Commit 6d28263

ms.date: "4/24/2018"

ms.prod: "sql-non-specified"

ms.prod_service: "sql-non-specified"

manager: craigg

ms.workload: "Active"

[!INCLUDE[appliesto-ss-xxxx-xxxx-xxx-md](../includes/appliesto-ss-xxxx-xxxx-xxx-md.md)]

This article summarizes the behavior of different data objects used within SQL Server and how the objects are used to pass information of a personal or confidential manner. This article serves as an addendum to the overall Microsoft Privacy Statement. The data classification in this article only applies to versions of the SQL Server on-premises product. It does not apply to the items:

Definition of *Permitted usage Scenarios*. For the context of this article, Microsoft defines “Permitted Usages Scenarios” as actions or activities that are initiated by Microsoft.

Credential-related information used to secure logins, users, or accounts within a SQL Server installation.

- Passwords

- Certificates

|Scenario |Access Restrictions |Retention Requirements |

|---------|---------|---------|

|These credentials never leave the user machine via Usage Feedback. |- |- |

|Crash Dumps may contain Access Control Data. |- |Crash Dumps: Maximum 30 days. |

|These credentials never leave the user machine via User Feedback unless Customer injects it manually |Limit to Microsoft internal use with no third-party access. |User Feedback: Max 1 year |

|

Customer content is defined as data stored within user tables, directly or indirectly. The data includes statistics or user literals within query texts that might be stored within user tables.

- Statistics objects containing copies of values within the rows of any user table.

- Query texts containing literal values.

|Scenario |Access Restrictions |Retention Requirements |

|---------|---------|---------|

|This data does not leave the user machine via Usage Feedback. |- |- |

|Crash Dumps may contain Customer Content and be emitted to Microsoft. |- |Crash Dumps: Max 30 days. |

|Customers with their consent can send User Feedback that contains Customer Content to Microsoft. |Limit to Microsoft internal with no third-party access. Microsoft can expose the data to the original customer. |User Feedback: Max 1 year |

Data received from a user, or generated from their use of the product.

- Linkable to an individual user.

- Location Information

- Customer Identification

|Scenario |Access Restrictions |Retention Requirements|

|---------|---------|---------|

|Customer Identification ID may be emitted to Microsoft to deliver new hybrid and cloud features that the users have subscribed to. |- |Currently no such hybrid or cloud features exist.|

|Customers with their consent can send User Feedback that contains Customer Content to Microsoft.|Limit to Microsoft internal use with no third-party access. Microsoft can expose the data to the original customer. |User Feedback: Max 1 year |

Data needed to provide Internet-based services, per the SQL Server EULA.

- An IP Address with certain octets removed

- Map Data

|Scenario |Access Restrictions |Retention Requirements|

|---------|---------|---------|

|May be used by Microsoft to improve features and/or fix bugs in current features. |Limit to Microsoft internal use with no third-party access. Microsoft can expose the data to the original customer. For example, dashboards |Min 90 days - Max 3 years |

|Customers with their consent can send User Feedback that contains Customer Content to Microsoft. |Limit to Microsoft internal use with no third-party access. |Customers with their consent can send User Feedback that contains Customer Content to Microsoft. |

|Power View and SQL Reporting Services Map Item(s) may send data for use of Bing Maps. |Limit to session data |- |

Data generated in the course of running the server. The data does not contain Customer content.

Microsoft does examine Application Name values set by other programs that use SQL Server (example: Sharepoint or 3rd party packaged programs and includes this information in System Metadata sent to Microsoft when Usage Data is enabled). Customers should not

place personal data, such as end-user identifiable information, in System Metadata fields or create applications designed to store personal data in these fields.

|Scenario |Access Restrictions |Retention Requirements|

|---------|---------|---------|

|Customers with their consent can send User Feedback that contains Customer Content to Microsoft. |Limit to Microsoft internal with no third-party access. Microsoft can expose the data to the original customer. |User Feedback: Max 1 year |

|May use database name and application name to categorize databases and applications into known categories, for example, those that may be running software provided by Microsoft or other companies.|Limit to Microsoft internal with no third-party access.|Min 90 days - Max 3 years |

Data that describes or is used to configure servers, databases, tables, and other resources. Object metadata includes database table and column names but not the contents of database rows or other Customer Content. Customers should not place personal data, such as end-user identifiable information in Object Metadata fields or create applications designed to store personal data in these fields. For the permitted usage scenario's below, only hash form is used to determine usage patterns to improve the product.

- Table names and Column names

- Statistics Names

|Scenario |Access Restrictions |Retention Requirements|

|---------|---------|---------|

|May be used by Microsoft to improve features and or fix bugs in current features. |Limited to Microsoft internal use with no third-party access. |Min 90 days - Max 3 years|

[!INCLUDE[get-help-options](../includes/paragraph-content/get-help-options.md)]