--- title: "Is Microsoft 365 GDPR-compliant? Spoiler alert: no" description: Microsoft claims it is compliant with privacy regulations in Europe. But it doesn't meet all the criteria set in the GDPR. Can you safely use it or not? image: https://www.smartlockr.io/hubfs/microsoft-not-gdpr-proof%20(1)%20(1).webp --- [![Smartlockr logo](https://www.smartlockr.io/hubfs/Smartlockr-logo.png) ](https://www.smartlockr.io/en?hsLang=en) - Product - [Product overview ](https://www.smartlockr.io/en/product?hsLang=en) - [Integrations ](https://www.smartlockr.io/en/integrations?hsLang=en) - Customers - [Case studies ](https://www.smartlockr.io/en/blog/tag/casestudy) - Team - [Management ](https://www.smartlockr.io/en/teams/management?hsLang=en) - [IT specialist ](https://www.smartlockr.io/en/teams/it-specialist?hsLang=en) - [CISO ](https://www.smartlockr.io/en/teams/ciso?hsLang=en) - [End user ](https://www.smartlockr.io/en/teams/end-user?hsLang=en) - Branches - [Healthcare ](https://www.smartlockr.io/en/branches/secure-email-healthcare?hsLang=en) - [Municipalities ](https://www.smartlockr.io/en/branches/secure-email-municipalities?hsLang=en) - [Finance ](https://www.smartlockr.io/en/branches/secure-email-financial-services?hsLang=en) - [Legal ](https://www.smartlockr.io/en/branches/secure-email-legal-industry?hsLang=en) - [Education ](https://www.smartlockr.io/en/branches/secure-email-education?hsLang=en) - [Recruitment ](https://www.smartlockr.io/en/branches/secure-email-recruiters?hsLang=en) - [Housing associations ](https://www.smartlockr.io/en/branches/secure-email-housing-associations?hsLang=en) - [Pricing ](https://www.smartlockr.io/en/pricing?hsLang=en) - Resources - [Blog ](https://www.smartlockr.io/en/blog) - [Guides ](https://www.smartlockr.io/en/resources?hsLang=en#guides) - [Webinars ](https://www.smartlockr.io/en/resources?hsLang=en#webinars) - [Videos ](https://www.smartlockr.io/en/resources?hsLang=en#videos) - [Partners ](https://www.smartlockr.io/en/partners?hsLang=en) - Company - [Contact ](https://www.smartlockr.io/en/contact?hsLang=en) - [Support ](https://support.smartlockr.io/hc/en-us?hsLang=en) - [Request more licenses ](https://www.smartlockr.io/en/request-more-licenses?hsLang=en) - [Who we are ](https://www.smartlockr.io/en/about-us?hsLang=en) - [Jobs ](https://www.smartlockr.io/en/careers?hsLang=en) [![Free Consultation](https://no-cache.hubspot.com/cta/default/6122972/846d7346-3e53-4811-b976-8a3dd0a3f9ee.png)](https://cta-redirect.hubspot.com/cta/redirect/6122972/846d7346-3e53-4811-b976-8a3dd0a3f9ee) # Is Microsoft 365 GDPR-compliant? Spoiler alert: no [ Olle Vastbinder ](https://www.smartlockr.io/en/blog/author/olle-vastbinder) Feb 10, 2023 --- ![Is Microsoft 365 GDPR-compliant? Spoiler alert: no](https://www.smartlockr.io/hubfs/microsoft-not-gdpr-proof%20(1)%20(1).webp) Ever since the introduction of the GDPR in 2018, there has been a lot of discussion about whether services like Microsoft 365 are compliant with these privacy regulations. We've written extensively about that before, and the answer so far has always been 'no'. But on Jan. 1, 2023, Microsoft says it has put up a 'data border' between the U.S. and Europe. With that, Microsoft claimed it would be fully GDPR-proof with its Microsoft services Azure, Microsoft 365, Dynamics 365 and Power BI. But is that really the case? Thanks to that new data border, the data of business European customers is no longer stored in the U.S., but only in Europe. That's already a win. The problem was that because of the US Cloud Act, all information on servers in the US must be accessible to US intelligence agencies. In other words, your data is not safe because the intelligence agencies can see everything. WEBINAR ### The Cloud Act and what it means for Europe Watch our free webinar with GDPR and data privacy expert, **Alexander Hanff**. [Watch it now ](https://www.smartlockr.io/en/blog/is-microsoft-365-gdpr-compliant#)   ## US regulations remain a problem Microsoft's change to use only European servers would be the solution to this issue. But unfortunately for Microsoft, U.S. regulations continue to throw a spanner in the works. Because although U.S. authorities cannot have physical access to a server in Europe, they can still legally require any U.S. company to allow full access to stored data. And that means this is true even if those servers are in Europe, or anywhere else in the world. So, this latest change from Microsoft doesn't actually change anything. You need to take extra measures to use Microsoft's products and be GDPR-Compliant. The easiest and most secure solution, is to use Zero Knowledge End-To-End encryption.   ## Encryption is the only solution By encrypting data so that only the sender and receiver can read a message, you ensure that if someone gains access to the data on the server, they still can't do read it. Even someone with physical access cannot do anything with a server on which all the data is encrypted with Zero Knowledge end-to-end encryption. ![Windows-crash](https://www.smartlockr.io/hs-fs/hubfs/Windows-crash.webp?width=752&height=376&name=Windows-crash.webp) *Microsoft's services are still not 100% GDPR-proof, as U.S. authorities can even demand access to servers of U.S. companies located abroad.* So the answer to whether Microsoft's online services are really GDPR-proof is still a definite 'no'. But fortunately, you can use Zero knowledge end-to-end encryption to make it an GDPR-proof service yourself. How exactly this form of data security makes a difference, [you can read in this blog](https://www.smartlockr.io/en/blog/lock-your-digital-front-door-with-zero-knowledge-encryption?hsLang=en). Want to know how easy Smartlockr can turn Microsoft into a GDPR-compliant solution? Book your free demo below. [![Free email security walkthrough](https://no-cache.hubspot.com/cta/default/6122972/5d872173-5927-4b5b-ad57-52501b073486.png)](https://cta-redirect.hubspot.com/cta/redirect/6122972/5d872173-5927-4b5b-ad57-52501b073486) [GDPR](https://www.smartlockr.io/en/blog/tag/gdpr) [Microsoft](https://www.smartlockr.io/en/blog/tag/microsoft) [![secure communication](https://www.smartlockr.io/hs-fs/hubfs/secure-communication-bp.png?width=336&name=secure-communication-bp.png)](https://www.smartlockr.eu/en/request-demo?hsLang=en)   ### Whitepapers - [Is it safe to store data in a US-based Cloud provider?](https://www.smartlockr.eu/en/whitepaper-is-it-safe-store-data-us-cloud-provider?hsLang=en) - [Good cop, bot cop: the truth about AI, ML and your privacy](https://www.smartlockr.eu/en/whitepaper-ai-ml-and-data-privacy?hsLang=en) - [The 8 things you can expect from a partnership with Smartlockr](https://www.smartlockr.eu/en/whitepaper-things-you-can-expect-from-partnetship-smartlockr?hsLang=en) - [How to choose the right secure email solution?](https://www.smartlockr.eu/en/how-to-choose-the-right-secure-email-solution-whitepaper?hsLang=en) - [Keep your organization free of data leaks](https://www.smartlockr.eu/en/keep-organization-free-of-data-leaks?hsLang=en) - [Smartlockr & Workspace 365: Prevent data breaches, work and communicate more securely](https://www.smartlockr.eu/en/safe-emailing-and-safe-workplace?hsLang=en) ### Popular Post [ Oops, I sent an important email to the wrong recipient. What now? ](https://www.smartlockr.io/en/blog/sent-email-to-wrong-recipient-what-now?hsLang=en) [ Is Microsoft 365 GDPR-compliant? Spoiler alert: no ](https://www.smartlockr.io/en/blog/is-microsoft-365-gdpr-compliant) [ Recall sent emails to protect data: block emails, files and recipients ](https://www.smartlockr.io/en/blog/recall-sent-email?hsLang=en) [ Why Pentesting is a must for banks and financial services ](https://www.smartlockr.io/en/blog/why-pentesting-is-a-must-for-banks-and-financial-services?hsLang=en) [ Preventing misdirected emails with files and recipients confirmation ](https://www.smartlockr.io/en/blog/confirmation-on-files-and-recipients?hsLang=en) ## Similar posts ### [Secure email explained in less than 500 words](https://www.smartlockr.io/en/blog/secure-email-explained-in-less-than-500-words?hsLang=en) Secure email doesn’t have to be a hassle within your company, as long as you know what to look out for. We explain this in our blog of less than 500... Secure Emailing Apr 22, 2020 ### [What is machine learning and what's in it for you?](https://www.smartlockr.io/en/blog/what-is-machine-learning-and-whats-in-it-for-you?hsLang=en) What is machine learning, how does it work and why is it the most powerful tool to combat the human error in everyday communication? Read the blog! Machine learning Oct 24, 2022 [![Smartlockr logo](https://www.smartlockr.io/hubfs/smartlockr-logo2.png) ](https://www.smartlockr.io/nl/?hsLang=en) **Netherlands: **H.J.E Wenckebachweg 123 1096 AM, Amsterdam Kvk: 61781614 BTW-nr: NL854485685B01   ### Contact - Netherlands: +31 (0) 20 244 03 50 - Sweden: +46 81 211 29 68 ### Smartlockr - [Terms & Conditions](https://www.smartlockr.io/en/general-terms-and-conditions-smartlockr?hsLang=en) - [Privacy Statement](https://www.smartlockr.io/en/privacy-statement?hsLang=en) - [Smartlockr A-Z](https://www.smartlockr.io/en/smartlockr-a-z?hsLang=en) - [Status of our services](https://www.smartlockr.io/en/status-of-our-services?hsLang=en) ### Support - [Help Center](https://support.smartlockr.io/hc/en-us?hsLang=en) - [FAQ](https://support.smartlockr.io/hc/en-us/categories/5354862458012-FAQ-and-information?hsLang=en) - [Need help? Download TeamViewer](https://get.teamviewer.com/smartlockr) © 2026 Smartlockr All rights reserved ![BC Certified logo_ISO 27001-2022 RVA_ENG](https://www.smartlockr.io/hs-fs/hubfs/BC%20Certified%20logo_ISO%2027001-2022%20RVA_ENG.jpg?width=303&height=80&name=BC%20Certified%20logo_ISO%2027001-2022%20RVA_ENG.jpg) ![NEN 7510 certificate Smartlockr](https://www.smartlockr.io/hs-fs/hubfs/BC-Certified-logo_NEN7510-1-2017_RVA_ENG.png?width=320&height=85&name=BC-Certified-logo_NEN7510-1-2017_RVA_ENG.png) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Olle Vastbinder", "url" : "https://www.smartlockr.io/en/blog/author/olle-vastbinder" }, "dateModified" : "2023-07-20T15:53:56.841Z", "datePublished" : "2023-02-10T08:50:10.000Z", "headline" : "Is Microsoft 365 GDPR-compliant? Spoiler alert: no", "image" : [ "https://www.smartlockr.io/hubfs/microsoft-not-gdpr-proof%20(1)%20(1).webp" ], "mainEntityOfPage" : { "@id" : "https://www.smartlockr.io/en/blog/is-microsoft-365-gdpr-compliant", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.smartlockr.io/hubfs/SL-logo@3x.png" }, "name" : "Smartlockr" } } ``` ```json { "@context" : "http://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "", "addressLocality" : "Amsterdam", "addressRegion" : "Noord Holland", "postalCode" : "", "streetAddress" : "H.J.E. Wenckebachweg 123 " }, "alternateName" : "AttachingIT", "areaServed" : { "@type" : "GeoCircle", "geoMidpoint" : { "@type" : "GeoCoordinates", "latitude" : "52.336690", "longitude" : "4.929430" }, "geoRadius" : "150 km" }, "description" : "Secure email and file sharing for businesses that handle privacy sensitive data", "email" : "sales@smartlockr.eu", "image" : "https://www.smartlockr.io/hubfs/homepage-en.png", "logo" : "https://www.smartlockr.io/hubfs/Smartlockr-logo.png", "mainEntityOfPage" : { "@id" : "https://www.smartlockr.io/en/blog/is-microsoft-365-gdpr-compliant", "@type" : "WebPage", "description" : "Microsoft claims it is compliant with privacy regulations in Europe. But it doesn't meet all the criteria set in the GDPR. Can you safely use it or not?" }, "name" : "Smartlockr", "sameAs" : [ "https://www.linkedin.com/company/smartlockr/", "https://www.youtube.com/@smartlockr9354", "https://www.instagram.com/smartlockr/" ], "telephone" : "+31 (0) 20 244 03 50", "url" : "https://www.smartlockr.io/" } ``` ```json { "@context" : "https://schema.org/", "@type" : "WebSite", "description" : "Secure email and file sharing for businesses that handle privacy sensitive data", "name" : "Smartlockr", "potentialAction" : { "@type" : "SearchAction", "query-input" : "required name=search_term_string", "target" : "https://www.smartlockr.io/hs-search-results{search_term_string}" }, "url" : "https://www.smartlockr.io/" } ```