You can download your data and close your account through Microsoft's privacy dashboard, but Microsoft may keep some of your data after you close your account.
Consumer impact (what this means for users)
While Microsoft provides data export and account closure tools, continued data retention for 'legitimate business purposes' after account closure is a vague carve-out that may conflict with your GDPR Article 17 right to erasure, particularly for Copilot conversation history and AI-processed data.
What you can do
⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
Export Your Data
Log in to your Microsoft account, navigate to account.microsoft.com/privacy, and use the 'Download your data' tool to export a copy of your personal data including Copilot history, search history, and other stored content before closing your account.
Close Your Account
After downloading your data, go to account.microsoft.com/account/close and follow the steps to permanently close your Microsoft account. Note that closure affects all linked services including Copilot, Xbox, OneDrive, and Outlook.
Cross-platform context
See how other platforms handle Data Export and Account Closure and similar clauses.
The right to export data and close your account is important for controlling your personal information, but the retention of data after account closure for undefined 'legitimate business purposes' could conflict with GDPR erasure rights.
View original clause language
You can export or download a copy of your data at any time using the tools available in your Microsoft account privacy dashboard. If you wish to close your Microsoft account, you may do so through your account settings. Upon account closure, Microsoft may retain certain data as required by law or for legitimate business purposes.
REGULATORY FRAMEWORK: Data export and account closure provisions implicate GDPR Arts. 17 (right to erasure), 20 (right to data portability), and 25 (data protection by design and by default), enforced by EU national DPAs and the European Data Protection Board. CCPA §§1798.100 (right to know) and 1798.105 (right to delete) are enforced by the California AG and CPPA. The UK GDPR (retained post-Brexit) imposes equivalent obligations enforced by the ICO. Canada's PIPEDA (S.C. 2000, c. 5) and Brazil's LGPD (Art. 18) provide similar rights.
🔒
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Applicable agencies
FTC
The FTC has authority under Section 5 of the FTC Act over deceptive data retention practices, including retention of personal data after account closure without adequate disclosure.
California's AG and CPPA enforce CCPA §1798.105 deletion rights, including the right to have personal data deleted after account closure without unjustified retention.
ConductAtlas Policy Archive
Entity: Microsoft Copilot | Document: Microsoft Copilot Terms of Service | Record: CA-P-003188
Captured: 2026-04-27 09:50:27 UTC | SHA-256: 3b836ca98040eca1…
URL: https://conductatlas.com/platform/microsoft-copilot/microsoft-copilot-terms-of-service/data-export-and-account-closure/
Accessed: May 2, 2026