What DW says it processes
DW says it uses Teams for audio and video meetings with internal and external participants. Those include business partners, service providers, applicants, guests and other contacts. The notice lists four categories of data that may be processed, depending on which features a meeting uses:
- Master and contact data: name, display name and email address.
- Meeting and connection data: date, time, duration, participation status, IP address and technical connection details.
- Communication content: audio, video, chat messages, shared content and files, reactions and screen sharing, as far as those functions are used.
- Technical data: device, browser, app and diagnostic data, as far as needed for provision, security and troubleshooting.
The wording matters. DW does not claim that every category is collected in every call. A voice-only call with no chat and no file sharing produces less content data than a screen-sharing workshop.
Controller, processor and legal basis
DW names itself as the controller under Article 4(7) GDPR, with its address in Bonn and a separate Data Protection Officer contact. It generally relies on Article 6(1)(f) GDPR, legitimate interests. It describes that interest as holding meetings efficiently and securely regardless of location. In some cases it relies on Article 6(1)(b), such as steps before a contract, application procedures and dealings with contractual partners.
DW says Microsoft generally acts as its processor under Article 28 GDPR, under a data processing agreement. The notice then adds a caveat. For certain data processed for Microsoft's own purposes, mainly diagnostic, service, support or feedback data, Microsoft may be an independent controller. DW says it has only limited influence over that processing.
The caveat is the most useful part of the notice. "Microsoft is our processor" is a common shorthand, but it does not describe every data flow. Many organizations leave this out of their privacy statements.
Microsoft's Teams documentation gives some context on the diagnostic side. Microsoft's GDPR compliance guidance for Windows diagnostic data says that, when it acts as a processor, it makes personal data available to the customer (the controller). Data-subject requests it receives are redirected to the controller. That guidance covers Windows diagnostic data, not Teams. Teams has its own diagnostic controls. Admins can choose a Required, Optional or Neither level of Teams diagnostic data through the Office cloud policy service. Microsoft's Teams documentation says this diagnostic data does not include user names, email addresses, or content such as chat messages and shared Office files. That documentation describes Microsoft's service in general. It cannot confirm how DW has configured its tenant.
Where the data lives, and who might still reach it
DW says data is generally processed in EU data centers. It adds that it cannot completely rule out individual access from outside the EU or EEA by Microsoft or affiliates. It names three situations: support, maintenance, and security measures, and participants dialing in from third countries. Where such access counts as a transfer, DW relies on the EU Standard Contractual Clauses plus supplementary technical and organizational measures.
Microsoft's documentation says Teams data resides in the geographic region tied to the organization's Microsoft 365 tenant. Admins can see that region in the Microsoft 365 admin center under Settings, then Organization profile, in the Data location section. Microsoft also notes that files stored with third-party storage providers depend on those providers' locations.
Microsoft's EU Data Boundary documentation, as quoted by a third-party commentary site (Leexi), carries a similar qualification. The commitments are subject to limited circumstances in which data will still be transferred outside the boundary. DW's wording follows the same pattern: EU processing as the default, with narrow exceptions.
Retention: the 30-day detail is easy to misread
The notice makes two separate statements on retention:
- Meeting and connection data, chat histories and shared content are kept as long as necessary to conduct, follow up on and document the communication.
- Log data from video calls is deleted after 30 days.
The 30-day figure applies to log data only. It is not a deletion deadline for chats, files or meeting content. The notice gives no fixed period for those, and it does not say what DW treats as "necessary." Anyone who shares sensitive files in a DW meeting should not assume they disappear after a month.
Your rights, and their limits
DW lists the standard GDPR rights: access, rectification, erasure, restriction, portability and objection. It also lists the right to complain to a supervisory authority. It then warns that these rights can be restricted or excluded by law in a specific case, in particular by Section 63 of the Deutsche Welle Act. The notice gives no step-by-step request procedure and does not name the supervisory authority. Invitees who want to exercise a right would start with the Data Protection Officer contact the notice provides.
What this means for admins and invitees
For invitees:
- Expect your name, email address and IP address to be processed when you join.
- Chat, files, audio and video are processed only if you use those features.
- Do not read the 30-day log deletion as a general retention limit.
For IT admins drafting a similar notice:
- Separate processor and independent-controller roles instead of using a blanket statement.
- Check your tenant's data location in the admin center, and say how support and security access are handled.
- State retention per data category. Log data, chats, files and recordings often follow different rules.
- Review your Teams diagnostic data level. The Optional level is sent unless an admin changes the policy, according to Microsoft's documentation.
- Name the legal basis for each processing purpose.
Limits and perspective
This is a transparency document, and it has the usual limits. It states DW's position. It does not show how DW has configured Teams, and I could not verify its retention practices. Microsoft's documentation can explain how the product generally works, but it cannot show DW's tenant settings.
Commentary around German Microsoft 365 use is also divided. Some law-firm and consultancy writers say an Article 28 agreement and the EU Data Boundary make Microsoft 365 workable. Others, citing German data protection authorities, say the standard agreement leaves questions about subprocessors and US transfers. These are secondary sources. DW's notice does not take a side. It documents a cautious, layered approach for a public broadcaster.
The practical takeaway is plain. A good Teams privacy notice says who controls what, where data sits, who might still reach it, and how long each kind of data stays. DW's notice covers most of that. The retention section is the one with the most room for more detail.