The state data protection authority in Hessen has approved the use of Microsoft 365 for public sector organizations and businesses, provided that specific user configurations are implemented to ensure compliance with data protection regulations.

This decision follows a comprehensive review by the supervisory authority, which focused on fundamental data protection issues related to the cloud-based suite of applications. Microsoft 365, which includes widely used tools such as Word, Outlook, and PowerPoint, had previously faced scrutiny due to concerns about the handling and transfer of personal data, particularly regarding the potential for data to be processed or stored in the United States.

Background and Regulatory Review

Concerns surrounding Microsoft 365 stemmed from its nature as a cloud service, with the German Data Protection Conference in 2022 highlighting seven primary issues. These included questions about the extent of personal data processing by the US-based company and the possible transfer of sensitive data outside the European Union, especially to the US. The lack of clarity led to uncertainty among public institutions and enterprises about whether they could legitimately use the software in accordance with the European General Data Protection Regulation (GDPR).

Since early 2025, there have been multiple discussions between the Hessen data protection authority and Microsoft representatives. These meetings aimed to address the core issues identified by regulators. While a technical audit of Microsoft's services was not conducted, the authority emphasized that they had reached satisfactory solutions for the fundamental legal questions. The agency acknowledged that resource limitations prevented a full technical analysis but stated that their guidance provides a solid legal foundation for compliant deployment.

Key Measures and Documentation

To facilitate compliant use, the Hessen authority released a detailed document outlining recommended configurations and best practices for Microsoft 365. This guide is intended to help organizations minimize risks and fulfill their data protection obligations. In collaboration with the Bavarian data protection office, Microsoft has also introduced additional support materials, including a toolkit for GDPR documentation, an updated cloud compliance guide, and customizable templates for data protection impact assessments.

Changes in Data Processing Practices

The review concluded that Microsoft had adapted its data processing operations to align with European legal requirements. The company now processes nearly all user data within Europe, with only rare, justified exceptions. Furthermore, for internal business purposes, Microsoft handles only aggregated and anonymized protocol data, reducing the risk of personal data exposure.

These adjustments have addressed previous concerns about unauthorized data transfers to the United States. The authority confirmed that, in light of recent changes to European regulations and Microsoft's revised data handling practices, there are no remaining objections regarding cross-border data flows.

Open-Source Alternatives and Sectoral Developments

While Microsoft 365 remains a popular choice, the public sector in Germany is also exploring open-source alternatives. The openDesk platform, developed under the direction of the Center for Digital Sovereignty (ZenDiS), is being introduced in various government agencies, including the military and public health services. Additionally, the International Criminal Court in The Hague is transitioning away from Microsoft software in favor of openDesk, seeking greater independence from US-based technology providers.

These developments underscore ongoing efforts to balance digital efficiency with the protection of sensitive information in the public sector. The approval of Microsoft 365 in Hessen is expected to provide legal clarity and operational certainty for organizations seeking to modernize their IT environments while adhering to strict data protection standards.