Data processing agreement with Microsoft
Under the General Data Protection Regulation (GDPR), every organization must have a data processing agreement with suppliers that process personal data on its behalf. Microsoft is one such supplier.
The agreement comes with the subscription
Yes, the data processing agreement is included in every Microsoft 365 subscription. It's part of the license terms in the Microsoft Customer Agreement, and you don't need to sign a separate document.
If you buy Microsoft 365 through us, the agreement is in place through the Microsoft Customer Agreement. Digiserv is an approved Microsoft partner (Cloud Solution Provider).
What the agreement covers
- What data Microsoft processes, and for what purpose.
- The security measures that protect the data.
- The subprocessors Microsoft uses, and the terms that apply to them.
- Storage in Europe, and the terms for transfers outside the EEA.
- Notification within 72 hours of a data breach.
- Deletion of data when the subscription ends.
The agreement and all related documents, such as compliance statements and certifications (ISO 27001, SOC 2), are available in the Microsoft Trust Center.
What you need to do yourself
- List Microsoft as a data processor in your record of processing activities.
- Name Microsoft as a subprocessor in the data processing agreements you have with your own customers, if relevant.
If you have questions about privacy and GDPR in Microsoft 365, get in touch at 38 27 80 00.