Show contents
Microsoft 365 combines cloud services such as Exchange Online, Teams, SharePoint and OneDrive with the familiar Office applications. Its use is neither automatically prohibited by the GDPR nor made compliant merely by signing a standard contract. The decisive factors are the specific use case, the current contractual framework, data flows, tenant configuration and the controller’s documented risk assessment.
Key information about data protection and Microsoft 365
- There is no blanket prohibition or blanket approval for Microsoft 365. Controllers must assess and document their own implementation.
- In 2022, the German Data Protection Conference criticised the standard data processing agreement it reviewed at that time. Guidance published by several German supervisory authorities in 2023 describes possible contractual and organisational improvements.
- In 2024, the Lower Saxony supervisory authority considered an individually negotiated agreement for Microsoft Teams in the state administration acceptable. An individual DPIA, data-minimising configuration and an assessment of remaining third-country transfers were still required.
- The EU Data Boundary expands storage and processing within the EU and EFTA, but does not cover every service or every possible data transfer.
- Before production use, organisations should review at least the DPA and Product Terms, subprocessors, data locations, legal bases, retention and deletion rules, transparency information, access controls, diagnostic data and the required safeguards.
Terminology: Microsoft renamed many Office 365 plans to Microsoft 365 in 2020. This page still uses “Office 365” where it refers to historical documents or established search terms.
Current assessment and primary sources
The applicable services and current contractual documents must always form the basis of the assessment. This article takes particular account of:
- the 2022 report of the German Data Protection Conference on Microsoft 365 data processing,
- the guidance issued by several German supervisory authorities on the Microsoft 365 data processing agreement,
- the Lower Saxony assessment of an individually negotiated Microsoft Teams agreement,
- the EDPS decision concerning the European Commission’s specific use of Microsoft 365,
- the current Microsoft Data Protection Addendum, and
- Microsoft’s EU Data Boundary documentation, including documented exceptions.
The EDPS decision of 2024 concerns the European Commission under the data protection rules for EU institutions. It is an important risk indicator, but it is not a general prohibition for all companies.
Historical background to Office 365 and data protection
Microsoft’s Office applications are widely established in business environments. Alongside Word, Excel and PowerPoint, Microsoft 365 includes services for email, collaboration, file storage, video communication and workflow automation. Their growing use and the scale of the data involved have repeatedly attracted scrutiny from data protection authorities.
European Data Protection Supervisor
In 2024, the European Data Protection Supervisor found infringements in the European Commission’s specific use of Microsoft 365. The findings included insufficiently defined processing purposes and safeguards for certain transfers outside the EU and EEA. Companies should treat these findings as review criteria, while assessing their own processing under the GDPR and their actual contractual and technical setup.
German Data Protection Conference
The German Data Protection Conference published its final report on the Microsoft 365 data processing agreement in 2022. Its working group concluded that the version examined did not fully meet the requirements of Article 28(3) GDPR. The conclusion related to the contractual version reviewed at that time and did not replace an assessment of individual Microsoft 365 services.
Guidance published in 2023 by several German supervisory authorities explains contractual and organisational measures that controllers should consider. Because Microsoft regularly updates its DPA, organisations must always examine the version that actually applies to their contract.
German supervisory authorities
A more recent practical example comes from Lower Saxony. In 2024, an individual data protection agreement for Microsoft Teams was negotiated for the state administration. The supervisory authority considered the data processing agreement acceptable, but continued to require internal measures, an individual DPIA, data-minimising configuration and an assessment of transfers outside the EU Data Boundary.
Schrems II and the EU-U.S. Data Privacy Framework
The Court of Justice of the European Union invalidated the former EU-U.S. Privacy Shield in its 2020 Schrems II judgment. This did not prohibit every transfer to the United States, but such transfers require a valid transfer mechanism and, depending on the recipient and risk, additional safeguards.
Since July 2023, the EU-U.S. Data Privacy Framework adequacy decision has applied to certified U.S. organisations. Controllers must nevertheless identify which Microsoft entity receives which data, for which purpose and whether the selected transfer mechanism covers the particular transfer.
GDPR assessment of Microsoft 365
Microsoft provides Microsoft 365 through an international corporate and data-centre infrastructure. For eligible customers in the European Economic Area, the EU Data Boundary covers many Microsoft 365 services and data categories. It does not guarantee that all data will remain exclusively within the EU and EFTA in every scenario. Microsoft documents continuing and temporary exceptions; optional features, support cases, diagnostic data and integrated services also require assessment.
Controllers should therefore document the commitments applying to their tenant, the Data Location Card, enabled services and documented exceptions. Blanket statements such as “all data remains in the EU” or “all metadata is transferred to the United States” are too imprecise for a reliable assessment.
For transfers to the United States, relevant mechanisms can include the EU-U.S. Data Privacy Framework for certified recipients or the EU Standard Contractual Clauses together with the required transfer and risk assessment. Incorporating a contractual clause alone does not replace that assessment.
A robust evaluation must cover Microsoft’s contractual roles, processing purposes, subprocessors, data locations, third-country transfers and the functions actually enabled in the tenant.
Is a data protection impact assessment required?
Before introducing Microsoft 365, organisations must assess and document whether their specific processing is likely to result in a high risk to the rights and freedoms of individuals. If it is, a data protection impact assessment under Article 35 GDPR is required. The assessment depends on the enabled services, data categories, groups of data subjects, processing purposes, recipients and safeguards. A DPIA is particularly likely to be required for extensive or sensitive use cases.
The threshold assessment should record at least the services used, authorised user groups, data categories, purposes, recipients, storage locations, retention periods and safeguards. Older assessments of individual Office versions cannot be transferred unchanged to a current Microsoft 365 tenant.
A current checklist for configuring Microsoft 365 with data protection in mind
No single setting makes Microsoft 365 automatically GDPR-compliant. The organisation must assess its specific tenant, enabled services, processed data and actual use cases together. This checklist is deliberately product-neutral and should be repeated whenever material changes occur.
1. Record services, data and purposes
Document which Microsoft 365 services are actually used, which categories of personal data they process and for which purposes. Include Teams, Exchange Online, SharePoint, OneDrive, mobile applications, analytics and AI-assisted features. Disable services and integrations that are not required.
2. Review contracts and roles
Review and archive the Microsoft Product Terms and the current Data Protection Addendum that apply to the contract. Microsoft’s role may vary between services and purposes and should therefore be documented for each relevant function. Subprocessors and announced contractual changes must also be included in regular reviews.
3. Assess data locations and third-country transfers
The EU Data Boundary reduces certain transfers but does not eliminate them in every scenario. Review the data locations, documented exceptions and support access that apply to the tenant. For remaining third-country transfers, document the legal basis, transfer mechanism and any necessary supplementary safeguards.
4. Secure access consistently
Use role-based access according to the need-to-know principle. Multi-factor authentication, separate administrator accounts, suitable conditional-access policies and logging of security-relevant events form part of the baseline. Access rights should be recertified regularly and accounts belonging to former staff disabled without delay.
5. Minimise diagnostics, analytics and connected features
Assess diagnostic and usage data, Connected Experiences, analytics and integrations such as LinkedIn against their specific purpose. Enable only functions that are necessary and organisationally approved. Because Microsoft regularly changes labels and settings, the options available in the tenant should be recorded and reviewed each time.
6. Define deletion, retention and recovery
Translate legal and internal retention requirements into documented policies for Exchange, Teams, SharePoint and OneDrive. Define when data is deleted, restricted, archived or retained for legal proceedings. Based on the organisation’s protection needs, assess whether Microsoft’s recovery capabilities are sufficient or whether additional backup arrangements are required.
7. Address employee data protection
Analysis of communication, activity or performance data can significantly affect employees. Such functions should be assessed under data protection and employment law before activation. Involve the data protection officer and, where required, the relevant employee representation body, and establish transparent rules of use.
8. Support transparency and data-subject rights
Update privacy notices, records of processing activities and internal procedures for access, rectification, deletion, restriction and data portability. Responsibilities and technical search procedures must allow requests to be handled within the applicable deadlines.
9. Determine whether a DPIA is required
A DPIA is not automatically required merely because of the product name. Assess whether the nature, scope, context and purposes of the specific processing are likely to create a high risk. Document the threshold assessment and, where necessary, the DPIA and its mitigating measures, and update them when the processing changes.
10. Monitor changes continuously
Microsoft 365 is a dynamic cloud service. Define fixed review intervals and a process for new services, features, contractual versions and subprocessors. Record approvals, configuration changes and residual risks in an auditable form. The Lower Saxony guidance and the 2022 German Data Protection Conference report can serve as starting points; the current contractual documents and the organisation’s specific implementation remain decisive.
Conclusion: the specific implementation is decisive
Whether Microsoft 365 can be used in compliance with the GDPR cannot be answered in the abstract for every organisation and configuration. Controllers must assess their specific deployment, restrict functions to what is necessary, review contracts and third-country transfers, implement appropriate technical and organisational measures and document their decisions.
This is not a one-off exercise. New services, revised contractual documents and tenant changes can alter the assessment. An effective data protection and information security management system establishes clear responsibilities, recurring reviews and reliable evidence.