Data protection and privacy

Your data is your business, and you may access, modify, or delete it at any time. Microsoft will not use your data without your agreement, and when we have your agreement, we will use your data to provide only the services you have chosen.

Your control over your data is reinforced by Microsoft compliance with broadly applicable privacy laws, such as GDPR and privacy standards. These include the world’s first international code of practice for cloud privacy, ISO/IEC 27018.

We don’t share your data with advertiser-supported services or mine it for any purposes, such as marketing research or advertising.

We will not disclose data to a government or law enforcement agency, except as you direct or where required by law. Microsoft scrutinizes all government demands to ensure they are legally valid and appropriate.

If Microsoft receives a request for your data, we will promptly notify you and provide a copy of the request unless legally prohibited from doing so. Moreover, we will direct the requesting party to seek the data directly from you.

Our contractual commitments to our enterprise and public sector customers include defending your data, which builds on our existing protections. We will challenge every government request for commercial and public sector customer data where we can lawfully do so. We have a proven track record of successfully challenging government demands in the courts when those demands are inconsistent with the rule of law, and we are transparent about the number of US national security orders we receive.