Microsoft Dynamics 365 Commerce

Dynamics 365 Commerce sets first party cookies for cart, checkout, session, anti CSRF tokens, and locale. Application Insights adds analytics cookies (ai_user, ai_session). Microsoft Entra ID issues authentication cookies for signed in customers. Optional integrations such as Microsoft Clarity, advertising pixels, and Customer Insights may add further analytics, personalization, or marketing cookies.

Strictly necessary cookies (cart, checkout, payment, security, anti forgery) do not require consent. Analytics, behavioral profiling, personalization, Application Insights, Microsoft Clarity, and any marketing pixels require prior opt in consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. Consent must be specific, informed, granular, and as easy to withdraw as to give.

Order processing, cart, checkout, payment, and fulfillment rely on Article 6(1)(b) GDPR (performance of the sales contract). Fraud prevention and core security rely on Article 6(1)(f) (legitimate interest). Analytics, profiling, personalization, marketing, and remarketing rely on Article 6(1)(a) (consent). Each processing activity should be mapped in the record of processing activities.

Yes. Microsoft is a US headquartered processor and data may flow to the United States and other Microsoft regions. Transfers are covered by the EU US Data Privacy Framework (Microsoft is certified), the UK extension, the Swiss US Framework, and Standard Contractual Clauses in the Microsoft DPA. Selecting an EU region activates the EU Data Boundary for core customer data, while some telemetry and identity flows may still cross borders.

A DPIA is strongly recommended. The platform involves large scale processing of customer and payment data, behavioral profiling via Application Insights and Customer Insights, optional Microsoft Clarity session recordings, integration with Microsoft Entra ID, and cross border transfers. These factors trigger several DPIA criteria in the EDPB guidelines and the national lists of CNIL, BfDI, and AEPD.

Sign the Microsoft DPA, choose an EU region with EU Data Boundary, gate Application Insights, Clarity, and marketing tags behind a Consent Management Platform, document subprocessors, set retention windows for orders and telemetry, implement data subject requests through the Microsoft Privacy portal, harden Microsoft Entra ID with least privilege and MFA, and run a DPIA.

Alternatives include Shopify, Adobe Commerce (Magento), SAP Commerce Cloud, Salesforce Commerce Cloud, Commerce Tools, and Sylius for European hosting. Each option has its own data flows, hosting locations, and consent considerations. EU based solutions or self hosted deployments can reduce third country transfer concerns but may shift compliance and security work to your team.

List each Dynamics 365 Commerce cookie with name, purpose, duration, and category (necessary, analytics, personalization, marketing). Document Microsoft as a processor, name relevant subprocessors, declare transfers to the United States under the EU US Data Privacy Framework and Standard Contractual Clauses, and link to the Microsoft Trust Center and DPA. Provide a granular opt in and a clear withdrawal mechanism.