The question of whether Microsoft 365 can be used in compliance with the GDPR has occupied public authorities, companies and, not least, data protection officers for some time. In 2020 and 2022, the German Data Protection Conference (DSK), the body representing Germany’s data protection supervisory authorities, concluded that GDPR-compliant use could not be guaranteed. The Hessian Commissioner for Data Protection and Freedom of Information (HBDI) has now reached a different conclusion. At first glance, the HBDI report suggests that GDPR-compliant use may no longer be ruled out, but only under certain conditions. In the following sections, we examine the background, the current position and the data protection risks that still remain when using Microsoft 365.
Table of Contents
“HBDI: Microsoft 365 can be used in compliance with data protection law” - under laboratory conditions and with blinkers on
In mid-November, the Hessian Commissioner for Data Protection and Freedom of Information (HBDI) announced:
“Microsoft 365 can be used in compliance with data protection law in Hesse.” [1]
This message was immediately picked up by many media outlets, often with the implication that Microsoft 365 had now officially been given the green light for public authorities. It has not.
What the report actually says:
The underlying report is extensive, but its central conclusions can be reduced to a few points:
- Microsoft has revised its contractual framework.
- On the basis of these documents, the HBDI now considers it possible to operate Microsoft 365 in formal compliance with data protection law.
- To do so, however, public authorities must configure a whole series of settings correctly and review them continuously.
Crucially: the report assesses Microsoft’s documentation and contractual position, not actual technical control over Microsoft’s systems. And above all:
The report does not say that Microsoft 365 is risk-free.
It merely says that, under certain conditions, the service can formally comply with the requirements of the GDPR.
Background and substance of the Hesse report
The new HBDI report was necessary because the German Data Protection Conference (DSK) had already reached a critical conclusion in 2022: on the basis of the contractual position at the time, “data protection-compliant operation of Microsoft 365 could not be demonstrated”. In other words, in the DSK’s view, GDPR-compliant use of Microsoft 365 could not be guaranteed.
The reasons were varied and related in particular to the use of data for Microsoft’s own business activities, unrestricted changes to subprocessors, insufficient commitments regarding technical and organisational measures, and unlawful transfers to third countries.
The HBDI has now examined what has changed since then and concludes that, on the basis of the new documentation, GDPR compliance may be possible, but only under strict conditions and solely on the basis of the paperwork rather than a technical inspection.
So what has improved since 2022, and what has not? Some of the main points of criticism and the corresponding changes are shown below:
| Criticism in 2022: Microsoft 365 not compliant with data protection law | What has changed according to the HBDI in 2025: is Microsoft 365 now GDPR-compliant? |
|---|---|
| Microsoft grants itself unspecified rights to process our data for its own business activities. | Microsoft states that this only concerns aggregated and anonymised data. |
| In its data processing agreement, Microsoft reserves extensive rights to process data without instructions from the controller and to disclose it, including to third countries. | Microsoft has committed not to do this any longer. |
| When operating Microsoft 365, Microsoft transfers personal data unlawfully to the USA and other countries. | Microsoft has changed its data processing so that only a small proportion now takes place in the USA and other third countries. Transfers to third countries are, however, expressly acknowledged. There are also the Standard Contractual Clauses and the “Data Privacy Framework”. |
This leads to the new assessment that GDPR-compliant use may be possible. However, it comes with a whole series of very specific recommendations and required settings, an indication of just how narrow and fragile this possibility actually is.
| What is the EU-US Data Privacy Framework? |
|---|
The EU-US Data Privacy Framework (DPF) is the current attempt to provide a legally secure basis for data transfers to the USA. It is the third attempt after two failed predecessors:
|
Why “formal GDPR compliance” is not enough
A crucial weakness in the current debate is the equation of formally meeting data protection requirements with actual security. They are not the same thing, and with cloud services operated by a US corporation, the gap could hardly be greater.
Of course, Microsoft 365 now offers countless data protection settings. Telemetry can be reduced, data regions can be selected and certain processing operations can be objected to. All these settings create the impression that you have complete control over what happens to the data. But ultimately, that is exactly what it remains: an impression.
Neither public authorities nor external auditors have the technical or legal means to independently inspect Microsoft’s internal processes. Whether the “boxes you tick” really do everything they promise is beyond European control and ultimately relies on trust in a US company that is required to comply with US law.
Formal GDPR compliance therefore means only this:
On paper, everything is configured correctly.
It does not mean:
That the data is fully protected or processed without risk.
For private companies, that may be a calculable risk. For public bodies, it is not.
The real sticking point: the CLOUD Act, and why it overrides every safeguard in practice
The biggest blind spot in the entire Microsoft 365 debate is not the technology, the encryption or even the question of which data centre stores the data.
The decisive issue is US law, to which Microsoft, as a US company, is subject.
The CLOUD Act requires US providers to disclose data to US authorities -
regardless of where that data is stored
and
regardless of which privacy settings the customer has selected.
Whether the data is stored in Frankfurt or China, processed within an EU data region or encrypted is not decisive for US law enforcement authorities. What matters is that Microsoft is a US company.
This places a legal framework above every GDPR safeguard that cannot be controlled from Europe.
It is a structural risk that cannot be configured away.
And that leaves an uncomfortable truth:
- No box in the settings prevents access by US authorities.
- No Microsoft contract can override the CLOUD Act.
- No European documentation changes that.
For many companies, this residual problem may be manageable, particularly where customer data is concerned, given that customers are tracked to the maximum at every turn anyway.
But for the state, for administrations, courts, ministries, police forces or critical public authorities?
There, this is not about convenience or tool preferences. It is about the fundamental question of who is given control over government communications and sensitive processes.
| Marketing gimmick: “Hosting in Germany” |
|---|
Many cloud providers, including Microsoft, advertise that data is stored “in Germany” or “in the EU”.
In short: the server location is marketing. The legal position is what matters. Microsoft itself, incidentally, communicates this too.[2] |
Another risk: political influence beyond European control
And even if Microsoft 365 could be operated in compliance with the GDPR, there is a third factor alongside data protection law and technology that, understandably, does not appear in the Hesse report: geopolitics. The HBDI assesses data protection, not digital sovereignty. Yet this is precisely where dependence on Microsoft becomes particularly sensitive.
Microsoft has already shown that, in politically sensitive situations, it is prepared to restrict access to critical communications, without a court order, without a transparent process and in anticipatory compliance with US policy.
The email account of the Chief Prosecutor of the International Criminal Court (ICC), for example, was temporarily blocked. Not because of technical problems and not because of a court order, but in the context of US sanctions intended to put political pressure on the ICC.[3]
For the ICC, this was a warning sign: if an external provider can shut off access at a critical moment, the institution is vulnerable. The consequence: the Court is moving its infrastructure to European alternatives.[4]
Perhaps we are missing something, but:
An international court investigates, Trump does not like it one bit, and Microsoft 365 pre-emptively starts throttling the lines?
The International Criminal Court responds by rebuilding its entire infrastructure.
And Hesse headlines: “Microsoft 365 can be used in compliance with data protection law.”
The right message? A simple test of the objectivity of the situation would be to reverse the roles: how would we react if the potential actor were not Microsoft from the USA, but Alibaba Cloud from China or Yandex from Russia?
Conclusion - the uncomfortable truth
The HBDI’s declaration that Microsoft 365 can be “used in compliance with data protection law” is formally correct, but misleading in practice.
Not because the report is wrong, but because it considers only half of the reality.
As long as a US provider is subject to US law, even the most strictly and carefully configured cloud remains a system that is ultimately subject to American law and American politics, and one that European authorities cannot fully inspect or regulate, either technically or legally.
The consequence is unavoidable: assumptions and trust become part of the model. But trust is not a basis for government IT security and data protection.
That is precisely why it would be dangerous to treat the Hesse report as a free pass: tick a few settings, cite the report, and consider the issue closed.
The easy route is often the wrong one, particularly when it entrenches dependencies, ignores risks and overlooks political factors.
And Europe is not short of alternatives. Solutions exist that operate without Cloudflare, Amazon, Google or Microsoft while still being feature-rich, reliable and attractively priced.
Sources:
[1] https://datenschutz.hessen.de/presse/hbdi-microsoft-365-kann-datenschutzkonform-genutzt-werden
[2] https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/
Together with the Federal Office for Information Security (BSI), we conducted a security survey for the first time. The participating companies had high requirements for data protection, cybersecurity and anonymity. LamaPoll met them very well, both technically and organisationally. A contact person was also available whenever needed. We are extremely satisfied with the cooperation.
Do you have questions for our team?
We will be happy to answer any questions you have about security at LamaPoll.
Please feel free to contact us.
