[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxhATUgntXtbgGdIRVCsObl7h440xMKwduLP0QUUuxDY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"45ba66a6-951d-4a72-993a-ef0bfcb5f0ef","eu-commission-reprimanded-for-unlawful-data-transfers-via-microsoft-365","8a521290-d9d0-4e1e-beef-2aba3cbda43d","EU Commission Reprimanded for Unlawful Data Transfers via Microsoft 365","The European Commission failed to ensure that its use of Microsoft 365 complied with GDPR data transfer requirements, particularly by not verifying that contractual guarantees (such as the 'EU Data Boundary') were free of exceptions permitting third-country access. This case illustrates that vendor marketing claims about data residency and sovereignty do not substitute for rigorous legal and technical due diligence. Organizations cannot outsource accountability for data protection compliance to cloud providers — they remain the data controller and bear ultimate responsibility. The EDPS's suspension of data flows underscores that non-compliance carries real operational consequences, not just financial penalties.","**Immediate actions:**\n- Conduct a full audit of all cloud service agreements to identify contractual exceptions that permit third-country data access.\n- Suspend or restrict data flows to cloud vendors in non-adequate countries until appropriate transfer mechanisms (SCCs, BCRs) are verified and documented.\n\n**Vendor & Supply Chain due diligence:**\n- Require cloud providers to supply technical evidence — not just contractual assurances — of data residency and access controls before onboarding.\n- Establish a formal third-party risk assessment process that evaluates GDPR transfer compliance as a mandatory checkpoint for all SaaS\u002Fcloud procurement.\n- Map all personal data flows across cloud services and update Records of Processing Activities (RoPAs) to reflect actual transfer destinations.\n\n**Long-term governance improvements:**\n- Implement a Data Transfer Impact Assessment (DTIA) process for every third-country transfer, reviewed annually or upon contractual change.\n- Train procurement, legal, and IT teams on GDPR Chapter V obligations so that compliance requirements are embedded at the point of vendor selection.\n- Establish continuous monitoring of vendor compliance posture, including tracking regulatory decisions (adequacy rulings, SCCs updates) that may affect transfer legality.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 44 — General principle for transfers","GDPR Article 46 — Transfers subject to appropriate safeguards","GDPR Article 28 — Processor obligations","GDPR Article 30 — Records of processing activities","NIST SP 800-53 SA-9 (External Information System Services)","NIST SP 800-53 PT-7 (Specific Categories of Personally Identifiable Information)","NIST Privacy Framework GV.PO-P2 (Privacy risk management policies)","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management","ITIL Service Design — Supplier Management Process","ENISA Cloud Security Guide for SMEs — Third-country transfer risk",{},"published","2026-07-17T14:21:00.069084+00:00","2026-07-17T14:20:59.934+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=EDPS_-_2021-0518&diff=52391&oldid=42245","edps-2021-0518-b3b20a","EDPS - 2021-0518",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":57,"name":58,"problem":59},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":61,"name":62,"problem":63},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]