5.1.2. Microsoft Privacy Principles
💡 First Principle: Microsoft publishes six explicit privacy principles — control (customers control their data), transparency (about how data is collected and used), security (protecting the data entrusted to Microsoft), strong legal protections (respecting local privacy laws), no content-based targeting (customer email, chat, and files aren't used for advertising), and benefits to you (data Microsoft collects is used to improve your experience) — because privacy commitments only matter if they're specific and public enough to be held accountable to.
These principles directly inform product behavior across Microsoft 365 and Azure — for example, customer data ownership underlies why customers, not Microsoft, control data classification, retention, and deletion decisions covered later in this phase.
⚠️ Exam Trap: Privacy principles are commitments about how Microsoft handles data as a provider — they don't replace an organization's own responsibility to configure information protection and data governance controls (5.3) correctly for their own data.
Reflection Question: If a customer owns their data outright under Microsoft's privacy principles, whose responsibility is it to actually classify and protect that data appropriately — Microsoft's, or the customer's?
