Cybersecurity Policy Report, Microsoft, EC Take Steps to Comply With EU Privacy Directive, EDPS Says, (Jul 28, 2025)

By Tony Foley

The European Data Protection Supervisor (EDPS) today said the European Commission (EC) had demonstrated compliance with the privacy and data protection law governing European Union institutions, bodies, offices, and agencies (EUIs) related to its use of Microsoft 365.

In March 2024, the EDPS ruled that the EC’s use of the software infringed several provisions of Regulation (EU) 2018/1725, including a failure to provide appropriate safeguards to ensure that personal data transferred outside of Europe had adequate levels of protection (CPR, March 24, 2024). The decision ordered the EC to suspend all data flows resulting from the use of Microsoft 365 to Microsoft, its affiliates, and sub-processors located in countries outside of Europe that are not covered by an adequacy decision and ordered the EC to submit a report by December 2024.

In a news release today, the EDPS said it held several discussions with the EC after receiving its compliance report. On the basis of those discussions, as well as a letter from the EC sent July 3 outlining addition measures taken by the EC and Microsoft, the EDPS sent a July 11 letter to the EC in which it said the infringements identified in the March 2024 decision had been remedied and that its investigation was closed.

“Thanks to our thorough investigation, and the Commission’s follow-up, we have jointly contributed to a significant improvement of data protection compliance in the Commission’s use of Microsoft 365,” said Supervisor Wojciech Wiewiórowski. “We also acknowledge and appreciate Microsoft’s efforts to align with the Commission’s requirements stemming from the EDPS decision of March 2024. This is a meaningful and shared success, and a strong signal of what can be achieved through constructive cooperation and effective supervision.”

The improvements and compliance measures taken by the EC include the following:

1. Explicit identification of the types of personal data processed and the purposes for processing in using Microsoft 365;

2. Determination of specific recipients and purposes for which personal data is transferred, complemented by technical and organizational measure implemented by the EC and Microsoft that reduce the possibility of transfers to third countries not covered by an adequacy decision; and

3. Establishment of additional contractual provisions to ensure that EU or member state law may require that Microsoft or its sub-processors omit notification to the EC of disclosure requests for personal data in the EC’s use of Microsoft 365 within the European Economic Area.

News: LitigationEnforcement DataPrivacy InternationalLegislation