Dynamics 365 is a CRM and ERP in one cloud. That only works if security and GDPR are not a slide deck. Roles, encryption and a way to change the system without breaking Friday afternoon are the real product.
Access and encryption
Role-based access decides who sees a record. Encryption covers data at rest and in transit. Microsoft patches the platform; you still own who has a licence and who can export a list.
GDPR tools
Classification, DLP, audit logs and Data Subject Rights are built in. EU data residency exists so EU personal data can stay in the EU. The Compliance Manager is a scoreboard, not a substitute for a process when someone asks to be deleted.
Change in live systems
Power Apps and Power Automate let non-developers extend processes. APIs and plug-ins do the rest. Test in a sandbox. Ship with version control. Never edit production “just this once”.
Habits that keep you safe
Review roles on a calendar. Watch the audit log. Train the people who click export. Microsoft runs the cloud. You run the keys.
