{"id":3816,"date":"2026-10-05T20:21:19","date_gmt":"2026-10-05T18:21:19","guid":{"rendered":"https:\/\/www.klytic.com\/?page_id=3816"},"modified":"2026-10-06T10:38:07","modified_gmt":"2026-10-06T08:38:07","slug":"gdpr-microsoft-365","status":"publish","type":"page","link":"https:\/\/www.klytic.com\/en\/gdpr-microsoft-365\/","title":{"rendered":"GDPR and Microsoft 365: what a business needs to check"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3816\" class=\"elementor elementor-3816 elementor-3737\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7f9d9d1 e-con-full kly-g e-flex e-con e-parent\" data-id=\"7f9d9d1\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-85c4db7 e-con-full kly-g-hero e-flex e-con e-parent\" data-id=\"85c4db7\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-b1b03b6 e-con-full kly-g-hero-in e-flex e-con e-parent\" data-id=\"b1b03b6\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5c7f6c2 elementor-widget elementor-widget-text-editor\" data-id=\"5c7f6c2\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/#souverainete\">Sovereignty<\/a><\/p><p class=\"kly-g-pill\" style=\"--pill:#38bdf8\">Sovereignty<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-31174b6 elementor-widget elementor-widget-heading\" data-id=\"31174b6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">GDPR and Microsoft 365: what a business needs to check<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-85dbe59 elementor-widget elementor-widget-text-editor\" data-id=\"85dbe59\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-lead\">Microsoft 365 can be used within a GDPR framework. The regulation does not prohibit US software vendors. It requires you to know who processes what, on what basis data leave the Union, and how individuals exercise their rights. Here is what a business needs to check, in order, and what it needs to write in its record.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-05d6d0b elementor-widget elementor-widget-text-editor\" data-id=\"05d6d0b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>9 min<\/b> read<\/span><span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-defe9c9 e-con-full kly-g-body e-flex e-con e-parent\" data-id=\"defe9c9\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-8906b9b e-con-full kly-g-article e-flex e-con e-parent\" data-id=\"8906b9b\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4bf115b elementor-widget elementor-widget-text-editor\" data-id=\"4bf115b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>1. The role of each party<\/h2><p>For the content of the mailboxes, files and teams you administer, the customer is generally the controller. Microsoft is the processor. For certain account, billing, security and service measurement data, Microsoft may be a separate controller. The Data Processing Addendum and the Microsoft Privacy Statement distinguish between these cases.<\/p><p><strong>How to check.<\/strong> The role determines the obligations. Read the two documents side by side and place each category of data in a box. A 25-person accounting firm, for example, will have on one side emails and client files (Microsoft as processor), and on the other the billing of the subscription (Microsoft as separate controller).<\/p><p><strong>In the record.<\/strong> One line per processing activity, with Microsoft\u2019s role and the document on which it is based.<\/p><p><strong>Common mistake.<\/strong> Writing \u201cMicrosoft is our processor\u201d for the service as a whole.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c7cabcc elementor-widget elementor-widget-text-editor\" data-id=\"c7cabcc\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>2. The DPA is signed, and it covers the services actually enabled<\/h2><p>The Microsoft DPA is incorporated into the online terms. Check that it covers the services you have switched on: Exchange, SharePoint, OneDrive, Teams, Planner, Copilot, Power Automate, and any connector.<\/p><p><strong>How to check.<\/strong> A tenant evolves beyond the initial order. Compare the list of services switched on in the admin center with the scope of the DPA, and archive the version of the DPA in force on the date of the check.<\/p><p><strong>In the record.<\/strong> The service, the activation date, the purpose. A service enabled by an administrator \u201cto try it out\u201d enters the record on the day it processes data of your employees or your customers.<\/p><p><strong>Common mistake.<\/strong> Assuming that a connector to a third-party tool falls under the Microsoft DPA. The third party has its own terms, which must be read separately.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c8a67db elementor-widget elementor-widget-text-editor\" data-id=\"c8a67db\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>3. Where the data are, service by service<\/h2><p>For an eligible tenant, Microsoft describes the EU Data Boundary: customer data and pseudonymised personal data stored and processed in the EU or EFTA, professional services data stored at rest in that area. Three checks avoid mistaking the announcement for a complete scope.<\/p><ul><li>Is the tenant within the scope? A Multi-Geo customer is not, according to Microsoft\u2019s documentation, even if the country of registration is European.<\/li><li>Which exceptions continue? Remote access by support from outside the area for certain incidents, elements of escalated tickets stored outside the area, support voicemails, optional features.<\/li><li>Which services outside the core (Copilot, Teams telephony, connectors) cause a transfer because the administrator has enabled them?<\/li><\/ul><p><strong>Why.<\/strong> The boundary is a scope with published exceptions, and it is these exceptions that your record must account for. The page <a href='\/en\/data-hosted-in-europe\/'>data hosted in Europe<\/a> explains why this list is the real issue.<\/p><p><strong>How to check and record.<\/strong> Compare the tenant\u2019s configuration (Multi-Geo or not, optional features enabled) with Microsoft\u2019s exceptions page, line by line, and note in the record those that apply to you.<\/p><p><strong>Common mistake.<\/strong> Copying \u201cdata in Europe\u201d into the privacy policy without mentioning support or optional features.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1866c19 elementor-widget elementor-widget-text-editor\" data-id=\"1866c19\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>4. The legal basis for the transfer<\/h2><p>When personal data are accessible from the United States or transferred to a US organisation, the transfer must have a legal basis: an adequacy decision, standard contractual clauses, or another tool under Article 46 of the GDPR.<\/p><p>As of 5 October 2026, Decision (EU) 2023\/1795 (Data Privacy Framework) is in force for certified US organisations. It is being challenged before the Court of Justice and is the subject of a political review. According to a commentary by the law firm WilmerHale, the General Court of the European Union dismissed an action for annulment on 3 September 2025, and an appeal was lodged before the Court of Justice on 31 October 2025. The law firm DAC Beachcroft sums up the situation in the title of its own commentary: stability for now, uncertainty ahead. Until the decision is withdrawn or annulled, the transfers it covers can rely on it.<\/p><p>The precedent explains the caution. On 16 July 2020, in judgment C-311\/18 (known as Schrems II), the Court of Justice invalidated Decision 2016\/1250 (Privacy Shield), owing in particular to the scope of US surveillance programmes and the lack of effective redress. Standard contractual clauses remained valid, but they require a case-by-case assessment.<\/p><p>The CLOUD Act is not something that is \u201csigned\u201d in the DPA. It applies, where relevant, to Microsoft as a US company that holds or controls the data. Article 48 of the GDPR provides, for its part, that a judgment of a court or a decision of an authority of a third country requiring the disclosure of personal data may only be recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty, in force between that country and the Union or the Member State. A US provider operating in Europe may therefore find itself caught between two rules. Article 48 describes this conflict; it does not resolve it.<\/p><p>On 10 June 2025, before the French Senate commission of inquiry on public procurement, the director of public and legal affairs of Microsoft France was asked whether he could guarantee under oath that the data of French citizens entrusted to Microsoft via Ugap would never be transmitted, following an order from the US government, without the explicit consent of the French authorities. He replied: \u201cNo, I cannot guarantee it, but, once again, it has never happened yet.\u201d The details are in <a href='\/en\/protect-business-cloud-act\/'>protect a business from the CLOUD Act<\/a>.<\/p><p><strong>In the record.<\/strong> The legal basis for each transfer, and the fallback plan: the Article 46 tool you would rely on if the decision fell.<\/p><p><strong>Common mistake.<\/strong> Confusing location (point 3) with the legal basis for the transfer. Data stored in Europe may remain accessible from the United States.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b9a255 elementor-widget elementor-widget-text-editor\" data-id=\"8b9a255\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>5. Data subject rights, in practice<\/h2><p>An employee or a customer may request access, rectification, erasure, restriction or portability. On Microsoft 365, part of this is done in the admin center and the content search tool.<\/p><p><strong>How to check.<\/strong> The time limit is one month. The processor provides the means; the controller answers the individual. Run a dry test: the designated person extracts, for a test account, the mailbox, the OneDrive and the Teams files.<\/p><p><strong>In the record.<\/strong> The procedure, and the names of the person in charge and their deputy.<\/p><p><strong>Common mistake.<\/strong> Waiting for a former employee in a dispute to make a request before discovering the search tool.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bdf19dd elementor-widget elementor-widget-text-editor\" data-id=\"bdf19dd\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>6. Retention and exit<\/h2><p>Retention of shared mailboxes, logs, meeting recordings, legal hold copies (litigation hold). On termination, what happens to the tenant, within what time frame, and in what format do you recover messages, files and what cannot be exported (full history of Teams conversations, certain Power Automate flows)?<\/p><p><strong>How to check.<\/strong> Record the retention periods actually configured, not those in the internal policy, and test the full export of an account.<\/p><p><strong>In the record.<\/strong> A retention period per category, the justification for each legal hold, the exit procedure.<\/p><p><strong>Common mistake.<\/strong> Leaving a legal hold active for years after the end of the dispute that justified it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e02c46d elementor-widget elementor-widget-text-editor\" data-id=\"e02c46d\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>7. Instructions to users<\/h2><p>Copilot and analysis features process the content you give them. If you enable them, informing employees and setting a framework for use are part of compliance. This point is internal to your business. It does not depend on the country of the datacenter.<\/p><p><strong>How to check.<\/strong> Is there an information notice, and does a rule state which data may be submitted to these features?<\/p><p><strong>Common mistake.<\/strong> Opening a Copilot pilot to one team without informing the other people whose data appear in the files processed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0e2b49 elementor-widget elementor-widget-text-editor\" data-id=\"f0e2b49\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Frequently asked questions<\/h2><h3>Does the GDPR prohibit Microsoft 365?<\/h3><p>No. The regulation governs roles, transfers and data subject rights. It does not prohibit a software vendor on the grounds of its nationality; it requires you to document what you do and on what legal basis.<\/p><h3>Does the EU Data Boundary settle the CLOUD Act question?<\/h3><p>No. It describes where certain data are stored and processed. Microsoft remains a US company, and 18 U.S.C. \u00a7 2713 targets the data that a provider holds or controls, wherever they are.<\/p><h3>What should we do if the Data Privacy Framework is annulled?<\/h3><p>The record should already say so. After Schrems II, standard contractual clauses remained valid, with a case-by-case assessment. Preparing it in advance avoids having to draft it in a hurry.<\/p><h3>Who answers an employee who asks for their data?<\/h3><p>You do, as the controller. Microsoft provides the extraction tools; the answer and the one-month time limit are your responsibility.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d8ea4da elementor-widget elementor-widget-text-editor\" data-id=\"d8ea4da\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>When the check concludes with \u201cwe are staying\u201d<\/h2><p>It concludes this way when Microsoft tools are at the core of the business, the DPA is in place, the residency scope is understood, and the record documents the residual transfers. Changing suites does not become a GDPR obligation merely because the software vendor is American.<\/p><p>The arguments for staying are serious. An engineering firm that lives in advanced Excel, Power BI and Teams would lose features by changing suites, and a migration carries its own risks. A well-documented Microsoft tenant is more compliant than a poorly documented alternative. The decision should be reviewed if the legal basis for transfers changes. The trade-offs are detailed in <a href='\/en\/microsoft-365-vs-sovereign-solution\/'>staying with or leaving Microsoft 365<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e3ab0f0 elementor-widget elementor-widget-text-editor\" data-id=\"e3ab0f0\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>When the check concludes with \u201cwe are changing operator\u201d<\/h2><p>It concludes this way when management wants a European company to hold the content, or when the transfer and support access exceptions exceed what the record can account for. It can also come from customers: a tender that requires a European operator settles the question for the scope concerned.<\/p><p>This conclusion has its arguments. When the operator is European and does not depend on a US group for possession of the data, the conflict described in point 4 no longer arises for those data, provided that its sub-processors do not reintroduce a US provider. It exempts you from nothing else: a processing agreement, the record, a procedure for data subject rights and a tested exit remain necessary. The page <a href='\/en\/migrate-from-microsoft-365\/'>migrate from Microsoft 365<\/a> describes what this change involves, without presenting it as an automatic step, and the <a href='\/en\/microsoft-365-migration-checklist\/'>migration checklist<\/a> breaks it down into stages.<\/p><p>Klytic, operated by the French company Dedicace Software, is one of the options if your uses fit within email, documents (sharing, online editing alone or with others, version history), video conferencing, CRM and telephony. The services are purchased separately; you can also keep Microsoft 365 and add only Klytic MTA filtering, placed in front of it. Hosting is provided in any geographical area corresponding to the applicable jurisdiction, subject to the availability of the required services, for example in Europe or Mauritius, or on the customer\u2019s servers. The data are held by the customer, or by Klytic on the customer\u2019s behalf, and encrypted natively or according to the customer\u2019s choice; the key is held by the customer or kept in the customer\u2019s account, and Klytic has no access to it. The stages where encryption is managed by Klytic are detailed on the page <a href='\/en\/protect-business-cloud-act\/'>protect a business from the CLOUD Act<\/a>. The contract must describe this possession and this encryption. Klytic does not replicate advanced Excel, Power BI or Teams. It does not hold the SecNumCloud qualification, and a French operator remains subject to French law.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fa3685a kly-g-disclaimer elementor-widget elementor-widget-text-editor\" data-id=\"fa3685a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This page describes a general framework. It does not constitute legal advice.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-96c28e5 kly-g-legal elementor-widget elementor-widget-text-editor\" data-id=\"96c28e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Legal status as of 5 October 2026.<\/b> This text does not replace a contract review. The EU\u2013US adequacy decision (EU) 2023\/1795 is in force. It is being challenged. The ANSSI catalogue is authoritative for SecNumCloud.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7d56f29 kly-g-sources elementor-widget elementor-widget-text-editor\" data-id=\"7d56f29\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Sources<\/h2><p>Accessed in October 2026.<\/p><ul><li>Regulation (EU) 2016\/679, Articles 28 (processor), 44 to 49 (transfers), including Article 48 (decisions of third-country authorities). <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:32016R0679' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>Microsoft, Data Protection Addendum (DPA). <a href='https:\/\/www.microsoft.com\/licensing\/docs\/view\/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA' rel='noopener' target='_blank'>Microsoft Licensing<\/a><\/li><li>Microsoft, EU Data Boundary: scope, eligibility, exclusion of Multi-Geo. <a href='https:\/\/learn.microsoft.com\/en-us\/privacy\/eudb\/eu-data-boundary-learn' rel='noopener' target='_blank'>Microsoft Learn<\/a><\/li><li>Microsoft, transfer exceptions, including support. <a href='https:\/\/learn.microsoft.com\/en-us\/privacy\/eudb\/eu-data-boundary-transfers-for-all-services' rel='noopener' target='_blank'>Microsoft Learn<\/a><\/li><li>Decision (EU) 2023\/1795. <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:32023D1795' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>Court of Justice of the European Union, 16 July 2020, C-311\/18 (Schrems II). <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:62018CJ0311' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>On the Data Privacy Framework litigation, lawyers\u2019 commentary, not a decision: WilmerHale, \u201cEuropean Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework\u201d, 1 December 2025. <a href='https:\/\/www.wilmerhale.com\/en\/insights\/blogs\/wilmerhale-privacy-and-cybersecurity-law\/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework' rel='noopener' target='_blank'>wilmerhale.com<\/a><\/li><li>On the litigation and the ongoing review, lawyers\u2019 commentary, not a decision: DAC Beachcroft, \u201cThe EU\u2013US Data Privacy Framework: stability for now, uncertainty ahead\u201d. <a href='https:\/\/www.dacbeachcroft.com\/en\/What-we-think\/The-EU-US-Data-Privacy-Framework-Stability-for-now-uncertainty-ahead' rel='noopener' target='_blank'>dacbeachcroft.com<\/a><\/li><li>18 U.S.C. \u00a7 2713. <a href='https:\/\/www.govinfo.gov\/content\/pkg\/USCODE-2023-title18\/html\/USCODE-2023-title18-partI-chap121-sec2713.htm' rel='noopener' target='_blank'>govinfo<\/a><\/li><li>French Senate, commission of inquiry on public procurement, record of the week of 9 June 2025 (hearing of 10 June 2025). <a href='https:\/\/www.senat.fr\/compte-rendu-commissions\/20250609\/ce_commande_publique.html' rel='noopener' target='_blank'>senat.fr<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-30fbf82 e-con-full kly-g-aside e-flex e-con e-parent\" data-id=\"30fbf82\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-e93e663 elementor-widget elementor-widget-html\" data-id=\"e93e663\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<nav class=\"kly-g-toc\" aria-label=\"Contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f76c256 elementor-widget elementor-widget-text-editor\" data-id=\"f76c256\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"kly-g-cta\"><h3>A French operator for your data<\/h3><p>Email, documents, video conferencing, CRM and telephony, hosted in the zone that matches your jurisdiction, for example in Europe or Mauritius, or on your premises.<\/p><p><a class=\"kly-g-btn\" href=\"\/en\/contact\/\">Talk to an advisor \u2192<\/a><\/p><p style=\"margin:0\"><a class=\"kly-g-btn ghost\" href=\"\/en\/hosting-sovereignty\/\">Klytic hosting<\/a><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6321f07 e-con-full kly-g-related e-flex e-con e-parent\" data-id=\"6321f07\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8c8319e elementor-widget elementor-widget-text-editor\" data-id=\"8c8319e\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>Read next<\/h2><div class=\"kly-g-grid\"><a class=\"kly-g-card\" href=\"\/en\/gdpr-google-workspace\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">GDPR and Google Workspace: what a business needs to check<\/span><span class=\"q\">Roles, data regions, support access, logs not covered, transfers and exit: what to check before closing the Google Workspace question.<\/span><span class=\"m\"><span>9 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/what-is-sovereign-cloud\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">What is a sovereign cloud?<\/span><span class=\"q\">A sovereign cloud is judged by its operator, the applicable law, control over access and data exit. The datacenter\u2019s location is not enough.<\/span><span class=\"m\"><span>8 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/european-alternatives-microsoft-365\/\" style=\"--cat:#6d28d9\"><span class=\"c\">Comparisons<\/span><span class=\"t\">European alternatives to Microsoft 365: 2026 guide<\/span><span class=\"q\">Selection criteria, then Microsoft 365, Google Workspace, OVHcloud, Nextcloud, Infomaniak, other players and Klytic. When each one is relevant.<\/span><span class=\"m\"><span>18 min read<\/span><b>Read \u2192<\/b><\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-47ba7642 e-con e-atomic-element e-div-block-base e-default-div e-47ba7642-0a8d8cb \" data-id=\"47ba7642\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"47ba7642\" data-e-type=\"e-div-block\" data-id=\"47ba7642\">\n    <div class=\"elementor-element elementor-element-1957dcf0 e-con e-atomic-element e-div-block-base e-default-div e-1957dcf0-65bb45b \" data-id=\"1957dcf0\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"1957dcf0\" data-e-type=\"e-div-block\" data-id=\"1957dcf0\">\n    \t\t\t<p class=\"e-34902a51-b78d132 e-paragraph-base e-default-p\" data-interaction-id=\"34902a51\" data-e-type=\"widget\" data-id=\"34902a51\">Welcome offer<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"54c96233\" class=\"e-54c96233-632171d e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"54c96233\">30 days free trial, migration support included<\/h2>\n\t\t\t\t\t<p class=\"e-6661c7ce-fdde46c e-paragraph-base e-default-p\" data-interaction-id=\"6661c7ce\" data-e-type=\"widget\" data-id=\"6661c7ce\">No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.<\/p>\n\t\t<div class=\"elementor-element elementor-element-761c01f e-con e-atomic-element e-div-block-base e-default-div e-761c01f-cf11a99 \" data-id=\"761c01f\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"761c01f\" data-e-type=\"e-div-block\" data-id=\"761c01f\">\n    \t\t\t<a href=\"https:\/\/www.klytic.com\/en\/30-day-free-trial\/\" target=\"_self\" class=\"e-2f43419f-52885cf e-button-base e-default-a\" data-interaction-id=\"2f43419f\" data-e-type=\"widget\" data-id=\"2f43419f\">\n\t\ud83d\ude80 Start the free trial\n<\/a>\n\t\t\t\t\t<a href=\"https:\/\/www.klytic.com\/en\/pricing\/\" target=\"_self\" class=\"e-31327e4d-45bbc1a e-button-base e-default-a\" data-interaction-id=\"31327e4d\" data-e-type=\"widget\" data-id=\"31327e4d\">\n\tSee pricing\n<\/a>\n\t\t\n<\/div>\n\n<\/div>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Accueil\u203aGuides\u203aSouverainet\u00e9 Souverainet\u00e9 RGPD et Microsoft 365 : ce qu\u2019une entreprise doit v\u00e9rifier Microsoft 365 peut \u00eatre utilis\u00e9 dans un cadre RGPD. Le r\u00e8glement n\u2019interdit pas les \u00e9diteurs am\u00e9ricains. Il impose de savoir qui traite quoi, sur quelle base les donn\u00e9es quittent l\u2019Union, et comment les personnes exercent leurs droits. Voici ce qu\u2019une entreprise doit v\u00e9rifier, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"GDPR and Microsoft 365: what a business needs to check | Klytic","_seopress_titles_desc":"Roles, DPA, EU Data Boundary, transfers, data subject rights and exit: the GDPR checks to carry out before closing the Microsoft 365 question.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"GDPR and Microsoft 365: what a business needs to check | Klytic","_seopress_social_fb_desc":"Roles, DPA, EU Data Boundary, transfers, data subject rights and exit: the GDPR checks to carry out before closing the Microsoft 365 question.","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"GDPR and Microsoft 365: what a business needs to check | Klytic","_seopress_social_twitter_desc":"Roles, DPA, EU Data Boundary, transfers, data subject rights and exit: the GDPR checks to carry out before closing the Microsoft 365 question.","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-3816","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3816","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/comments?post=3816"}],"version-history":[{"count":2,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3816\/revisions"}],"predecessor-version":[{"id":3909,"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3816\/revisions\/3909"}],"wp:attachment":[{"href":"https:\/\/www.klytic.com\/en\/wp-json\/wp\/v2\/media?parent=3816"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}