The EDPS finds the Commission's use of Microsoft 365 unlawful

2024-03-11 · Publisher : CEPD (Contrôleur européen de la protection des données) · Domain : Cloud & DevOps

The European Data Protection Supervisor finds that the Commission's use of Microsoft 365 infringes Regulation 2018/1725, notably on data transfers outside the EU. Compliance is required by 9 December 2024.

### Background On 11 March 2024, the European Data Protection Supervisor (EDPS) closes the investigation opened in May 2021 into the European Commission's use of **Microsoft 365**. It concludes that the use infringes Regulation (EU) 2018/1725, which applies to Union institutions, and issues a reprimand together with corrective measures. ### Key facts - Infringements identified: types of personal data and purposes insufficiently specified, insufficient safeguards for transfers outside the EU/EEA, no documented instructions to Microsoft. - The EDPS also notes further processing beyond the stated purposes and the lack of technical measures limiting data use to the provision of the service. - The Commission must suspend data flows to Microsoft entities located outside the EU/EEA without an adequacy decision, and map transfers by recipient and country. - Compliance deadline set for 9 December 2024. - The Commission states its commitment to compliance while warning that the measures could undermine "the current high level of mobile and integrated IT services". ### Why it matters The decision concerns one institution, but the reasoning applies to any organization entrusting data to a US provider's cloud service: map transfers, document instructions to the processor and frame purposes. It fed the debate on the sovereignty of office tools in Europe. The EDPS later announced in 2025 that the Commission had brought its use into compliance. ### Takeaway A European regulator established that even the Commission had to review its data transfers to Microsoft.

Tags : Réglementation, Europe, Données, États-Unis, Souveraineté