Act 2023 Section 5. | Configurable DPDP employee notice with employer-specific purpose, retention period, and rights information; employee-facing transparency portal. |
| Data Principal rights handling | M365 Compliance Centre (Purview) supports some GDPR-style data subject requests; not India DPDP-specific; no dedicated employee-facing portal for DPDP access, correction, erasure, or nomination requests. | Dedicated Data Principal rights request portal; employees file access, correction, erasure, and nomination requests directly; automated response workflow with statutory timeline tracking. |
| Grievance officer feature | Microsoft’s global Data Protection Officer contact; no India-specific employment data grievance workflow or named India grievance officer mechanism as required by DPDP Act 2023 Section 13. | Built-in grievance mechanism; employer configures a named grievance contact with response tracking; employee-facing interface for submitting and tracking grievances. |
| DPDP audit trail | M365 audit logs available (M365 E3/E5 required for full audit history); logs are IT security–oriented, not structured for DPDP processing-activity demonstration to the Data Protection Board of India. | Tamper-evident processing activity log structured for DPDP audit and regulatory demonstration; exportable for compliance reviews. |
| EU AI Act readiness | Microsoft has published conformity documentation for M365 products under EU AI Act. Annex III classification of specific Viva Insights features depends on use case and deployment configuration — verify with Microsoft and counsel. | Output-signal model with mandatory human oversight; designed to operate outside Annex III high-risk scope when used as an advisory tool rather than an automated decision engine. |
| Data capture surface (DPDP risk) | M365 signal analytics: email metadata, calendar, Teams usage, SharePoint activity. No screenshots or keystrokes. Medium DPDP capture surface for the signals it analyses. | Outcome signals: deliverable velocity, ticket closure, repository activity, calendar participation. No screenshots, keystrokes, or biometric data. Low DPDP classification risk. |
| India pricing | Included with M365 Business Premium, E3, and E5. No additional standalone cost if licence tier already includes Viva Insights. Not separately available in INR as a standalone product. | INR-denominated pricing; India-specific SMB and enterprise tiers; standalone deployment without M365 dependency. |
| Implementation for India IT | Integrated with M365 tenant; minimal additional setup for existing M365 customers. Admin-enables features at the tenant level. No India-specific onboarding programme. | 2–4 week deployment; integrates with HRMS, Jira, GitHub, GitLab, and project management tools; dedicated India implementation support team. |
This comparison is based on publicly available product documentation as of June 2026. Microsoft product capabilities, data residency configurations, and DPDP compliance posture change; verify current specifications with Microsoft before using this table for procurement decisions.
When Viva Insights is enough — and when it is not
This comparison is not an argument that every India IT team must replace Viva Insights. There are scenarios where Viva Insights is sufficient and scenarios where it is not.
Viva Insights may be sufficient if:
- You use it for optional manager self-reflection (the personal insights feature visible only to the individual employee) and do not use it for team-level surveillance, performance monitoring, or appraisal input.
- Your legal team has reviewed your M365 DPA and confirmed that the employer-employee data processing relationship for Viva Insights-specific signals is adequately covered by your existing employment terms and DPDP compliance programme.
- You are not a significant data fiduciary under DPDP and your DPDP obligations are limited to the baseline Act requirements that your existing M365 data governance covers.
Viva Insights is not sufficient if:
- You use Viva Insights signals as input to performance reviews, productivity scoring, PIP decisions, or variable-pay calculations. The moment the analytics influence an employment decision, the DPDP consent requirements become stricter and the EU AI Act Annex III classification question becomes sharper.
- Your compliance programme requires a documented DPDP consent ledger, Data Principal rights portal, and India-specific grievance trail as evidence for regulatory demonstration to the Data Protection Board of India.
- You are a GCC with dual DPDP (India workforce) and EU AI Act or GDPR (parent-company reporting) obligations. A single tool that satisfies both regulatory frameworks simultaneously reduces audit complexity.
- You are in a regulated sector (BFSI with SEBI monitoring requirements, NASSCOM-registered BPO, or healthcare entity under applicable sectoral rules) where DPDP compliance documentation must meet specific evidence standards.
For the last two categories, Viva Insights functions well as an M365 analytics layer but requires a dedicated DPDP compliance stack alongside it. The question is whether you build that stack around Viva Insights or replace Viva Insights’s analytics function with a tool that provides the compliance architecture natively. Use the DPDP Vendor Comparison Scorecard to score your current stack against 12 DPDP criteria before making that decision.
How gStride handles the DPDP requirements Viva Insights does not
gStride is built for outcome intelligence, not M365 signal analytics. The two tools are architecturally different: Viva Insights mines communication pattern signals from M365 services; gStride scores deliverable outcomes from work-product tools (Jira, GitHub, GitLab, Asana, Google Workspace). Neither is a comprehensive replacement for the other in all scenarios.
What gStride provides that Viva Insights does not, for DPDP compliance:
- India data residency: gStride’s primary deployment is on India cloud infrastructure. For GCCs and IT companies where data localisation is a board-level compliance requirement, this eliminates the residency uncertainty that comes with M365 tenant geography.
- DPDP consent ledger: Employees receive a DPDP Section 5 notice specific to gStride’s monitoring activity (what is collected, why, for how long, and how to exercise rights). Consent is recorded per employee, per processing purpose. Revocations are logged. The consent ledger is exportable for regulatory demonstration.
- Data Principal rights portal: Employees can file access, correction, erasure, and nomination requests through a dedicated interface. Responses are tracked against the timelines expected under DPDP. The employer-side admin sees all open requests and their status.
- Grievance mechanism: The employer configures a named grievance officer. Employees can submit concerns about their monitoring data through the gStride interface; the employer receives notifications and tracks response. This satisfies DPDP Section 13 requirements for a functioning grievance mechanism.
- DPDP audit trail: gStride generates a tamper-evident log of all processing activity for each employee — what data was collected, when, on what basis, and who accessed it. This log is the evidence layer for a DPDP Board inquiry.
For GCCs managing dual DPDP and EU AI Act obligations, gStride’s EU AI Act readiness documentation covers the Annex III human oversight and transparency requirements. For a detailed view of how gStride approaches the GCC dual-compliance challenge, see the GCC workforce AI solution overview.
Switching from Viva Insights to gStride: what to expect
Most India IT companies that deploy gStride are not replacing Viva Insights entirely — they are adding a DPDP-compliant productivity intelligence layer alongside M365. The practical steps:
| Week | Action | Owner |
|---|---|---|
| Week 1 | Tool integration: connect gStride to your existing HRMS, Jira or Azure DevOps, GitHub or GitLab, and Google Workspace or M365 calendar. API-based; no agent installation required on employee devices. | IT |
| Week 1 | DPDP notice deployment: configure the employee-facing DPDP Section 5 notice with your company name, the specific processing purposes gStride performs, retention period, and grievance contact. Distribute to all employees before monitoring begins. | HR / Legal |
| Week 2 | Consent collection: employees receive the DPDP notice through the gStride portal and acknowledge. Consent records are timestamped and stored in the consent ledger. Employees who do not consent are flagged (non-consenting employees are not monitored by gStride). | HR |
| Week 2 | Baseline calibration: gStride establishes role-level productivity baselines from the first 2 weeks of data. Managers are trained on how to interpret outcome signals without using them as automated performance verdicts. | HR / Managers |
| Weeks 3–4 | Live monitoring begins. Manager dashboards show team-level outcome trends. Individual signals are available to the employee through their personal gStride view. No automated decisions; all insights are advisory. | Managers |
For a cost estimate of switching — including what you save on DPDP compliance overhead by replacing ad-hoc tools with a purpose-built platform — use the Switch Cost Estimator. For a comparison of how gStride’s DPDP architecture stacks up against other vendors in the India market, see the best DPDP-compliant employee monitoring software India (2026) roundup.
For a RFP template that includes the Viva Insights vs dedicated-vendor evaluation criteria, see the DPDP vendor RFP redline template.
Score Viva Insights and gStride against 12 DPDP criteria — free
The DPDP Vendor Comparison Scorecard maps any monitoring or analytics tool against 12 DPDP-specific criteria: consent ledger, data residency, DPDP notice, Data Principal rights portal, grievance mechanism, audit trail, breach notification SLA, EU AI Act readiness, data minimisation, and three more. Run it on Viva Insights and gStride side by side in under 5 minutes. Free to score; PDF download with full 8-vendor pre-scored matrix is email-gated.
Also: the Switch Cost Estimator calculates the cost of adding DPDP-compliant monitoring alongside or instead of your current M365 analytics stack, based on your headcount and tool configuration.
Frequently asked questions
Is Microsoft Viva Insights DPDP-compliant for India employers?
Viva Insights is a capable workplace analytics tool, but it was not designed for India’s DPDP Act 2023. The three gaps India employers must evaluate: (1) data may be processed outside India depending on tenant geography; (2) no dedicated DPDP consent collection workflow; (3) no built-in Data Principal rights portal for access, correction, erasure, or nomination requests. Whether these gaps create a compliance violation for your specific organisation depends on your processing activities, size, sector, and M365 configuration. Verify with counsel before relying on Viva Insights as your sole workforce analytics tool for DPDP compliance purposes.
Where does Microsoft Viva Insights store and process Indian employee data?
Microsoft processes M365 data — including Viva Insights signals — in regional data centres assigned based on the geography selected when your M365 tenant was created. As of June 2026, Microsoft does not have a dedicated Viva Insights data centre in India. Indian M365 tenants are typically assigned to the Asia Pacific region. Verify the current data residency for your specific tenant and Viva Insights workload at Microsoft’s data residency documentation. This can change as Microsoft expands its regional infrastructure, so check current documentation rather than relying on this comparison.
What DPDP features does Viva Insights lack that Indian employers need?
The three DPDP-specific features Viva Insights does not provide as standalone capabilities: (1) a configurable DPDP Section 5 privacy notice to employees covering the Viva Insights monitoring activity specifically; (2) a Data Principal rights request portal where employees can file and track access, correction, erasure, and nomination requests; (3) an India-specific grievance mechanism with a named contact and response workflow as required by DPDP Act 2023 Section 13. Verify current product capabilities with Microsoft before acting on this comparison — product features change.
Can I use Viva Insights and gStride together, or is it one or the other?
These tools serve different purposes and many India IT teams use both. Viva Insights analyses M365 communication and collaboration patterns; gStride scores outcome signals from work-product tools. If you need formal DPDP compliance documentation — consent ledger, Data Principal rights portal, India-specific grievance trail — gStride addresses those requirements; Viva Insights alone does not. The combination gives you M365 pattern analytics plus DPDP-compliant outcome intelligence in one compliance-auditable stack.
How long does it take to switch from Viva Insights to gStride?
For a typical India IT company with 200–1,000 employees, 2–4 weeks: Week 1 for integration and DPDP notice setup; Week 2 for consent collection and baseline calibration; Weeks 3–4 for manager onboarding and live monitoring. Viva Insights data does not need to be migrated; gStride uses independent data sources. Use the Switch Cost Estimator to get a rough cost estimate for your specific team size and configuration.
Disclaimer: This article is general information, not legal advice. Microsoft Viva Insights product capabilities, data residency configurations, and compliance posture change; verify current specifications directly with Microsoft. DPDP Act 2023 obligations, consent requirements, Data Principal rights timelines, enforcement posture, and applicable Rules are subject to Data Protection Board guidance and orders. Nothing in this comparison constitutes a compliance assessment or legal opinion. Verify the lawfulness of your specific workforce monitoring stack and DPDP compliance programme with qualified counsel before acting.