By uploading or storing content in Microsoft services like OneDrive or Outlook, you give Microsoft a worldwide, royalty-free license to use, store, display, and process that content as needed to operate and improve its services.
Any content you store in Microsoft services — including personal documents, photos, and emails — is subject to a broad license that allows Microsoft to use it in ways that extend to product improvement, creating privacy and intellectual property concerns for sensitive materials.
How other platforms handle this
Authorities. We may disclose Personal Information with authorities if compelled by a subpoena, court order, or similar legal procedure, when necessary to comply with law, or where the disclosure of Personal Information is reasonably necessary to prevent physical harm or financial loss, report suspec...
We may engage third-party companies or individuals as service providers or business partners to process Information and support our business. These third parties may, for example, provide virtual computing and storage services, assist Slack with verifying Owners and Customers, or we may share busine...
European Commission's Standard Contractual Clauses. Slack uses Standard Contractual Clauses approved by the European Commission (and the equivalent standard contractual clauses for the UK where appropriate) for transfers to, among others, Australia, Canada, India, Japan, South Korea, and the United ...
This license grants Microsoft broad rights over your personal files, emails, and documents — including the right to use them to improve Microsoft products — which goes beyond what many users expect when storing content in the cloud.
REGULATORY FRAMEWORK: This provision engages GDPR Arts. 6(1)(b) (processing necessary for performance of contract) and 6(1)(f) (legitimate interests) for EU users, as well as CCPA §1798.100 (right to know about data use) for California residents. The breadth of 'improve Microsoft products and services' as a stated purpose raises questions about whether adequate lawful basis exists under GDPR Art. 6 for all contemplated uses. The Irish Data Protection Commission (DPC) is the lead supervisory authority for EU users. FTC Act Section 5 applies to U.S. users regarding unfair or deceptive representations about data use.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.