Cybersecurity Policy Report, Microsoft 365 Meets Privacy Requirements, German Regulator Says, (Nov 19, 2025)
The Hessian Commissioner for Data Protection and Freedom of Information (HBDI) has determined that the use of Microsoft 365 software complies with data protection regulations and can be used in the German state of Hesse.
HBDI explains in a press release that negotiations with Microsoft Corp. have been ongoing since January 2025, leading to a determination that companies and public authorities in Hesse now have “fundamental legal certainty and operational security for the data protection-compliant use of M365 products.”
Microsoft 365’s privacy compliance has been under review since regulators in 2022 decided that the software did not meet the requirements of article 28 of the European Union’s General Data Protection Regulation (GDPR).
During negotiations, the HBDI recognized that over the past three years, conditions have changed, including the legal requirements concerning the permissibility of transferring personal data to the U.S. based on the EU-U.S. Data Privacy Framework. Microsoft has also adapted its data processing to European requirements and Microsoft “provided the HBDI with a detailed explanation of changes to its data protection concept.”
Based on those changes, the HBDI concluded that companies and public authorities in Hesse now have “fundamental legal certainty and operational security” for the data protection-compliant use of Microsoft 365 products.
News: InternationalLegislation DataPrivacy GDPR