If you are in the UK I believe that would be covered by GDPR. Since MS do business in the UK they have to abide by that too.