Microsoft 365 | Data Privacy at a Glance

Microsoft 365 cannot be operated in a data protection-compliant manner “out of the box”; it requires active customization. Microsoft provides the tools (Technical & Organizational Measures), but as an admin, you must configure them yourself (Shared Responsibility).

This checklist guides you through the critical levels: from contractual aspects to tenant hardening, Copilot, AI, and the bridge to NIS2.

Before you start tweaking settings in the Admin Center, the fundamental paperwork must be in place. Without these documents, operations in the EU are effectively prohibited. This is where you lay the foundation for accountability under Article 5(2) of the GDPR.

The days of simply ticking a box in the Admin Center with a 'Yes, I agree' are over. Microsoft now governs this through the central Data Protection Addendum (DPA), which is part of volume licensing agreements and the Microsoft Customer Agreement (MCA).

Microsoft regularly updates this document, often at the beginning of the year. It includes the 2021 EU Standard Contractual Clauses (SCCs) from the European Commission, which serve as a fallback should the current adequacy decision be overturned.

Admin tasks:

M365 is not a "set-and-forget" solution. You must precisely document in the processing directory (Art. 30 GDPR) which data ends up in the cloud. An entry like "We use Office 365" is a red flag for auditors.

The situation changed fundamentally in July 2023, but caution is still advised.

To-Do: Create a short document that references the adequacy decision but also lists your technical safeguards (encryption, 2FA).

This is where the real work for administrators begins. Microsoft’s philosophy is productivity first, which is why default settings are often designed for maximum data transmission. To move closer to the principle of Privacy by Default (Art. 25 GDPR), we need to drastically reduce the clients’ chattiness.

Looking at just the mailbox storage location is no longer sufficient. Microsoft completed Phase 3 of the EU Data Boundary (EUDB) on February 26, 2025. Since then, not only data storage (data at rest) but also the processing of personal data and even support logs largely remain within EU and EFTA borders.

The limits of the EUDB: Microsoft reserves the right, in narrowly defined security cases requiring a coordinated global response, to process data with protective measures outside the EU. Additionally, some Azure services require extra steps for support data protection to take effect. So while the EUDB is robust, it doesn’t eliminate US data transfers entirely. It applies automatically to European tenants—you just need to ensure your licensing agreements are concluded in an EU region.

This is the main point of criticism from the Data Protection Conference (DSK). Office applications send telemetry data (system status, crash reports, feature usage) to Microsoft. The challenge: Microsoft has changed the labels. What used to be called 'Basic' is now mostly referred to as 'Required'.

Configure the policy 'Configure the level of client software diagnostic data sent to Microsoft' via Intune, GPO, or Cloud Policy.

This is where things get legally complex: For many of these features (such as Translator, 3D Maps, Smart Lookup), Microsoft no longer acts as a processor but as a controller in its own right. This means the data leaves the strictly protected tenant environment.

The distinction:

Guidance for decision-making: For high-security areas (HR, research, critical infrastructure), disable content-analyzing services via policy ("Connected experiences that analyze your content"). Expect complaints, as popular convenience features like the Design Assistant in PowerPoint will disappear. This requires a trade-off between productivity and data minimization. Pro tip: If you allow these services, explicitly inform users in the privacy policy that data is sent to Microsoft when using the translator.

Article 32 GDPR requires appropriate technical and organizational measures (TOMs) to ensure a level of protection commensurate with the risk. For Microsoft 365, this means: default settings are not sufficient. An unhardened tenant is vulnerable to ransomware and data exfiltration, and thus a potential data protection violation.

Access control is the most critical lever. A compromise (identity theft) is considered a reportable data breach (within 72 hours). The strategy: Enable multi-factor authentication (MFA) for 100% of users, including admins.

Important: Block legacy authentication (POP3, IMAP, SMTP). These protocols often bypass MFA and are the #1 entry point for password-spraying attacks.

Data hoarding contradicts the principle of storage limitation (Art. 5 GDPR). Many admins confuse backup with retention. The solution: Use Microsoft Purview Data Lifecycle Management (formerly Information Governance) and create retention policies in the Purview portal.

The advantage: Automation prevents human error and ensures that old data is deleted on time (right to be forgotten).

Prevent internal data from being exposed via anonymous links (“Anyone with the link”) on the internet. In the SharePoint and OneDrive admin center:

Guest management: Guest users often remain in the system indefinitely. Use Access Reviews in Entra ID to regularly ask group owners whether a guest still needs access. Automated Access Reviews require an Entra ID P2 license. Alternatively, check semi-annually using a PowerShell script.

Without logs, you cannot determine which data was leaked in an emergency (GDPR Articles 33/34). Unified Audit Log: Ensure that audit log search is enabled in the Purview Compliance Portal. Since October 2023, logging has been enabled by default for new tenants, but it’s still worth checking for existing ones.

Retention period:

To-Do: Regularly perform spot checks on logs for anomalies, such as mass file downloads or logins from unusual countries.

The biggest new challenge has shifted: away from pure Office usage, towards Microsoft 365 Copilot. Copilot doesn’t change the data privacy landscape by creating new data, but by exposing existing data. Every access permission carelessly granted over the years becomes a searchable query with Copilot. That’s why AI belongs on the same checklist as AVV and MFA.

Copilot for Microsoft 365 accesses exactly the content via Microsoft Graph that the signed-in user is already permitted to see: emails, Teams chats, SharePoint libraries, OneDrive. Copilot does not elevate permissions, but it can find in seconds what a human would never manually open. A SharePoint site accidentally shared with all members thus becomes a goldmine. Microsoft calls this problem oversharing.

Copilot processes potentially personal data on a large scale. This triggers Art. 35 GDPR: Before deployment, a Data Protection Impact Assessment (DPIA) must be reviewed. If a DPIA for Microsoft 365 already exists, you supplement it with the Copilot section instead of starting from scratch.

Since February 2, 2025, Article 4 of the AI Regulation (AI Act) requires companies to ensure sufficient AI competence among employees who use AI systems. For Copilot, this means: training and an internal AI policy are not optional but mandatory. Create an internal AI policy and document training records. Both are also components for TISAX and ISO 27001. Copilot for Microsoft 365 operates within the EU Data Boundary: prompts, responses, and data retrieved via Microsoft Graph generally remain within the EU infrastructure. This relieves your TIA but does not replace it.

The points above describe what should be configured. This section shows how to check the current state without making any changes. All commands are read-only (pure Get queries) and do not modify the tenant. For a complete, repeatable run, it's better to use a dedicated audit script rather than individual commands.

Read the authentication methods allowed in the tenant and the state of your Conditional Access policies. Required permission: Policy.Read.All (read).

Note: A policy with the status enabledForReportingButNotEnforced (Report-only) is logged but not enforced. It is not a protection, but a test.

Check the tenant-wide sharing settings. Requires the SharePoint Online Management Shell and a SharePoint Administrator role (read-only).

Target state: SharingCapability set to ExternalUserSharingOnly (or more restrictive), DefaultSharingLinkType set to Internal, and an expiration date configured for anonymous links.

A single value reveals whether logging is enabled at all. Requires Exchange Online PowerShell. Important: The query must run in Exchange Online PowerShell; in Security & Compliance PowerShell, UnifiedAuditLogIngestionEnabled always returns False.

A result of True means: Logging is active. If False, you lack the evidence required under Article 33 GDPR in an emergency.

External forwarding is a classic exfiltration path after a compromised account. This query lists all mailboxes with SMTP forwarding without reading email content.

There is no clean read command for the data location per workload. Check it in the Microsoft 365 admin center under Settings, Org settings, Organization profile, Data location. Use Get-MgOrganization to additionally read country assignments and tenant master data.

These samples do not replace a structured audit. They are snapshots, and the existence of a policy does not prove its effectiveness. Anyone who needs to conduct regular and audit-proof checks (TISAX, ISO 27001, NIS2) requires a reproducible collector that gathers, hashes, and versions evidence.

Those who have implemented hardening measures from levels 2 and 3 already meet large parts of the NIS2 obligations without realizing it. Since December 6, 2025, Germany’s NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) has been in force. It obliges an estimated 29,000 companies to implement risk management, incident reporting, and registration with the BSI. The law does not provide for a transitional period.

Section 30 of the BSIG requires risk management in ten areas, from risk analysis and backup management to cryptography and multi-factor authentication. This almost entirely aligns with the technical and organizational measures (TOMs) required by Article 32 of the GDPR. MFA, deletion concepts, logging, and access control contribute to compliance with both frameworks. Companies with an ISMS based on ISO 27001 already meet a large portion of the NIS2 requirements.

There are three things the GDPR does not cover: registration with the BSI via the MUK portal (deadline was March 6, 2026, with an extended deadline until July 31, 2026), the 24-hour reporting procedure, and personal liability of the executive management. First, check applicability under § 28 BSIG: typically applies to entities with 50 or more employees or an annual turnover of €10 million in one of the 18 sectors covered by the NIS2 Directive (11 highly critical sectors plus 7 other critical sectors; listed in Annexes 1 and 2 of the German BSIG).

The answer is: It’s complicated, but doable. A blanket statement like “everything is forbidden” or “everything is allowed” is technically incorrect. The assessment is dynamic and depends on whether you’ve completed the hardening measures outlined above. The following timeline puts the key developments into context.

The question of whether Microsoft 365 is GDPR-compliant can now be answered much more clearly than in the days of the Schrems II ruling. The legal gray area has been significantly reduced by the EU-US Data Privacy Framework (2023, judicially confirmed in September 2025) and the technical implementation of the EU Data Boundary.

Yet for administrators, trust does not replace configuration. Microsoft provides with M365 a platform that, out of the box, is optimized for convenience and data exchange—not for data minimization. An unhardened tenant is therefore not just a security risk but also a compliance violation.

Your strategy for legally compliant operations:

Those who follow these points leave the realm of negligence and operate Microsoft 365 responsibly and securely in line with the current state of the art.