Microsoft modified its data retention policy language on April 19, 2026. Previously, the policy described specific retention criteria including whether customers expected data to be retained until they removed it, and whether automated deletion controls existed. The updated language simplifies retention guidance by stating that Microsoft retains personal data to provide services, fulfill transactions, and for legitimate purposes including legal obligations, business operations, and dispute resolution. The revised policy removes granular examples (like email deletion procedures) and instead directs users to product documentation, while adding new retention justifications around improving products, protecting systems, and customer safety.
Consumers: Microsoft can now point to more reasons to keep your data, not just legal requirements and fulfilling what you asked for.
Data controllers: Organizations must check individual product policies to understand how long data is actually retained, rather than relying on a central privacy policy.
The updated policy establishes additional grounds on which Microsoft may retain personal data. While the prior version tied retention to specific user expectations and available deletion controls, the revised language authorizes retention for 'operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes.' This expands the stated purposes beyond transaction fulfillment and legal compliance. The updated policy directs users to product-specific documentation for retention details rather than providing explicit deletion procedures and timelines in the privacy statement itself.
→ Review product-specific retention documentation for services you use (OneDrive, Outlook.com, etc.) to understand actual data deletion timelines.
→ Check your account settings in Microsoft privacy dashboard for any available controls over data retention or automatic deletion of old data.
ConductAtlas has recorded 4 material changes to this document over 44 days of monitoring (since March 2026). An additional minor or cosmetic changes were excluded.
4 of Microsoft's significant changes have been classified as negative for consumers.
Expanded from legal compliance and transaction fulfillment to include business operations, product development, safety, and dispute resolution.
Changed from explicit policy statement of deletion procedures and storage limits to delegation to product-specific documentation.
Added explicit authorization to use auto-dialer and AI-generated voice for marketing calls to consenting phone numbers.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
This change broadens the stated legal bases for data retention across Microsoft's product portfolio. The updated language adds operational and business development justifications alongside legal obligations. Organizations evaluating Microsoft as a vendor should review product-specific …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001079.
Microsoft updated its Privacy Statement in an update detected on August 1, 2026, making changes primarily to document structure, formatting, …
Microsoft's privacy policy table of contents was updated on June 30, 2026, with a single sentence modification. The specific textual …
Microsoft's Privacy Statement table of contents was reorganized on June 28, 2026. Several product and feature references were relocated or …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.