Data protection information for participants of Microsoft Teams meetings

Identity and contact data: display name, email address, where applicable profile picture/department, organisational affiliation (for external participants: information from the invitation/registration).
Meeting metadata: meeting ID and title, invitation details, date/time, organiser, role (organiser, presenter, participant), connection information (e.g. IP address), client/end device.
Communication content: audio/video, screen sharing, chat messages, reactions/raised hand (if used).
Attendance reports: attendance list including join/leave times (visible only to organisers and co-organisers).
Recording/transcription/interpreter (only if enabled): video/audio file as well as transcript and related metadata.

The conduct and moderation of online meetings serve communication, presentation and collaboration with internal and external participants.
Transcription and video recording serve the following purposes:
(i) for training/instruction sessions and (ii) information events, the purpose is to make the training content and information available after the meeting for review and for absent persons; and (iii) for meetings with several participants or more complex content, the purpose is efficient knowledge management (time savings through automated minutes, better searchability of meeting content); and (iv) for other purposes specifically stated in the meeting invitation or expressively stated by the organizer in the meeting prior to the start of recording or transcription.
Attendance reports serve the follow-up of meetings.

Art. 6(1)(b) GDPR – insofar as meetings are required for the performance of a (pre-) contractual relationship, e.g. in the context of job interviews or the employment relationship.
Art. 6(1)(f) GDPR – our legitimate interest lies in increased efficiency through a detailed or verbatim automated minute-taking function as well as through safeguarding and availability of complete meeting content.
Art. 6(1)(a) GDPR – where you have consented to the processing, such processing is based on your consent.

For participation in an online meeting via Teams, name and email address are required (invitation/joining). For external participants, however, there is no contractual obligation to provide the data.

Audio/video, chat and reactions are voluntary for everyone and are not required for passive participation; you may deactivate your camera and microphone, not use the chat or reactions and, where applicable, participate with a neutral display name. In that case, active verbal contributions, video contributions or screen sharing may not be possible.

If you do not wish to give your consent to transcription or video recording, you may participate in the meeting passively by keeping your microphone muted and not activating your camera.

We use Microsoft 365 within the framework of the EU Data Boundary. Personal data and pseudonymised personal data of the core cloud services (including Microsoft 365/Teams) are generally stored and processed within the EU/EFTA; since February 2025, support/professional services data has also been stored within the EU/EFTA. For any unavoidable exceptions that we cannot completely rule out, safeguards pursuant to Chapter V (Art. 44 et seq.) GDPR are in place, e.g. in the form of Microsoft’s certification under the EU-US and Swiss-US Data Privacy Framework.

Transcripts are stored together with the recordings (audio and/or video). Recordings are stored in the organiser’s OneDrive for Business or, in the case of invitations sent from a Teams channel, in SharePoint, and are automatically deleted in both locations after 90 days. By way of exception, this automatic retention period may be defined for a longer period depending on the specific purpose, in particular the topic and the group of participants of the training/information event, but only if and for as long as this is strictly necessary to achieve the purpose.
Attendance reports are available to organisers (and co-organisers) in Teams; they are assigned to the organiser account and are automatically deleted by default after no later than 12 months.
Live captions / interpreter agent are not stored.

Right to information pursuant to Art. 15 GDPR

keyboard_arrow_up

You can request confirmation from the data controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request the following information from the data controller:

the purposes for which the personal data are processed;
the categories of personal data being processed
the recipients or categories of recipients to whom your personal data have been or will be disclosed
the planned duration of the storage of your personal data or, if specific information on this is not possible, criteria for determining the storage period
the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the data controller or a right to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority
all available information about the origin of the data if the personal data is not collected from the data subject
the existence of automated decision-making, including profiling, referred to in Art. 22 para. 1 and para. 4 GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You have the right to request information as to whether your personal data is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

Right to rectification pursuant to Art. 16 GDPR

keyboard_arrow_up

You have a right to rectification and/or completion vis-à-vis the data controller if the processed personal data concerning you is incorrect or incomplete. The data controller must make the correction without delay.

Right to erasure pursuant to Art. 17 GDPR

keyboard_arrow_up

You have the right to obtain from the data controller the erasure of personal data concerning you without undue delay and the data controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
a.   the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
b.   you withdraw your consent on which the processing was based according to Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a) GDPR, and where there is no other legal ground for the processing.
c.   you object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
d.   the personal data concerning you has been processed unlawfully.
e.   the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject.
f.   the personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.
If the controller has made your personal data public and is obliged to erase it pursuant to Art. 17 para. 1 GDPR, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform data controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
The right to erasure does not exist if the processing is necessary
a.   for exercising the right of freedom of expression and information
b.   for compliance with a legal obligation which requires processing by Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
c.   for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h) and i) and Art. 9 para. 3 GDPR;
d.   for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in para. 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
e.   for the establishment, exercise or defence of legal claims.

Right to restriction of processing pursuant to Art. 18 GDPR

keyboard_arrow_up

You may request the restriction of the processing of your personal data under the following conditions:

if you contest the accuracy of your personal data for a period enabling the data controller to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
the data controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or
if you have objected to processing pursuant to Art. 21 para. 1 GDPR pending the verification whether the legitimate grounds of the data controller override your grounds.

If the processing of your personal data has been restricted, this data - apart from its storage - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the data controller before the restriction is lifted.

Right to information pursuant to Art. 19 GDPR

keyboard_arrow_up

If you have asserted the right to rectification, erasure or restriction of processing against the data controller, the data controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right vis-à-vis the data controller to be informed about these recipients.

Right to data portability pursuant to Art. 20 GDPR

keyboard_arrow_up

You have the right to receive your personal data, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

the processing is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR or on a contract pursuant to Art. 6 para. 1 lit. b) GDPR and
the processing is carried out by automated means.

In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority assigned to the controller.

Right to object pursuant to Art. 21 GDPR

keyboard_arrow_up

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Art. 6 para. 1 GDPR, including profiling based on those provisions. The data controller will no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such marketing; this also applies to profiling insofar as it is associated with such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the possibility of exercising your right to object by automated means using technical specifications.

Right to revoke the declaration of consent under data protection law pursuant to Art. 7 para. 3 GDPR

keyboard_arrow_up

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

keyboard_arrow_up

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, or the Federal Data Protection and Information Commissioner (FDPIC) if you consider that the processing of your personal data infringes the GDPR or the FDPA. The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Automated decision-making in individual cases, including profiling

keyboard_arrow_up

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

is necessary for the conclusion or fulfilment of a contract between you and the data controller,
is authorised by Union or Member State law to which the data controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
with your express consent.

However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a) or g) applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests. With regard to the cases referred to in a. and c., the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Data protection information for participants of Microsoft Teams meetings

Controller

Scope

1. What data is processed?

2. Purposes of processing in connection with Teams meetings

3. Legal basis

4. Obligation to provide data / behavioural options

5. Recipients

6. Data transfers to third countries

7. Storage locations and retention period

8. Automated decision-making

9. Your rights

Right to information pursuant to Art. 15 GDPR

Right to rectification pursuant to Art. 16 GDPR

Right to erasure pursuant to Art. 17 GDPR

Right to restriction of processing pursuant to Art. 18 GDPR

Right to information pursuant to Art. 19 GDPR

Right to data portability pursuant to Art. 20 GDPR

Right to object pursuant to Art. 21 GDPR

Right to revoke the declaration of consent under data protection law pursuant to Art. 7 para. 3 GDPR

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

Automated decision-making in individual cases, including profiling

10. Data protection contact