German regulator approves Microsoft 365 for GDPR compliance

The Hessian Data Protection Commissioner concluded on November 15, 2025, that Microsoft 365 cloud services can operate in compliance with the General Data Protection Regulation, marking a significant shift from the authority's position three years earlier when it identified seven critical deficiencies in Microsoft's data processing agreements.

According to Professor Dr. Alexander Roßnagel, the Hessian Data Protection and Freedom of Information Commissioner, the 137-page assessment represents the outcome of negotiations that began in January 2025. "We have constructively examined under what conditions practical and data protection-compliant use of M365 is possible in the interests of users," Roßnagel stated in the official announcement. The finding provides organizations and public authorities in Hesse with fundamental legal certainty for deploying Microsoft 365 products.

The evaluation does not constitute a technical examination of individual M365 services. Rather, the Hessian authority focused exclusively on whether Microsoft's Data Protection Addendum addresses the seven deficiencies that the Conference of Independent Data Protection Authorities identified in November 2022. At that time, the conference determined that controllers could not demonstrate GDPR-compliant operation of M365 based on the Data Protection Addendum dated September 15, 2022.

Microsoft provides M365 as a cloud service where Microsoft functions as the data processor and the customer organization serves as the controller under GDPR terminology. The September 2022 Data Protection Addendum failed to meet Article 28 GDPR requirements for processors across seven specific areas, which became the benchmark for subsequent negotiations.

Three structural changes enabled the new assessment. Legal frameworks shifted, most notably through the adoption of the EU-US Data Privacy Framework that permits personal data transfers to the United States. Microsoft adjusted its data processing architecture to handle almost all personal data within the European Economic Area through what Microsoft terms an "EU data boundary." The company also expanded explanations of its data protection concepts to the Hessian authority and developed the Data Protection Addendum specifically for public sector clients.

The first deficiency addressed inadequate specification of processing types, purposes, personal data categories, and affected groups. Microsoft provided enhanced documentation that enables controllers to obtain sufficient information about Microsoft's data processing operations and integrate this information into their processing records. The authority concluded that public sector controllers now have access to adequate information about how Microsoft processes their data.

Concerning the second issue of Microsoft reserving insufficiently defined rights for its own business activities, the company clarified that it processes only log and diagnostic data in anonymized and aggregated form for the controller's purposes, not content data. This processing either falls outside GDPR scope or represents acceptable data protection practice, according to the Hessian assessment.

The third deficiency involved Microsoft reserving extensive authority to process data without controller instruction and disclose data to third countries. The updated Data Protection Addendum commits Microsoft to processing personal data only upon documented customer instruction and subjects disclosure practices to GDPR requirements. Microsoft now contractually binds itself to process data exclusively based on explicit controller direction.

Fourth, Microsoft's previous failure to commit to implementing required technical and organizational security measures has been resolved. The current Data Protection Addendum obligates Microsoft to comply fully with GDPR requirements without exceptions. The company now contractually commits to maintaining security standards mandated by the regulation.

The fifth shortcoming concerned inadequate return and deletion obligations. Microsoft now offers a deletion process and enables all customers to delete data themselves or request expedited deletion when necessary. Controllers maintain direct deletion capabilities rather than depending exclusively on Microsoft's standard deletion timelines.

Regarding the sixth issue of insufficient advance notification about subprocessor changes, Microsoft maintains detailed information about every subprocessor in its Service Trust Portal. The company provides this information six months in advance for most subprocessors and one month for others, ensuring customers can review subprocessor arrangements without difficulty. All customers receive notifications enabling them to assess new subprocessor relationships.

The seventh and most politically sensitive issue involved unlawful data transfers to the United States and other jurisdictions. Microsoft now processes data almost entirely within the European Economic Area. Remaining data transfers to the United States and other countries rely on European Commission adequacy decisions and Standard Contractual Clauses. The EU-US Data Privacy Framework, adopted since the 2022 assessment, provides legal foundation for transatlantic transfers that did not exist when regulators initially identified this deficiency.

The positive determination rests on expectations that Microsoft and controllers will collaborate to enable compliant M365 usage. The report concludes with implementation recommendations for both public and private sector organizations in Hesse. These guidelines enable controllers to conduct detailed data protection assessments of specific M365 components for their intended deployments.

The Hessian authority's jurisdiction extends only to one of Germany's 16 federal states, each maintaining independent data protection supervisory authority. The assessment does not bind other German states or European data protection authorities, though it may prove persuasive based on its substantive analysis. Germany has separately proposed sweeping GDPR reforms that extend far beyond current simplification efforts.

The finding arrives amid ongoing concerns about Microsoft's ability to protect European data from US government access. Microsoft France's Director of Public and Legal Affairs testified under oath in June 2025 that the company cannot guarantee French citizen data will never be transmitted to US authorities without explicit French authorization. The testimony highlighted tensions between contractual data protection commitments and the extraterritorial reach of the US Cloud Act.

Microsoft made additional materials available including the M365-Kit designed to support controllers with their data protection documentation obligations. The company developed these resources specifically to address implementation challenges that organizations face when attempting to document M365 data processing activities.

The assessment methodology focused on legal and contractual analysis rather than technical infrastructure examination. The Hessian authority did not conduct security audits of Microsoft's data centers or verify technical implementations of security controls. Instead, evaluators concentrated on whether contractual frameworks now provide adequate legal foundation for compliant usage.

Implementation recommendations emphasize that controllers must conduct their own assessments. Organizations should evaluate individual M365 components for specific use cases rather than assuming blanket approval for all services. The authority's positive determination establishes that compliant usage is possible, not that all M365 deployments automatically achieve compliance.

Controllers bear responsibility for configuring M365 appropriately, implementing necessary safeguards, and documenting processing activities. The assessment provides framework but does not substitute for organization-specific compliance work. Public and private sector entities must still conduct data protection impact assessments for high-risk processing operations.

The three-year evolution from identification of seven critical deficiencies to approval demonstrates how regulatory negotiations can yield substantive improvements in cloud service provider practices. Microsoft made specific contractual commitments and architectural changes rather than merely providing additional documentation about unchanged practices.

Microsoft's EU data boundary represents technical infrastructure investment beyond contractual language adjustments. Processing personal data within the European Economic Area addresses data localization concerns while maintaining operational capabilities. The approach differs from pure data residency requirements by permitting limited transfers under appropriate legal frameworks.

The assessment acknowledges remaining challenges despite overall positive determination. Technical complexity of cloud services creates inherent documentation difficulties. Distributed architectures where multiple subprocessors handle different processing operations require sophisticated contractual frameworks. Controllers must understand these technical realities to implement effective oversight.

Organizations evaluating Microsoft 365 adoption should review the full 137-page report alongside Microsoft's updated Data Protection Addendum and implementation guidance. The Hessian authority's analysis provides detailed reasoning about each previously identified deficiency and Microsoft's remedial actions.

Marketing technology professionals should note that GDPR compliance frameworks continue evolving alongside broader regulatory changes affecting data processing. The European Commission proposed substantial GDPR amendments through its Digital Omnibus initiative that could alter compliance requirements for AI development and automated decision-making systems.

The November 15 determination applies specifically to Microsoft 365 as documented in the current Data Protection Addendum. Future product changes, service expansions, or modified processing practices may require reassessment. Controllers should monitor Microsoft's communications about material changes to data processing architectures or contractual frameworks.

Timeline

• September 15, 2022: Microsoft publishes Data Protection Addendum that German authorities later determine fails GDPR Article 28 requirements
• November 2022: Conference of Independent Data Protection Authorities determines controllers cannot prove M365 GDPR compliance based on existing DPA
• January 2025: Hessian Data Protection Commissioner begins negotiations with Microsoft about M365 data processing practices
• June 10, 2025: Microsoft France director testifies under oath company cannot guarantee French data protection from US government
• July 28, 2025: European Data Protection Supervisor closes Microsoft 365 enforcement investigation despite Cloud Act vulnerabilities
• September 11, 2025: Dutch education cooperative SURF downgrades Copilot privacy risks while maintaining concerns
• November 15, 2025: Hessian Data Protection Commissioner publishes 137-page report concluding Microsoft 365 can operate within GDPR requirements

Summary

Who: The Hessian Data Protection and Freedom of Information Commissioner (HBDI), led by Professor Dr. Alexander Roßnagel, evaluated Microsoft's cloud service compliance. Microsoft functions as data processor while customer organizations serve as controllers under GDPR definitions.

What: The authority determined Microsoft 365 can now operate in compliance with GDPR requirements after resolving seven critical deficiencies previously identified in the company's Data Protection Addendum. Microsoft made contractual commitments, implemented EU data boundary infrastructure, and provided enhanced documentation enabling controllers to demonstrate compliant usage.

When: The 137-page report was published November 15, 2025, following negotiations that began in January 2025. The assessment addresses deficiencies identified by German data protection authorities in November 2022 regarding Microsoft's September 15, 2022 Data Protection Addendum.

Where: The determination applies specifically to Hesse, one of Germany's 16 federal states with independent data protection authority. Microsoft processes data almost entirely within the European Economic Area through its EU data boundary, with limited transfers to the United States under EU-US Data Privacy Framework and Standard Contractual Clauses.

Why: The assessment matters because Microsoft 365 represents widely deployed cloud infrastructure for organizations throughout Europe. The positive determination provides legal certainty for Hessian organizations while demonstrating how three years of regulatory negotiations yielded substantive improvements in cloud provider data protection practices, contractual frameworks, and technical architectures.