Customer Insights: Data privacy and GDPR

How does Customer Insights ensure compliance with the GDPR and data protection?

Customer Insights is fully GDPR-compliant. It is a data processing tool that offers data controllers, i.e. customers, facilitation for compliance.

Regarding data security, all data at rest are encrypted. Customer Insights uses state-of-the-art 256-bit AES encryption, which is native to the Azure storage it uses. This encryption is transparent to users. Users also have the option of bringing their own encryption keys. Data are transmitted over HTTPS, ensuring encryption during transfer.

Do consumers have access to the collected data?

Customer Insights does not directly collect data from end consumers. It only incorporates data from an organisation’s or company’s systems into Customer Insights, as desired by the company’s administrator.

Can the unification of data sources in Customer Insights be reversed?

Yes, the unification of data from different sources can be configured to allow the removal of sources or the addition of new ones at any time.

Is it possible to restrict what can be done with the data in Customer Insights?

Yes, the unification of data from different sources can be configured to allow sources to be removed or added at any time.

How are changes carrid over to customer and partner systems when users want to remove their data from Microsoft's data lakes? What about the right to be forgotten?

Data are incorporated into Customer Insights from an organisation’s or company’s systems. When data are removed, they are transferred to the Customer Insights application during an update or refresh process.

The “right to be forgotten”, i.e. the removal of personal data from an organisation’s or company’s customer data, is an important protection under the GDPR. Deleting personal data involves removing all personal data and system-generated logs, except for audit log information. Customer Insights provides the following in-product options for deleting personal data for a specific customer or Customer Insights user:

• Managing deletion requests for customer data: Customer data in Customer Insights is ingested from original data sources outside of Customer Insights. All GDPR deletion requests must be performed in the original data source.
• Managing deletion requests for Customer Insights user data: Data are created by Customer Insights, and all GDPR deletion requests must be performed within Customer Insights.

Do we have resources to help customers maintain compliance while unifying their customer data? How are companies supported when responding to their customers’ data gathering requests?

We help our customers find, refine, and validate data using intelligent search tools, enabling them to respond quickly and effectively to scenarios such as meeting legal requirements or responding to customer inquiries and investigations.

How does Microsoft ensure that privacy takes precedence over commercial gain?

Much of the potential of new technologies relies on analysing large volumes of data to gain new insights, create innovative services or simply make everyday tasks a little easier. However, the ability to leverage data must go hand in hand with protecting the privacy of the individuals whose information forms the basis of that data. Managing, storing and processing these data bring new responsibilities for Microsoft. Microsoft’s approach to privacy is based on the belief that our customers own their data, and we support this belief with specific measures to protect their privacy and give them control over their data. We only use customer data to deliver the agreed-upon services and do not use it for marketing or advertising purposes.

How does Microsoft combine data privacy with data security?

Microsoft employs over 3,500 cybersecurity experts who provide security measures to protect against, detect, and respond to potential threats.