3

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc).

Right now I have a privacy policy similar to DuckDuckGo. I collect nothing. Some products seem to collect data for a period of time in order to operate. Examples include:

  • Azure Threat Detection for SQL
  • Azure Application Gateway
  • Azure AD "Risky Sign ins"
  • etc...

Question

How can I gather the appropriate information in order to update my privacy policy accordingly?

Improve this question

1 Answer 1

Reset to default
1

You are a data custodian of your customer's data. The fact that you are using Azure means they are also a partner with you in data custodianship. For you to accurately describe what that means you either need to

  1. Include all the terms of the Azure privacy agreement into your agreement, understanding that these can change rapidly without notice. or
  2. You need to clarify that your policy is X and that your service runs on Azure who's policy is Y.

If it's an option the 2nd option will be the easiest way to resolve the problem with Azure's ever-changing privacy terms.

Do keep in mind that Azure's policy may also vary by jurisdiction and that you need to keep track of that and also which jurisdiction's laws apply to each of your customers.

Useful Reference: https://azure.microsoft.com/en-us/support/legal/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .