EDPS - 2021-0518
EDPS reprimands EU Commission over Microsoft 365 data processing violations and suspends third-country data flows.
The European Data Protection Supervisor (EDPS) issued a reprimand against the European Commission for non-compliant processing of personal data through Microsoft 365. The decision found that Microsoft's 'EU storage guarantee' and 'EU Data Boundary' contain numerous exceptions allowing data access from third countries, and that the Commission failed to ensure proper data transfer safeguards under GDPR articles. The EDPS suspended data flows to countries without adequacy decisions effective December 9, 2024.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe European Commission failed to ensure that its use of Microsoft 365 complied with GDPR data transfer requirements, particularly by not verifying that contractual guarantees (such as the 'EU Data Boundary') were free of exceptions permitting third-country access. This case illustrates that vendor marketing claims about data residency and sovereignty do not substitute for rigorous legal and technical due diligence. Organizations cannot outsource accountability for data protection compliance to cloud providers — they remain the data controller and bear ultimate responsibility. The EDPS's suspension of data flows underscores that non-compliance carries real operational consequences, not just financial penalties.
What helps against this
How we list vendors
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.