If you use Microsoft products through your employer, school, or government, your organization — not Microsoft — controls your data and is responsible for privacy. Microsoft's privacy policy does not protect you in these cases.
Many people use Microsoft products at work or school without realizing that Microsoft's consumer privacy protections do not apply — their employer or institution controls their data and sets the privacy rules.
If you use Microsoft 365, Teams, or other Microsoft products through your employer or school, your personal data is controlled by your organization, not covered by Microsoft's consumer privacy statement, and your employer may be able to access your activity data.
How other platforms handle this
We may disclose certain information, in connection with or during negotiations or closing of any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
For users who are under 18, Gemini Apps Activity is saved for 18 months by default and can only be changed to 3 months. Conversations with Gemini apps from users under 13 are not saved to their Google Account by default.
Reddit, Inc., is based in the United States and we process and store information on servers located in the United States. We may store information on servers and equipment in other countries depending on a variety of factors, including the locations of our users and service providers. By accessing o...
This clause could change without notice.
Get alerted when Microsoft updates this policy — with plain-language summaries and severity ratings.
REGULATORY FRAMEWORK: GDPR Art. 28 governs processor relationships, requiring a Data Processing Agreement when Microsoft processes employee/student data on behalf of enterprise customers who act as controllers. GDPR Art. 4(7)-(8) defines the controller-processor distinction. FERPA (20 U.S.C. §1232g) applies where educational institutions deploy Microsoft products to students. Employment privacy laws in EU member states (e.g., Works Councils Act in Germany, Article L1222-4 in France) constrain employer monitoring of employee Microsoft activity data. U.S. Electronic Communications Privacy Act (ECPA, 18 U.S.C. §2511) applies to employer access to employee communications.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Don't miss changes to this clause.
Microsoft has updated this policy before. Get alerted on the next change.
Watch MicrosoftMany people use Microsoft products at work or school without realizing that Microsoft's consumer privacy protections do not apply — their employer or institution controls their data and sets the privacy rules.
If you use Microsoft 365, Teams, or other Microsoft products through your employer or school, your personal data is controlled by your organization, not covered by Microsoft's consumer privacy statement, and your employer may be able to access your activity data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Microsoft.