Which Microsoft products and interactions this statement covers
This statement covers the interactions Microsoft has with you and the Microsoft products it lists, plus other Microsoft products that display the statement. "Products" is defined broadly to include services, websites, apps, software, servers and devices, across consumer, school, enterprise and developer uses. The page is marked as last updated in September 2026. The statement says the product-specific sections add relevant information, so a general rule here should be read together with the section for the product you use.
Supporting quotations
Last Updated: September 2026
References to Microsoft products in this statement include Microsoft services, websites, apps, software, servers, and devices.
This statement applies to the interactions Microsoft has with you and the Microsoft products listed below, as well as other Microsoft products that display this statement.
This privacy statement explains the personal data we process, how we process it, and for what purposes.
Qualifications & exceptions
Applies to the products it lists and to other Microsoft products that display this statement.
Product-specific sections give additional details; they are not replaced by this opening summary.
Not stated here
The opening text does not say which product-specific sections would change a general rule for a given product.
Legal Rights & Agreement Rules · Company commitment
Microsoft says it complies with the EU-U.S., UK and Swiss-U.S. data privacy frameworks
Microsoft states that it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, and directs readers to the Storage and processing of personal data section and the U.S. Department of Commerce framework website to learn more. The opening paragraph does not say which data or which Microsoft entities the frameworks cover; that detail is in the later section.
Supporting quotations
Microsoft complies with the EU-U.S., UK Extension to the EU-U.S., and Swiss-U.S. Data Privacy Frameworks.
Qualifications & exceptions
Details of the commitment are in the Storage and processing of personal data section.
Not stated here
This paragraph does not say which Microsoft entities or which categories of data the frameworks cover.
Legal Rights & Agreement Rules · Procedure
How to reach the Microsoft privacy team or Data Protection Officer
To raise a privacy concern, complaint or question with the Microsoft privacy team or its Data Protection Officer, the statement tells you to use the privacy support and requests page and choose the option to contact the privacy team or Data Protection Officer. For more about contacting Microsoft, including Microsoft Ireland Operations Limited, it points to the How to contact us section.
Supporting quotations
If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer
click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu
Qualifications & exceptions
The route given here is a web page and menu option, not an address or a deadline.
Not stated here
The paragraph states no response time.
Legal Rights & Agreement Rules · Context
U.S. individuals are pointed to a state privacy notice and a consumer health data policy
For people in the United States, the statement refers you to two separate documents for additional information about your rights and how your personal data is processed: the U.S. State Data Privacy Notice (which includes notice-at-collection details) and the Consumer Health Data Privacy Policy. Those two documents are linked, not supplied in this saved statement, so their contents are not analyzed here.
Supporting quotations
For individuals in the United States, please refer to our
for additional information about your rights and the processing of your personal data
Qualifications & exceptions
Applies to individuals in the United States.
Not stated here
The U.S. State Data Privacy Notice and the Consumer Health Data Privacy Policy are linked but not part of the supplied text, so the rights and limits they set are unknown here.
Legal Rights & Agreement Rules · Context
Children and organization-provided products are handled in separate sections
The opening text tells readers that details about personal data collected from children are in the Collection of data from children section, with a separate page for young people. For businesses, schools and other organizations that use Microsoft products, it points to the Enterprise and developer products section. If your product or Microsoft account is provided by your organization, it points to the Products provided by your organization and Microsoft account sections. Those rules are not set out in this opening text.
Supporting quotations
You can find details about personal data collected from children in the
Please see the Enterprise and developer products section of this privacy statement for more information about how we process data from organizations that use our products and services, like businesses and schools.
If you use a Microsoft product or a Microsoft account provided by your organization
Qualifications & exceptions
These are pointers; the operative rules are in the named sections.
Legal Rights & Agreement Rules · Company practice
Microsoft processes data on consent, necessity, legal duty, safety or legitimate interests
Microsoft says it processes your personal data with your consent and/or when it is necessary to provide the products you use, operate its business, meet contractual and legal obligations, protect the security and safety of its systems and customers, or pursue its legitimate interests or those of third parties. The legal basis may vary depending on how and across what products or services data is processed. When relying on legitimate interests, it says it balances them against your rights and freedoms and processes data only if those interests are not outweighed by yours.
Supporting quotations
We process your personal data with your consent and/or when it’s necessary to provide the products you use, operate our business, meet our contractual and legal obligations, protect the security and safety of our systems and our customers, or pursue our legitimate interests or those of third parties.
Our legal basis for processing may vary depending on how and across what products or services we process your data.
will only process your data if these interests are not outweighed by your own
Qualifications & exceptions
The basis may vary by product and type of processing.
Legitimate-interest processing is conditioned on the balancing test.
Legal Rights & Agreement Rules · Company commitment
Microsoft Corporation certifies to the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks
Microsoft Corporation says it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce. It says it has certified that it adheres to the EU-U.S. principles for personal data received from the European Union and from the United Kingdom (and Gibraltar), and to the Swiss-U.S. principles for personal data received from Switzerland. The controlled U.S. subsidiaries identified in its self-certification also adhere to the principles; the list of covered entities is linked, not supplied here.
Supporting quotations
Microsoft Corporation complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF
with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF
The controlled U.S. subsidiaries of Microsoft Corporation, as identified in our self-certification submission, also adhere to the DPF Principles
Qualifications & exceptions
The commitment is by Microsoft Corporation and the U.S. subsidiaries named in its certification.
Not stated here
The list of covered U.S. entities is linked but not part of the supplied text.
Legal Rights & Agreement Rules · Company commitment
Under the framework Microsoft stays liable for agents, and the framework principles prevail over this statement
For onward transfers, Microsoft Corporation says it is responsible for processing personal data it receives under the framework and then transfers to a third party acting as its agent. It remains liable under the framework if the agent processes such data inconsistently with it, unless Microsoft can prove it is not responsible for the event giving rise to the damage. If there is any conflict between this privacy statement and the EU-U.S. or Swiss-U.S. framework principles, the principles govern.
Supporting quotations
In the context of an onward transfer, Microsoft Corporation has responsibility for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on our behalf.
Microsoft Corporation remains liable under the DPF if our agent processes such personal data in a manner inconsistent with the DPF, unless Microsoft Corporation can prove that we are not responsible for the event giving rise to the damage.
If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.
Qualifications & exceptions
Liability applies to agents acting on Microsoft's behalf, with an exception if Microsoft proves it is not responsible.
The principles govern in a conflict with this statement.
Legal Rights & Agreement Rules · Procedure
Framework complaints go to Microsoft, then EU, UK or Swiss authorities, with binding arbitration as a last resort
For a question or complaint about Microsoft's participation in the Data Privacy Frameworks, Microsoft encourages contacting it through the privacy support and requests page. For complaints it cannot resolve directly, it has chosen to cooperate with the relevant EU Data Protection Authority or a panel of European data protection authorities for EU individuals, the UK Information Commissioner for UK individuals, and the Swiss Federal Data Protection and Information Commissioner for Swiss individuals, and will direct you to your authority's contacts if asked. Under the framework principles, binding arbitration is available for residual complaints not resolved by other means. Microsoft says it is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
Supporting quotations
we encourage you to contact us via our
we have chosen to cooperate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities, for resolving disputes with EU individuals, the UK Information Commissioner for resolving disputes with UK individuals, and the Swiss Federal Data Protection and Information Commissioner (FDPIC) for resolving disputes with Swiss individuals
binding arbitration is available to address residual complaints not resolved by other means
Microsoft is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).
Qualifications & exceptions
Applies to EU, UK and Swiss individuals for framework-related complaints.
Binding arbitration is for residual complaints not resolved by other means.
Legal Rights & Agreement Rules · Context
Individuals in Japan are pointed to Japanese-language references on data protection and telecommunications law
For individuals whose data is protected by Japan's Act on the Protection of Personal Information, the statement refers to an article on the Japanese Personal Information Protection Commission's website, published only in Japanese, about the commission's review of certain countries' data protection systems. For individuals in Japan it also links to a notice, in Japanese only, about the processing of information under the Telecommunications Business Act. Neither linked document is supplied here.
Supporting quotations
Individuals whose personal data is protected by Japan’s Act on the Protection of Personal Information should refer to the article on the
For individuals in Japan, please click
Qualifications & exceptions
Applies to individuals in Japan.
Not stated here
The linked Japanese-language article and notice are not part of the supplied text.
Legal Rights & Agreement Rules · Company commitment
Microsoft says it adheres to the NAI framework and to DAA, EDAA and DAAC advertising programs
Microsoft states that it participates in industry self-regulatory programs and adheres to the NAI Self-Regulatory Framework. It also lists the Digital Advertising Alliance in the US, the European Interactive Digital Advertising Alliance in Europe, and the Digital Advertising Alliance of Canada. Those programs' rules are not supplied here.
Supporting quotations
Microsoft participates in industry self-regulatory programs and adheres to the
In the US:
In Europe:
In Canada:
Not stated here
The self-regulatory frameworks' requirements are not part of the supplied text.
Legal Rights & Agreement Rules · Company commitment
Microsoft updates the statement when needed, and gives prominent notice of material changes before they take effect
Microsoft updates the statement when necessary, for example in response to feedback, product changes, changes in its data processing or policies, or changes in law. When it posts changes it revises the last updated date and describes the changes on a Change history page. If there are material changes, such as a change to the purposes of processing that is not consistent with the original purpose for collection, it says it will give prominent notice before the change takes effect. It encourages you to review the statement periodically.
Supporting quotations
We update this privacy statement when necessary and to provide greater transparency
we will revise the "last updated" date at the top of the statement and describe the changes on the
If there are material changes to the statement, such as a change to the purposes of processing personal data that is not consistent with the original purpose for collection, we will provide prominent notice of the change before it takes effect.
We encourage you to periodically review this privacy statement for updates.
Qualifications & exceptions
Prominent advance notice is promised for material changes; other changes are shown by the updated date and the Change history page.
Legal Rights & Agreement Rules · Company commitment
Microsoft promises a response within 30 days, and you can also complain to a data protection authority
To raise a privacy concern, complaint or question with the privacy team or the Data Protection Officer for your region, you use the privacy support and requests page and its contact menu. Microsoft says it will respond to questions or concerns within a period of no longer than 30 days or where otherwise required by law. You can also raise a concern or lodge a complaint with a data protection authority or other official with jurisdiction.
Supporting quotations
If you have a privacy concern, complaint, or question for the Microsoft privacy team or the Data Protection Officer for your region, please visit our
We will respond to questions or concerns within a period of no longer than 30 days or where otherwise required by law.
You can also raise a concern or lodge a complaint with a data protection authority or other official with jurisdiction.
Qualifications & exceptions
The 30-day response is a maximum "or where otherwise required by law".
Legal Rights & Agreement Rules · Context
Microsoft Corporation, and Microsoft Ireland Operations Limited for EEA, UK and Swiss users, are the data controllers
When Microsoft is a controller, unless otherwise stated, Microsoft Corporation is the data controller for personal data collected through the products subject to this statement. For those in the European Economic Area, the United Kingdom and Switzerland, Microsoft Ireland Operations Limited is also named as a data controller. The statement gives a Redmond, Washington address and phone number for Microsoft Privacy, an address and phone number in Dublin for the Data Protection Officer of Microsoft Ireland Operations Limited, a link to find the subsidiary in your country, and Microsoft Schweiz GmbH as the representative of Microsoft Ireland Operations Limited under the Swiss Federal Act on Data Protection.
Supporting quotations
When Microsoft is a controller, unless otherwise stated, Microsoft Corporation and, for those in the European Economic Area, the United Kingdom, and Switzerland, Microsoft Ireland Operations Limited are the data controllers for personal data we collect through the products subject to this statement.
Microsoft Privacy, Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA.
Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
The representative of Microsoft Ireland Operations Limited within the meaning of Art. 14 of the Swiss Federal Act on Data Protection is Microsoft Schweiz GmbH
Qualifications & exceptions
Applies "when Microsoft is a controller, unless otherwise stated".
Legal Rights & Agreement Rules · Context
Enterprise and developer products are those designed mainly for organizations and developers
Enterprise and Developer Products are Microsoft products and related software offered to and designed primarily for use by organizations and developers. They include enterprise online services such as Microsoft 365, Azure, Dynamics 365 and Intune; other enterprise and developer cloud services; enterprise and developer software such as Windows Server, SQL Server and Visual Studio; appliances and hardware used for storage infrastructure; and professional services available with the enterprise online services.
Supporting quotations
Enterprise and Developer Products are Microsoft products and related software offered to and designed primarily for use by organizations and developers.
such as Microsoft 365, Microsoft Azure, Microsoft Dynamics 365, and Microsoft Intune
Other enterprise and developer cloud-based services
Other enterprise and developer software, such as Windows Server, SQL Server, Visual Studio, System Center, Azure Stack
Appliances and hardware used for storage infrastructure
Professional services referred to in the Product Terms that are available with Enterprise Online Services
Qualifications & exceptions
The lists are given as examples.
Legal Rights & Agreement Rules · Restriction or exception
For enterprise and developer products, a customer's agreement with Microsoft controls over this statement
If this privacy statement conflicts with the terms of any agreement between a customer and Microsoft for Enterprise and Developer Products, the terms of the agreement control. Features and settings that affect privacy, for you or your end users, are described in the product documentation. This means the privacy statement is not the final word for enterprise customers or their end users; the customer's contract is, and it is not supplied here.
Supporting quotations
In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control.
You can also learn more about our Enterprise and Developer Products’ features and settings, including choices that impact your privacy or your end users’ privacy, in product documentation.
the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control
in product documentation
Qualifications & exceptions
Applies where a customer has an agreement with Microsoft for Enterprise and Developer Products.
Not stated here
The customer agreements and product documentation are not part of the supplied text.
Cross-references
qualifies (model-proposed): Which Microsoft products and interactions this statement covers — qualifies: The opening says the statement applies to listed products; for enterprise and developer products a customer agreement controls over it in a conflict.
Legal Rights & Agreement Rules · Context
Enterprise online services process data under the Product Terms, the Data Protection Addendum and the Trust Center
To provide Enterprise Online Services, Microsoft says it processes, uses and stores data as described in the Product Terms, the Microsoft Products and Services Data Protection Addendum and the Microsoft Trust Center. Those documents are linked, not supplied here, so what they provide is unknown.
Supporting quotations
To provide our Enterprise Online Services, Microsoft processes, uses, and stores data as described in the
Not stated here
The Product Terms, Data Protection Addendum and Trust Center are linked but not part of the supplied text.
Legal Rights & Agreement Rules · Restriction or exception
Other Microsoft translation services have different privacy practices than Microsoft Translator
Separate Microsoft translation services offered as features in other products and services have different privacy practices than Microsoft Translator. For the Azure Cognitive Services Translator Text API, Custom Translator and Translator Speech API, the statement points to the Enterprise and developer products section, and for the Translate feature in Microsoft 365 apps to the Productivity and communications products section.
Supporting quotations
Separate Microsoft translation services are available as features in other Microsoft products and services that have different privacy practices than Microsoft Translator.
Legal Rights & Agreement Rules · Context
LinkedIn's data practices are covered by LinkedIn's own privacy policy
For the data LinkedIn collects and how it is used and shared, the statement refers you to LinkedIn's Privacy Policy rather than describing those practices itself. That policy is linked, not supplied here.
Supporting quotations
To learn about the data LinkedIn collects and how it is used and shared, please see LinkedIn’s
Not stated here
LinkedIn's Privacy Policy is not part of the supplied text.