Is Microsoft Intune UK GDPR compliant?
answer from its trust card · not checked yet
> short_answer
Microsoft Intune handles customer data, so it acts as a supplier under UK GDPR. You’ll want a contract that covers processing, and to check where the data goes. The facts below are from its trust card.
No tool is “compliant” on its own; compliance depends on how you use it. This page shows the facts you need to decide.
The facts that matter for UK GDPR
Data location: Set by the country in your Microsoft Entra directory when Intune is first set up: North America, Europe (EU and EFTA only, inside the EU Data Boundary), Asia Pacific, or local Australia, India and Switzerland. Exceptions: support and troubleshooting, content-delivery caching, preview features (usually stored in the US), and end-user notification emails (processed in EMEA for EMEA customers).○ unclaimed
Data kept for: Personal data is generally removed within 30 days of deletion; audit logs are kept for up to two years.○ unclaimed
Certifications: Processed on ISO-certified systems; reports on Microsoft’s Service Trust Portal○ unclaimed
What you still need to do
- Add it to your record of processing. Pre-filled entry
- Check your contract covers processing and any transfers abroad. DPIA starter
- Watch it, so you hear if any of this changes. Watch Microsoft Intune