Vendor registry · Workplace tools
Microsoft 365: DPA, subprocessors and transfers
Last checked 16 September 2026. Changes to this record are tracked.
- Contracting legal entity
- Microsoft Ireland Operations Limited
- Country of registration
- Ireland
- Transfer mechanism
- EU-US Data Privacy Framework (DPF)
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
- Data processing agreement
- https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
- Security or trust page
- https://www.microsoft.com/en-us/trust-center
- Data regions
- EU, EFTA
What to put in your subprocessor list
A ready row. Replace the purpose with what your client actually uses Microsoft 365 for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Microsoft 365 | Microsoft Ireland Operations Limited | IE | Workplace tools | DPF | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA |