The European Medicines Agency (EMA) has published a data protection notice on 22 July 2026 governing how it processes personal data collected through surveys conducted via Microsoft Forms. The notice, issued under Regulation (EU) 2018/1725, applies to all surveys EMA administers using the cloud-based platform, which is hosted on the Agency's Azure tenant. It specifies that EMA acts as data controller, with the Head of Division or Task Force organising each survey serving as internal controller to ensure lawful processing.
The document outlines the types of personal data that may be collected, including full name, job title, place of employment, contact details, IP address, language chosen for drafting replies, views on survey topics, date and time of completion, and country of residence. Microsoft may also save usernames and email addresses of EMA accounts for authentication purposes. Respondents are advised to refrain from disclosing additional personal data in free text fields to avoid unnecessary processing.
Microsoft Ireland Operations Limited is named as the data processor, with contact details provided. EMA may also engage additional third-party processors, information about which can be obtained from the survey organiser. The legal basis for processing is consent, as per Article 5(1)(d) of the EUDPR, obtained when a participant submits a survey reply. The notice also addresses Microsoft's use of cookies, noting that consent will be obtained for optional cookies not strictly necessary for the website or communication facilitation.
The notice applies to all surveys EMA conducts via Microsoft Forms, which is part of the Office 365 suite. It does not introduce new data collection practices but formalises the Agency's obligations under existing EU data protection rules. The document is intended to inform stakeholders and survey participants about their rights and the processing of their data, in line with EMA's transparency commitments.
For survey respondents, the notice provides clarity on data handling and reinforces their right to consent, but may raise concerns about Microsoft's access to personal data given its role as processor. For EMA, the notice ensures compliance with EUDPR, reducing legal risk, though it imposes administrative obligations to inform participants and manage consent. Microsoft benefits from being designated as processor, but must adhere to EMA's data protection requirements. EU data protection authorities may view the notice as a positive step toward transparency, though they could scrutinise the reliance on a third-party cloud provider for processing sensitive regulatory data.