> Guide to Outlook Web App GDPR compliance covering email privacy, cookies, Microsoft DPA, data transfers, and compliance steps. > > Canonical: https://www.flowconsent.com/en/services/other/outlook-web-app Other # Outlook Web App (OWA) Unclassified · [Official website](https://help.outlook.com) Outlook Web App (OWA) is the web based email client of Microsoft 365/Exchange, providing email, calendar, contacts, and tasks in a browser. Part of the Microsoft 365 suite, it processes email content, attachments, and calendar data on Microsoft infrastructure. GDPR compliance follows the Microsoft 365 DPA framework. [Block Outlook Web App (OWA) until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Unclassified - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Global (Microsoft data centers, EU Data Boundary available) Overview ## What does Outlook Web App (OWA) do? ## **What Is Outlook Web App?** Outlook Web App (OWA) is the browser based email client of Microsoft 365 and Exchange Online. It provides email, calendar, contacts, tasks, and integration with other Microsoft 365 services. As part of the Microsoft 365 ecosystem, OWA inherits the same data processing framework, DPA, and compliance certifications. OWA sets authentication cookies, session tokens, and telemetry cookies from Microsoft domains. ## **GDPR Implications and Compliance** OWA processes email content which is inherently personal and often sensitive. The GDPR implications mirror those of Microsoft 365 broadly: Microsoft acts as processor under the DPA with SCCs, EU Data Boundary is available, and diagnostic data collection can be configured. Legal basis is contract performance for employee email. If OWA links are embedded on public websites, cookie consent applies. Practical steps: accept the Microsoft DPA, configure diagnostic settings, enable EU Data Boundary, implement email retention policies via Microsoft Purview, train staff on email data protection. Compliance ## Outlook Web App (OWA) and the GDPR Outlook Web App (OWA) is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract performance (Art. 6(1)(b)) for email service, consent for analytics cookies (Art. 6(1)(a)) - Risk level high - Applicable regulations GDPR, ePrivacy, UK GDPR, HIPAA, SOC 2, ISO 27001 ### Impact assessment (DPIA) DPIA recommended as part of broader Microsoft 365 assessment. Email content is inherently sensitive. Assess: email data categories, attachment sensitivity, calendar sharing, telemetry collection, Microsoft subprocessors. ### Sample text for your banner > This site embeds Outlook Web App components. Cookies may be set by Microsoft. Data is processed per the Microsoft DPA. You can manage consent via cookie settings. Cookies and trackers ## What Outlook Web App (OWA) sets and contacts - Tracking method web based email client with cookies, authentication tokens, telemetry, local storage - Server location Global (Microsoft data centers, EU Data Boundary available) - Data transferred outside the EU Part of Microsoft 365. Data hosted on Microsoft global data centers. EU Data Boundary available. DPA with SCCs provided. ### Cookies set (3) | Name | Type | Duration | Purpose | | -------- | -------------- | -------- | --------------------------------------------------------------- | | cadata | authentication | Session | OWA session cookie maintaining the webmail authenticated state. | | ESTSAUTH | authentication | Session | Azure AD authentication token for Outlook Web App. | | UC | functionality | 1 year | Stores Outlook user interface state preferences. | ### Third-party domains contacted (4) - `outlook.office.com` - `outlook.office365.com` - `login.microsoftonline.com` - `attachments.office.net` Questions ## Frequently asked questions about Outlook Web App (OWA) Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Cookies? Same as Microsoft 365: MUID, ESTSAUTH, AADSSO, MC1, MS0, SignInStateCookie from login.microsoftonline.com and outlook.office.com. ### Consent required? For internal employee email, no (contract performance). Analytics/telemetry cookies may need consent. Embedded OWA components on public sites need ePrivacy consent. ### Legal basis? Contract performance (Art. 6(1)(b)) for employee email. Legitimate interest for security. Consent for optional telemetry. ### US transfers? Part of Microsoft 365. EU Data Boundary available. DPA with SCCs. See Microsoft 365 entry for full details. ### DPIA? Recommended as part of broader Microsoft 365 assessment. Email inherently processes sensitive personal data. ### Compliance steps? Accept Microsoft DPA. Configure diagnostic data. Enable EU Data Boundary. Set email retention policies via Purview. Train staff. ### Alternatives? ProtonMail (Swiss, encrypted), Tutanota/Tuta (German, encrypted), Posteo (German), Mailbox.org (German), Infomaniak Mail (Swiss). ### Cookie policy? Document Microsoft authentication and telemetry cookies. Reference Microsoft DPA. Same framework as Microsoft 365. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Rubic](https://www.flowconsent.com/en/services/other/rubic) [Rubic is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Rubic enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Rubic empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/rubic) [Marketing](https://www.flowconsent.com/en/services/other/rubic) · ### [Droxit](https://www.flowconsent.com/en/services/other/droxit) [Droxit is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Droxit integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Droxit helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/droxit) [Other](https://www.flowconsent.com/en/services/other/droxit) · ### [TaxDome](https://www.flowconsent.com/en/services/other/taxdome) [Taxdome is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Taxdome supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Taxdome ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/taxdome) [Preferences](https://www.flowconsent.com/en/services/other/taxdome) · ### [Personio](https://www.flowconsent.com/en/services/other/personio) [Personio is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Personio integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Personio helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/personio) [Preferences](https://www.flowconsent.com/en/services/other/personio) · ### [Canopy Connect](https://www.flowconsent.com/en/services/other/canopy-connect) [Canopy Connect is an integration and connectivity platform that enables businesses to connect web applications, APIs, and services seamlessly. It provides pre-built connectors, webhook management, and data synchronization. Canopy Connect supports real-time data flow between marketing, sales, and operational tools, eliminating data silos and manual processes. With visual workflow builders and robust API management, Canopy Connect helps create unified digital ecosystems that drive efficiency.](https://www.flowconsent.com/en/services/other/canopy-connect) [Other](https://www.flowconsent.com/en/services/other/canopy-connect) · ### [SOPlanning](https://www.flowconsent.com/en/services/other/soplanning) [SOPlanning is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SOPlanning supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SOPlanning ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/soplanning) [Preferences](https://www.flowconsent.com/en/services/other/soplanning) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)