Microsoft Teams and GDPR: What to Check Before Using It

Teams stores your recordings and transcripts in the organiser’s OneDrive or the channel’s SharePoint, with a default expiration period of 120 days. If your Microsoft 365 organisation was created in a country of the European Union or EFTA, this data is covered by the EU Data Boundary, Microsoft’s commitment to store and process it in its European data centres, with documented residual transfers. Microsoft is a company subject to US law, which the EU Data Boundary does not change. This page is edited by Leexi, whose AI note-taking tool is used in Teams, and presents only what Microsoft Learn documents.

Where Teams hosts and processes your data

In your own Microsoft 365 environment, in your organisation’s region.

A Teams meeting recording is not stored in a separate Microsoft location. It is stored in OneDrive or SharePoint, depending on the type of meeting.

Microsoft Learn, “Storage and permissions for Teams meeting recordings and transcripts in OneDrive and SharePoint”, updated on August 18, 2026 “For meetings and events, the recording is saved to the organiser’s OneDrive, even if the organiser did not attend the meeting or event.”

For channel meetings, “the recording is stored in the Teams SharePoint site’s document library, in a folder named Recordings”. For one-to-one or group calls, the file is saved to the OneDrive of the person who started the recording. One hour of recording uses 400 MB and counts towards your quota.

The region depends on your organisation, not the meeting

The location is that of your Microsoft 365 organisation. For European organisations, Microsoft has made a specific commitment.

Microsoft Learn, “What is the EU Data Boundary?”, content dated February 26, 2025 “The EU Data Boundary is a geographically defined boundary within which Microsoft commits to storing and processing Customer Data and personal data for its enterprise Microsoft online services, including Azure, Dynamics 365, Power Platform and Microsoft 365.”

The access condition is explicitly defined: “For Microsoft 365, customers with a registration country in an EU or EFTA country or region are covered by the EU Data Boundary.” An organisation that has purchased Multi-Geo capabilities is excluded, even if its country is European.

The same document establishes two limitations. The commitments are “subject to limited circumstances in which Customer Data, personal data and Professional Services Data will continue to be transferred outside the EU Data Boundary”. In addition, the geographical scope includes Switzerland, Norway, Iceland and Liechtenstein, not just the European Union.

What this means for you: check your organisation’s registration country in the Microsoft 365 admin centre and confirm that you do not use Multi-Geo. These two points determine coverage.

How long Teams stores your recordings

Microsoft Learn, “Manage the expiration policy for Teams recordings”, updated on August 31, 2026 “Meeting recordings and transcripts have a default expiration period of 120 days.”

When it expires, the file is moved to the recycle bin of the location where it was stored. In a work account, items in the recycle bin “are automatically deleted after 93 days, unless the administrator has changed the setting”. The administrator can set another period, between 1 and 99,999 days, or disable expiration. The change applies only to new recordings.

GDPR requires a period limited to what is necessary.

GDPR, Article 5(1)(e) “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”

What this means for you: the default 120-day period is Microsoft’s decision, not yours. Your retention policy should confirm or replace it.

What Microsoft does with your conversations

Microsoft acts as a processor, and Copilot does not use your meetings to train its models.

Microsoft Learn, “General Data Protection Regulation”, updated on May 5, 2026 “As a processor, Microsoft processes personal data on behalf of the controller (the customer). […] Microsoft processes Customer Data to provide the Online Services in accordance with the controller’s documented instructions, as specified in the Product Terms and the Data Protection Addendum for Products and Services (DPA).”

This is the obligation that GDPR imposes on any processor.

GDPR, Article 28(3)(a) “processes the personal data only on documented instructions from the controller”

As for training, the commitment concerns Copilot, which produces meeting transcripts and summaries in Teams.

Microsoft Learn, “Data, privacy and security for Microsoft Copilot”, updated on August 18, 2026 “Prompts, responses, and data accessed through Microsoft Graph are not used to train foundation LLMs, including those used by Microsoft Copilot.”

The same document specifies: “For users in the European Union (EU), we have additional safeguards to comply with the EU Data Boundary. EU traffic stays within the EU Data Boundary”, and adds a specific exception: “Models provided by Anthropic as a processor are currently excluded from the EU Data Boundary.”

What this means for you: the no-training commitment is documented and covers Copilot. If your administrator enables third-party models in Copilot, the Anthropic exception falls outside the EU Data Boundary. This is a setting to verify, not a Microsoft failure.

Microsoft 365 certifications

ISO 27001, ISO 27018 and a published compliance portfolio, with documented transfer mechanisms.

Microsoft’s GDPR page refers to its compliance offerings, which include “FedRamp, HIPAA/HITECH, ISO 27001, ISO 27002, ISO 27018, NIST 800-171, UK G-Cloud”. The Copilot page also cites ISO 42001, the standard relating to AI management systems.

Regarding transfers outside the European Union, Microsoft is precise.

Microsoft Learn, “General Data Protection Regulation” “Microsoft has incorporated the Standard Contractual Clauses into all its Volume Licensing agreements through the Product Terms. […] Microsoft is certified under the EU-U.S. Data Privacy Framework, but does not rely on it as a basis for transferring personal data from the EU/EEA to the United States.”

The merit should be acknowledged: the Standard Contractual Clauses are integrated into all contracts, and Microsoft explicitly states that it does not rely on the Data Privacy Framework. What a DPO checks next is the exact scope of the certifications applicable to Teams, available on Microsoft’s trust portal.

The provider’s legal framework

Microsoft is a company subject to US law. The EU Data Boundary locates the data but does not change the law applicable to the provider.

18 U.S. Code § 2713, added by Pub. L. 115-141 of March 23, 2018 “A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a subscriber to or customer of such service, regardless of whether such communication, record, or other information is located within or outside of the United States.”

What this means for you: the EU Data Boundary is the market’s most documented localisation commitment and answers the question “where”. The question “which law applies” continues to be determined by the provider’s headquarters. This point is mentioned only once.

What this changes for a European team

In Teams, Leexi creates a second, distinct perimeter from Microsoft’s: the bot joins the meeting, and the audio is transcribed and summarised on Leexi’s infrastructure (AWS Paris region, language model run through Azure France in a closed circuit, with no training on your meetings), with a public DPA and ten identified subprocessors. Teams is the video-conferencing platform most frequently mentioned in Leexi support requests, and one third of those requests concern participant consent and notification. The Microsoft Teams integration page explains how to connect Leexi to Teams. Copilot, Microsoft’s AI assistant, has its own page: alternative to Microsoft Copilot. The compliance dossier and glossary present the definitions and supporting documents.

Frequently asked questions

Where are my Teams meeting recordings stored?

In the organiser’s OneDrive for meetings and events, even if they did not attend the meeting. In the channel’s SharePoint for channel meetings. In the OneDrive of the person who started the recording for one-to-one or group calls. The file counts towards your quota at a rate of 400 MB per hour.

How long does Teams retain a recording?

120 days by default. The recording is then moved to the recycle bin, where a work account retains items for 93 days before permanent deletion. The administrator can set another period, between 1 and 99,999 days, or disable expiration, for new recordings only.

Is my organisation covered by the EU Data Boundary?

Yes, if the registration country is in the European Union or EFTA and the organisation has not purchased Multi-Geo capabilities. The registration country can be checked in the Microsoft 365 admin centre. Residual transfers outside the boundary remain documented by Microsoft.

Does Copilot use my Teams meetings to train its models?

No. Prompts, responses and Microsoft Graph data are not used to train foundation models. European users’ traffic remains within the EU Data Boundary, with one exception: Anthropic models enabled as a processor are excluded from that boundary.

Are participants notified when a Teams meeting is recorded?

Yes. All participants receive a notification in Teams as soon as recording starts. Microsoft’s help documentation adds that “depending on your region, you may need to obtain everyone’s permission before you can record them”. Informing participants about the purpose and retention period remains your responsibility as the organiser.

Is Teams sufficient for a strict sovereignty requirement?

No. Microsoft is a company subject to US law and 18 U.S. Code § 2713, regardless of where the data is stored. The EU Data Boundary locates the data and documents residual transfers, but does not change the provider’s legal framework.

Sources

Data verified on September 2, 2026, on Microsoft’s official pages.

• Microsoft Learn, “Storage and permissions for Teams meeting recordings and transcripts in OneDrive and SharePoint”, updated on August 18, 2026
• Microsoft Learn, “Manage the expiration policy for Teams recordings”, updated on August 31, 2026
• Microsoft Learn, “What is the EU Data Boundary?”, page dated July 21, 2026, content dated February 26, 2025
• Microsoft Learn, “General Data Protection Regulation”, updated on May 5, 2026
• Microsoft Learn, “Data, privacy and security for Microsoft Copilot”, updated on August 18, 2026
• Microsoft Help, “Record a meeting in Microsoft Teams”
• GDPR, Articles 5 and 28, text published by CNIL
• 18 U.S. Code § 2713, Legal Information Institute, Cornell Law School

This page describes the applicable framework. It does not constitute legal advice.

Try Leexi for free