In plain English
OneDrive for Business gives every Microsoft 365 user their own cloud storage for work files. Files saved to OneDrive sync automatically to Windows laptops and can be accessed from any device. From a security perspective, OneDrive is covered by Purview DLP and sensitivity label policies, and Microsoft Defender for Office 365 scans files uploaded to OneDrive for malware.
Full definition
Every user gets their own OneDrive for Business storage, separate from team sites. Files saved there sync automatically to Windows laptops via the OneDrive sync client, so staff can work offline and changes push to the cloud when they reconnect. From a user perspective it behaves like a local folder. From a security perspective it is cloud storage covered by your tenant's data governance policies.
policies and apply to OneDrive the same way they apply to SharePoint and Teams. If a staff member saves a document containing a Medicare number or passport data and tries to share it externally, a DLP policy can block or flag that action. scans files uploaded to OneDrive for . Versioning is on by default, so that encrypts files on a synced device does not necessarily destroy the cloud copies: Microsoft retains version history that can be restored, though the restoration window depends on your licensing tier.
The Australian Privacy Act places obligations on organisations to protect they hold, and files sitting in OneDrive fall squarely within scope. A Notifiable Data Breaches scenario can arise if OneDrive sharing permissions are misconfigured and files containing personal data become accessible outside the organisation. Auditing OneDrive sharing settings, particularly links shared with "Anyone with the link" permissions, is a routine step in any Microsoft 365 security review and one that consistently surfaces unexpected exposure.