--- title: "Microsoft 365 and GDPR: What German Companies Need to Know in 2026" description: "Can German companies use Microsoft 365 under GDPR? DSK history, EU Data Boundary, DPA, DPIA, and works council obligations — complete 2026 guide." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/microsoft-365-gdpr/" language: "en" --- ![Microsoft 365 GDPR compliance Germany — DSK, EU Data Boundary, and DPA guide](https://compound.law/assets/images/tools/tools_3.webp) tools # Microsoft 365 and GDPR: What German Companies Need to Know in 2026 15 April 2026 Short answer Microsoft 365 can be used GDPR-compliantly in Germany when the EU Data Boundary is enabled, a Data Processing Agreement is signed, and a DPIA is conducted where required — the 2025 LfD Niedersachsen ruling confirmed this pathway for private-sector companies, while public sector use remains more complex. - Sign and verify scope of the Microsoft Data Processing Agreement under GDPR Article 28 for all M365 services in use. - Enable the EU Data Boundary to keep Exchange, SharePoint, and Teams customer content in EU/EFTA regions — and verify what telemetry data still transfers. - Negotiate a Betriebsvereinbarung with the works council before deploying Teams monitoring, Viva Insights, or productivity analytics features. **Microsoft 365 can be used GDPR-compliantly in Germany — but compliance is not automatic.** It requires the EU Data Boundary enabled for your tenant, a signed and verified Data Processing Agreement, a Data Protection Impact Assessment where required, and a Betriebsvereinbarung before deploying any employee monitoring features. The 2025 ruling by the LfD Niedersachsen marked a turning point for private-sector companies, confirming a legal pathway through careful configuration. For an overview of other enterprise tools assessed by our team, see [AI tools reviewed by Compound Law](https://compound.law/en-DE/tools/). ## Can German Companies Use Microsoft 365 Under GDPR? Yes — with the right setup. Microsoft 365 is GDPR-compliant for German private-sector companies when four conditions are met: 1. **The Microsoft Data Processing Agreement is signed.** This establishes Microsoft as an Article 28 GDPR processor and sets out obligations covering subprocessors, security, breach notification, and data deletion. 2. **The EU Data Boundary is enabled.** Core customer content — Exchange emails, SharePoint files, Teams messages — must be stored and processed within EU/EFTA territory. 3. **A valid legal basis exists** under Article 6 GDPR for each processing purpose. For most corporate use cases, Article 6(1)(b) (contract performance) or Article 6(1)(f) (legitimate interests) applies. 4. **A DPIA is conducted** where large-scale processing of personal data — including employee data via Teams monitoring or Viva Insights — is involved. Public sector use is more complex. Schools, authorities, and public bodies in several German Bundesländer face additional restrictions and should consult their Bundesland’s data protection authority before deploying. ## The German DSK Scrutiny: What Happened and Where It Stands The compliance debate around Microsoft 365 in Germany dates back to 2021, when the **Kultusministerkonferenz (KMK)** school debate put M365’s data transfers under intense scrutiny following the Schrems II ruling. The **Datenschutzkonferenz (DSK)** — the joint conference of German federal and state data protection authorities — published guidance in 2021 and 2022 expressing fundamental concerns. At the core was the question of whether Microsoft’s Standard Contractual Clauses (SCCs) were sufficient to justify transfers of diagnostic and telemetry data to the United States under post-Schrems II standards. The DSK’s position created significant legal uncertainty for German businesses deploying M365, with some DPAs advising against use for schools and government bodies. **The 2025 turning point:** In early 2025, the **Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen)** — the Lower Saxony data protection authority — published a positive assessment of Microsoft 365 for private-sector use. The assessment concluded that, with the EU Data Boundary properly configured and the updated DPA in place, M365 satisfies GDPR requirements for commercial organisations. This represented the first clear green light from a German DPA for private-sector M365 deployment. **Private sector vs. public sector divide:** The LfD Niedersachsen assessment applies to private companies. Public sector organisations — particularly schools and government agencies — remain subject to stricter scrutiny in several Bundesländer. Baden-Württemberg, Bavaria, and other Länder education ministries have issued guidance that restricts or conditions M365 use for schools. [Public sector AI compliance](https://compound.law/en-DE/ai-act/public-sector/) sets out the broader regulatory framework for public bodies. ## Microsoft’s EU Data Boundary: What It Actually Means The **EU Data Boundary** is Microsoft’s architectural commitment to store and process core customer data within EU and EFTA countries. It launched on January 1, 2023, and completed its full rollout across all Microsoft 365 services by end of 2024. **What stays in the EU under the EU Data Boundary:** | Data category | EU Data Boundary scope | Notes | | ------------------------------- | -------------------------------- | ----------------------------------------- | | Exchange Online (email content) | Yes — stored and processed in EU | Includes email body, attachments | | SharePoint Online (files) | Yes — stored and processed in EU | Includes OneDrive for Business | | Microsoft Teams (chats, files) | Yes — stored and processed in EU | Chat content, meeting recordings | | Account data | Yes | Tenant admin and user account information | | System-generated logs | Yes | Audit logs, sign-in logs | **What may still transfer outside the EU:** - **Diagnostic and telemetry data** — Microsoft collects limited service diagnostic data that may be processed outside the EU boundary. Microsoft states this is pseudonymised and limited in scope, but legal teams should review Microsoft’s current telemetry documentation and reflect this in any DPIA. - **Customer support interactions** — If you contact Microsoft support, support engineers outside the EU may access your data subject to role-based access controls. - **Third-party connectors and integrations** — Data flowing through third-party apps connected to M365 is governed by those providers’ terms, not Microsoft’s EU Data Boundary. **How to verify EU Data Boundary is enabled:** In the Microsoft 365 Admin Center, navigate to **Settings → Org Settings → Security & Privacy → Data Residency**. Your tenant’s region and EU Data Boundary status should be confirmed here. If your organisation was provisioned before January 2023, verify that migration to the EU Data Boundary is complete. ## The 2025 DPA Update: Key Improvements Microsoft updated its **Online Services Terms and Data Protection Addendum** in 2025, introducing several material changes relevant to German companies: - **EU-US Data Privacy Framework integration.** Following the EU Commission adequacy decision of July 2023, Microsoft’s updated DPA incorporates the DPF as a transfer mechanism for residual data flows involving the US, supplementing SCCs. - **EU Data Act alignment.** The updated DPA includes provisions addressing cloud switching rights and data portability obligations under the **EU Data Act**, which entered into force in September 2025. - **EFTA countries added.** Norway, Iceland, and Liechtenstein are now explicitly included in the EU Data Boundary and DPA geographic scope, relevant for DACH companies with operations in these countries. - **Enhanced subprocessor management.** Microsoft added 30-day advance notice of subprocessor changes (previously 6 months for removals only), with a documented right to object. German legal teams should verify that the updated DPA terms are accepted under their Microsoft Enterprise Agreement or Microsoft Customer Agreement, as automatic acceptance may depend on subscription type. ## DPIA Requirements A **Data Protection Impact Assessment (DPIA)** under Article 35 GDPR is required when processing is likely to result in a high risk to individuals. For Microsoft 365, the following scenarios typically trigger a mandatory DPIA: - **Systematic monitoring of employees** via Teams call analytics, Viva Insights productivity metrics, or presence tracking. - **Large-scale processing of sensitive data** — health records, legal matter content, or financial data processed in M365 at significant volume. - **Organisations with 250+ employees** using M365 for primary email and collaboration infrastructure. The **DSK recommends a DPIA for M365 as a precautionary measure** even where Article 35’s mandatory threshold is not technically met, given the volume of personal data processed and the complexity of data flows involved. **What German DPAs expect in a DPIA for M365:** 1. **Scope and purpose definition** — Map all M365 services in use and document their processing purposes. 2. **Data flow analysis** — Identify where personal data goes, including telemetry and support scenarios. 3. **Necessity and proportionality** — Assess whether M365 features are limited to what is necessary. 4. **Risk assessment** — Evaluate risks to employee and user data, especially from monitoring features. 5. **Mitigation measures** — Document EU Data Boundary configuration, DPA terms, admin controls used to limit data processing. 6. **Residual risk sign-off** — DPO sign-off (or equivalent review) on acceptable residual risk before deployment. ## Works Council (Betriebsrat) Obligations For German companies, deploying Microsoft 365 features that affect employees requires **works council involvement** under the **Betriebsverfassungsgesetz (BetrVG)**. This is not optional — failure to involve the works council before implementing employee-monitoring features can result in an injunction. **M365 features that trigger §87(1) No. 6 BetrVG:** - **Microsoft Teams** — call duration logs, meeting attendance, presence and availability tracking - **Viva Insights** — individual and team productivity analytics, meeting effectiveness data, focus time metrics - **Exchange Online mail tracking** — read receipt policies, delivery confirmation analytics at individual level - **Microsoft Purview compliance features** — employee communication monitoring, content search across mailboxes **What to cover in a Betriebsvereinbarung:** - Permitted and prohibited M365 features for employee monitoring - Which data categories are collected and for what purposes - Individual vs. aggregated reporting (Viva Insights individual data is particularly sensitive) - Data retention periods for Teams call logs and audit logs - Employee rights to access and correct their data - Admin access controls: who can view employee-level data For the broader legal framework governing AI and digital workplace monitoring in Germany, see [AI employee monitoring compliance](https://compound.law/en-DE/compliance/ai-employee-monitoring/). For Teams-specific AI features including meeting transcription and call analysis by Copilot, see [Microsoft Teams Copilot compliance](https://compound.law/en-DE/tools/teams-copilot/). **§26 BDSG applies to employee data.** When M365 processes personal data relating to employees — productivity data, email metadata, HR workflows — the **Bundesdatenschutzgesetz (BDSG) §26** applies alongside GDPR, requiring a specific legal basis and limiting permissible purposes to employment relationship management. ## Our Assessment For **private-sector companies** in Germany, Microsoft 365 can be deployed GDPR-compliantly with proper configuration. The 2025 LfD Niedersachsen assessment removes the significant legal uncertainty that existed since 2021. The checklist is not short — DPA verification, EU Data Boundary activation, DPIA, Betriebsvereinbarung — but each step is achievable. For **public sector organisations and schools**, the picture is more complex. Several Bundesländer data protection authorities continue to raise concerns or impose conditions for public bodies. Check your Bundesland’s DPA guidance before deploying M365 in schools, public authorities, or government-adjacent organisations. **Practical steps to make Microsoft 365 GDPR-compliant:** 1. Accept and verify scope of the Microsoft Data Processing Agreement 2. Enable the EU Data Boundary for your tenant and confirm migration is complete 3. Audit enabled M365 services and disable features not in use 4. Conduct a DPIA covering all active M365 services 5. Review and limit diagnostic data collection in admin settings 6. Engage the works council and negotiate a Betriebsvereinbarung for employee-facing features 7. Document legal basis for each processing purpose in your ROPA 8. Review the subprocessor list and confirm transfer mechanisms are current 9. Establish a process for reviewing Microsoft’s annual DPA updates **Note on Microsoft 365 Copilot:** This guide covers Microsoft 365 core services — Exchange, SharePoint, Teams. The AI-powered Copilot layer introduces additional considerations covered separately. See the [Microsoft 365 Copilot compliance guide](https://compound.law/en-DE/tools/copilot-microsoft-365/) for Copilot-specific GDPR and AI Act obligations. ## How Compound Law Helps - **DPA review and gap analysis** — verifying the Microsoft DPA covers your specific services, subscription tier, and data categories - **EU Data Boundary configuration review** — confirming your tenant’s data residency settings are correctly implemented and documented - **DPIA scoping and execution** — assessing scope, conducting the DPIA, and producing documentation German DPAs expect - **Works council strategy** — drafting Betriebsvereinbarungen for M365 and supporting co-determination consultations - **Public sector M365 assessment** — evaluating your Bundesland’s regulatory position and advising on the right deployment approach ## FAQ ### Is Microsoft 365 GDPR compliant? Microsoft 365 can be used GDPR-compliantly in Germany when the EU Data Boundary is enabled, the Microsoft Data Processing Agreement is signed, a valid legal basis exists under Article 6 GDPR, and a DPIA is conducted where required. The 2025 LfD Niedersachsen assessment confirmed this pathway for private-sector organisations. Compliance is not automatic — it depends on your configuration and contractual setup. ### Does Microsoft provide a Data Processing Agreement (DPA) for Microsoft 365? Yes. Microsoft provides a Data Processing Agreement through its Online Services Terms and Data Protection Addendum. It covers Article 28 GDPR processor obligations including subprocessors, security measures, breach notification, audit rights, and data deletion. Enterprise customers should verify that their specific M365 services and subscription tier are covered. ### Can German schools use Microsoft 365? This remains contested. Private-sector companies may use M365 with proper configuration following the 2025 LfD Niedersachsen ruling. Schools and public authorities face stricter scrutiny — several German Länder education authorities have issued guidance restricting or conditioning M365 use for schools. Public sector organisations should consult their Bundesland’s data protection authority before deploying. ### What is the EU Data Boundary? The EU Data Boundary is Microsoft’s commitment to store and process core customer data — including Exchange email content, SharePoint files, and Teams chats — within EU and EFTA countries. It launched on January 1, 2023, and completed its rollout by end of 2024. Tenants must verify it is enabled. Limited diagnostic telemetry data may still transfer outside the EU. ### Do I need a DPIA for Microsoft 365? German data protection authorities recommend conducting a Data Protection Impact Assessment (DPIA) under Article 35 GDPR for Microsoft 365 deployments involving significant employee data processing — particularly where Teams monitoring, Viva Insights, or large-scale email processing are in scope. Even where a full DPIA is not strictly required under Article 35, the DSK guidance recommends it as a precautionary measure. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Microsoft 365 can be used GDPR-compliantly in Germany when the EU Data Boundary is enabled, the Microsoft DPA is signed, a valid legal basis under Article 6 GDPR exists, and a DPIA is conducted where required. The 2025 LfD Niedersachsen assessment confirmed this for private-sector organisations. Compliance depends on configuration and contractual setup. Yes. Microsoft provides a Data Processing Agreement through its Online Services Terms and Data Protection Addendum. It covers Article 28 GDPR processor obligations including subprocessors, security measures, breach notification, audit rights, and data deletion. Enterprise customers should verify that their specific M365 services and subscription tier are covered. Private-sector companies may use M365 with proper configuration following the 2025 LfD Niedersachsen ruling. Schools and public authorities face stricter scrutiny — several Länder education authorities, including Baden-Württemberg, have restricted or conditioned M365 use for schools. Public-sector organisations should consult their Bundesland data protection authority first. The EU Data Boundary is Microsoft's commitment to store and process core customer data — including Exchange email content, SharePoint files, and Teams chats — within EU and EFTA countries. It launched on January 1, 2023, and completed its rollout by end of 2024. Tenants must verify it is enabled for their tenant. Limited diagnostic telemetry data may still transfer outside the EU. German DPAs recommend conducting a DPIA under Article 35 GDPR for M365 deployments with significant employee data processing — particularly Teams monitoring, Viva Insights, or large-scale email processing. Even where a full DPIA is not strictly required, the DSK guidance recommends it as a precautionary measure for M365. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Microsoft 365 and GDPR: What German Companies Need to Know in 2026", "description": "Can German companies use Microsoft 365 under GDPR? DSK history, EU Data Boundary, DPA, DPIA, and works council obligations — complete 2026 guide.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-04-15T00:00:00.000Z", "dateModified": "2026-04-15T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/microsoft-365-gdpr/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Microsoft 365 and GDPR: What German Companies Need to Know in 2026", "item": "https://compound.law/en-DE/tools/microsoft-365-gdpr/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Microsoft 365 GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Microsoft 365 can be used GDPR-compliantly in Germany when the EU Data Boundary is enabled, the Microsoft DPA is signed, a valid legal basis under Article 6 GDPR exists, and a DPIA is conducted where required. The 2025 LfD Niedersachsen assessment confirmed this for private-sector organisations. Compliance depends on configuration and contractual setup." } }, { "@type": "Question", "name": "Does Microsoft provide a Data Processing Agreement (DPA) for Microsoft 365?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Microsoft provides a Data Processing Agreement through its Online Services Terms and Data Protection Addendum. It covers Article 28 GDPR processor obligations including subprocessors, security measures, breach notification, audit rights, and data deletion. Enterprise customers should verify that their specific M365 services and subscription tier are covered." } }, { "@type": "Question", "name": "Can German schools use Microsoft 365?", "acceptedAnswer": { "@type": "Answer", "text": "Private-sector companies may use M365 with proper configuration following the 2025 LfD Niedersachsen ruling. Schools and public authorities face stricter scrutiny — several Länder education authorities, including Baden-Württemberg, have restricted or conditioned M365 use for schools. Public-sector organisations should consult their Bundesland data protection authority first." } }, { "@type": "Question", "name": "What is the EU Data Boundary?", "acceptedAnswer": { "@type": "Answer", "text": "The EU Data Boundary is Microsoft's commitment to store and process core customer data — including Exchange email content, SharePoint files, and Teams chats — within EU and EFTA countries. It launched on January 1, 2023, and completed its rollout by end of 2024. Tenants must verify it is enabled for their tenant. Limited diagnostic telemetry data may still transfer outside the EU." } }, { "@type": "Question", "name": "Do I need a DPIA for Microsoft 365?", "acceptedAnswer": { "@type": "Answer", "text": "German DPAs recommend conducting a DPIA under Article 35 GDPR for M365 deployments with significant employee data processing — particularly Teams monitoring, Viva Insights, or large-scale email processing. Even where a full DPIA is not strictly required, the DSK guidance recommends it as a precautionary measure for M365." } } ] } ] ```