Where Microsoft Bookings stores data (and GDPR requests)

What Microsoft says about storage#

From the Privacy section of the Bookings FAQ, as of September 2026:

• "All data is stored within the Microsoft 365 platform and in Exchange." Bookings follows the same data storage policies as other Microsoft 365 apps.
• "Bookings uses shared mailboxes in Exchange to store customer, staff, service, and appointment details. Compliance policies for shared mailboxes in Exchange also apply for Bookings mailboxes."
• Each new booking calendar creates an Exchange mailbox and an entry in Microsoft Entra ID, listed as an unlicensed user.
• Data can leave the production system through the Microsoft Graph and Exchange Web Services APIs, so that customers can download their own data.

There is no Bookings-specific data residency page. Where your tenant's Exchange data lives is where Bookings data lives.

To list every booking mailbox in the tenant, Microsoft's FAQ gives this Exchange Online PowerShell command:

Get-Mailbox -RecipientTypeDetails SchedulingMailbox -ResultSize Unlimited

Where copies of customer data end up#

The booking mailbox is the main store, but personal data is copied to other places during normal use. A DSR has to cover these too:

• Staff calendars. Appointments appear on the assigned staff member's Outlook calendar.
• Email. Confirmation, reminder and cancellation emails sit in customers' and staff members' inboxes.
• Exports. Anyone who downloaded the TSV report has a file with names, emails, phone numbers and custom answers. See exporting to Excel.
• Automations. Power Automate flows or scripts may have copied bookings into SharePoint, a CRM or elsewhere.

Handling GDPR requests#

Collect only what you need#

• In the Microsoft 365 admin center, Settings → Org settings → Bookings includes Restrict collection of customer data, which removes chosen fields from booking forms tenant-wide. Microsoft says org settings can take up to four hours to apply.
• Per service, keep custom questions to what you actually use. Custom questions and hiding phone or address covers the options.

Record consent#

On the booking page settings, Customer data usage consent adds a required checkbox with your own text. Microsoft says it exists "for GDPR compliance" and that the date and time of consent is recorded. The text doesn't support rich formatting, so Microsoft suggests putting links to your privacy notice in Business information, where they show below the checkbox.

Access requests#

• The customer record is on the calendar's Customers page, or via Graph (GET /solutions/bookingBusinesses/{id}/customers).
• Bookings can't list all appointments for one customer. Filter the TSV export or Graph appointment data by the person's email address instead; exporting the customer list shows both routes.
• Repeat for every booking calendar. Customer lists are per calendar, and there is no consolidated view.

Erasure requests#

1. Delete or cancel the person's appointments in the Bookings calendar.
2. Delete the customer record on the Customers page. Removing the customer does not remove their appointments, which is why step 1 comes first. For many records, see bulk deleting customers.
3. Clean up the copies listed above: exported files, flow destinations and any mail you don't have a reason to keep.
4. Check your retention policies. Because shared-mailbox compliance policies apply to booking mailboxes, a retention policy on those mailboxes can keep deleted items. Your compliance admin should confirm how your policies treat them.

To remove an entire calendar's data at once, an admin deletes the booking mailbox. That is permanent; see deleting a shared booking page.

Doing this with BookingsXP#

The BookingsXP widget stores no booking details unless you turn on its optional data layer, in which case it keeps a copy of bookings made through the widget that you would also need to include in DSR handling. BookingsXP is independent and not affiliated with or endorsed by Microsoft.