3.2.8 Azure Privacy, Compliance, and Data Protection Facts

What is the relationship between the OST and the DPA?

The DPA is an addendum (extension) to the OST. The OST covers general privacy terms; the DPA adds more detail on data processing and security.

What data collection tools does the Microsoft Privacy Statement address?

Cookies, web beacons, and other similar data collection tools — along with situation- and product-specific privacy information.

What is the Online Services Terms (OST)?

A legal agreement. When customers sign the OST, they agree to the privacy terms and conditions that apply to the online service(s) they purchased.

What is the Data Protection Addendum (DPA)?

An addendum to the OST that provides additional information about data processing and security terms for purchased services.

When should you use the Microsoft Trust Center?

When trying to determine whether a Microsoft service is compliant with a particular standard or regulation.

What is the Microsoft Privacy Statement?

A statement that outlines how Microsoft handles personal data. It applies to all Microsoft products — services, apps, software, servers, and devices.

What is the Microsoft Trust Center?

A website for individuals or organizations who want to learn about Microsoft's privacy, security, and compliance efforts. It's the best starting point for researching whether a service meets a specific standard or regulation.

What three topics does the DPA cover?

• Government compliance

• Data security

• Data handling

Name 3 topics covered in the Microsoft Privacy Statement.

• Personal data Microsoft collects

• How collected data is used

• Reasons for sharing personal data

• Cookie, web beacon, and other data collection tools

• Methods for accessing and controlling your data

What does CJIS stand for?

Criminal Justice Information Services.

What does ISO/IEC stand for?

International Organization of Standards / International Electrotechnical Commission.

What is HIPAA and what field does it cover?

A standard created to address information and data security specifically for the health care field.

What is CJIS and who does it apply to?

A collection of requirements and standards for local, state, and federal agencies, created to address information and data security in the criminal justice and law enforcement fields.

What does NIST stand for?

National Institute of Standards and Technology.

Match the standard to its field: CJIS, HIPAA, ISO/IEC, NIST

• CJIS → Criminal justice & law enforcement

• HIPAA → Health care

• ISO/IEC → Cloud data standards (global)

• NIST → U.S. technology & data protection guidance

What do ISO/IEC standards enforce for cloud-stored data?

• Customer data is not used for marketing or advertising

• Data will not be shared unless there is a legally binding order for disclosure

What does HIPAA stand for?

Health Insurance Portability and Accountability Act.

What is NIST and what does it do?

An agency of the U.S. Department of Commerce that encourages technological advancements and provides recommendations for data protection.