Understanding Microsoft’s Data Protection Addendum

• The DPA defines how customers and Microsoft share responsibility for protecting customer data in Microsoft online services.
• Microsoft cloud customers should review the DPA and how it maps to their data to avoid breaking laws, regulations, or organizational policies.
• The DPA applies to most of Microsoft’s online services, but not all.

The Data Protection Addendum (DPA), attached to volume licensing and other agreements, details the shared responsibilities that customers and Microsoft have with respect to data maintained in Microsoft’s cloud services, referred to as “online services” in the document. (In this report, “customer” refers to the signatory of the agreement with Microsoft.)

For an overview of the concept of shared responsibility, see the illustration “The Shared Responsibility Model.”

Note: this report provides an overview of the DPA; however, its contents are not legal advice, and customers should review this report with their legal counsel.