EDPS decision on the European Commission's use of Microsoft 365 (2024)¶
Reference
Citation: European Data Protection Supervisor. "EDPS investigation into use of Microsoft 365 by the European Commission (Case 2021-0518). Decision", 8 March 2024; and press release EDPS/2025/07, "European Commission brings use of Microsoft 365 into compliance with data protection rules for EU institutions and bodies", 28 July 2025. Type: regulatory decision. Links: decision (PDF), 2025 press release (PDF).
What it is¶
The EU institutions' data protection authority found that the Commission's use of a US provider's cloud suite under the provider's standard licensing agreement infringed Regulation (EU) 2018/1725, the GDPR's counterpart for EU institutions. The infringements fall in three groups (decision, Excerpt of findings, pp. 2-4). Purpose limitation: the agreement did not "sufficiently determine the types of personal data collected ... in relation to each of the purposes of the processing", and did not ensure that the provider processes data "only on documented instructions from the Commission". International transfers: the Commission had "not appraised, either prior to the initiation of the transfers or subsequently, what personal data will be transferred to which recipients in which third countries and for which purposes", and had concluded standard contractual clauses "without having clearly mapped the proposed transfers, concluded a transfer impact assessment and included appropriate safeguards". Unauthorised disclosures: the Commission had not ensured that only EU or Member State law could prohibit the provider from notifying it of a disclosure request. The EDPS ordered the Commission to suspend, from 9 December 2024, "all data flows resulting from its use of Microsoft 365 to Microsoft and to its affiliates and sub-processors, located in third countries not covered by an adequacy decision", and to bring the processing into compliance.
The case closed on 28 July 2025. The Commission renegotiated the licensing agreement: data types and purposes specified, binding instructions to the provider and its sub-processors, transfers limited to listed countries under an adequacy decision or a public-interest derogation, and contractual provisions on disclosure notification. The EDPS summarised: "Through updated contractual, technical, and organisational measures, it has ensured that Microsoft and sub-processors process data solely based on documented instructions and only for specified purposes in the public interest" (press release, p. 1). The Commission (Case T-262/24) and Microsoft Ireland (Case T-265/24) challenged the 2024 decision before the General Court; the editor should check the current status of those cases before relying on the decision's legal reasoning.
Role in the record¶
- Grounds BP04 (bp4-a1): compliance was reached through contract terms and technical and organisational measures, not through written policy; the provider's standard terms did not meet the institution's legal duties until they were renegotiated.
- Grounds BP11 (bp11-a3): the largest EU institution needed a bespoke contract to use a US cloud suite lawfully. A research institution using an AI service under consumer or standard terms is in the position the Commission was found to be in.
- Limits: the case concerns an office suite, not an AI service, and an EU institution under Regulation (EU) 2018/1725 rather than a Member State body under the GDPR. The provisions are parallel, and the reasoning transfers; the numbering does not.
Atom-level for/against detail and quotes are in the provenance data (assets/provenance.yml), keyed by practice atom.