Microsoft data processing agreement and GDPR in Microsoft 365

For many Danish SMEs, Microsoft 365 is the foundation of everyday work. But when it comes to GDPR, doubts often arise: Is Microsoft a data processor for us, and do we need a separate agreement? Here is the overview.

Is Microsoft a data processor for your business?

Yes, when you use Microsoft 365, Microsoft acts as a data processor for the personal data your business stores in the cloud. Microsoft provides the infrastructure, but as the data controller you are responsible for how data is processed and who has access to it.

How to find Microsoft's data processing terms

Microsoft's obligations as a data processor are set out in its "Data Protection Addendum" (DPA). You will find this documentation in the Microsoft Trust Center. It is important to note that Microsoft updates these terms on an ongoing basis to ensure compliance with the latest legislation.

Is a separate agreement necessary?

In most cases, a separately signed contract is not required. Microsoft has built its data processing terms into the Online Services Terms (OST), which your business accepts when purchasing your licences. These terms are legally binding and meet the requirements of GDPR Article 28.

How to ensure compliance in your Microsoft 365 solution

Although Microsoft takes care of its part of the agreement, it is your responsibility to ensure a secure setup. This includes:

• Enabling MFA (Multi-Factor Authentication) for all users.
• Configuring correct data storage and deletion policies.
• Setting up logging of access to sensitive data.
• Ongoing monitoring of your IT compliance.

Frequently asked questions