Microsoft 365 data & security
Frequently asked questions about how Microsoft looks after your data, restrictions from certain countries and what happens when you leave.
Are there any data protection risks?
We've thoroughly investigated the legal situation and we’re confident that most data can be stored in the cloud.
However, there are some significant exceptions, eg sensitive research data. In these exceptions, departments need to ensure that they’re appropriately using and protecting data. For further advice, please contact Data Protection.
How secure is OneDrive?
OneDrive is secure. Newly created documents are only accessible by the document owner and access to others is granted by sharing individual documents or folders.
However, we don’t recommend sharing files in OneDrive. The University’s approved filestore for shared documents is Google Drive.
If handling sensitive data, you must store it in an approved location. For help, check the University’s information classification and handling guidance.
For further support, visit Records Management and Information Governance.
Will I be able to access Microsoft 365 in China? Is it restricted elsewhere?
Access to Microsoft is allowed in China, however, performance may vary. If you're having difficulties accessing Microsoft 365 in China, try our China Connect service. (Alternatively, try connecting via the University’s Virtal Private Network or Virtual Desktop Service.)
Microsoft restricts access from certain countries. Find out which countries can access Microsoft.
Can I use Microsoft 365 for my personal documents?
We strongly recommend that you don’t use Microsoft 365 for personal documents.
As this is a University-provided service, it might sometimes be necessary for us to access your files. This is only done with appropriate permissions and in accordance with legal requirements and University regulations. We therefore advise that you maintain a separate account for personal documents.
For further information, see IT investigations and data access policy.
What happens to data (eg documents) held in OneDrive when someone leaves the University?
When someone leaves the University, we will suspend their Microsoft 365 account for 12 months. This is a precautionary grace period, allowing vital information (eg shared and departmental documents) to be retrieved by IT Services and stored in a more suitable location. Where there is a business need, we will carry out these requests in accordance with applicable laws and regulations.
Following the grace period, we will permanently delete the account and its associated data, including all documents still stored there.
To make a request to retrieve data, please contact IT Services.
Where can I find out about data privacy?
See Microsoft’s statement about data protection and privacy.
To learn how the University shares data with Microsoft, please see our information on Microsoft privacy and data protection.