The European Medicines Agency (EMA) has published a data protection notice for its use of Microsoft Forms to collect meeting registration data, detailing how personal information will be processed in compliance with EU data protection rules. The notice, dated 22 July 2026, applies to all individuals registering for EMA meetings, workshops, or similar events through the web-based platform.
The document designates EMA as the data controller, with the Head of Division or Task Force organising each meeting acting as Internal Controller. Microsoft Ireland Operations Limited serves as data processor, hosting the forms on EMA's Azure cloud tenant. The purpose of data collection is to gather information on stakeholder interest and availability, and to distribute meeting links, documents, and satisfaction surveys. For on-site meetings, mobility and dietary information may be processed to accommodate participants' needs. Participant names and affiliations may be disclosed to third parties or published on EMA's website for transparency.
Personal data collected includes full name, job title, place of employment, contact details, IP address, language preference, date and time of form completion, and country of residence. The notice also addresses Microsoft's use of cookies, noting that consent will be obtained for optional cookies not strictly necessary for the service. The processing is governed by Regulation (EU) 2018/1725, the EU data protection regulation for Union institutions.
The notice does not specify retention periods or individual rights procedures, but references the EUDPR framework. Stakeholders affected include meeting participants whose data is processed, EMA as the data controller, Microsoft as processor, and third parties receiving participant lists. The notice balances transparency and operational efficiency against privacy concerns, with moderate impact on participants' data protection rights and minimal impact on business operations.