Microsoft finalizes its EU sovereign cloud project

Microsoft says that it has completed a multi-year project to allow Europe-based customers using its cloud services to store and process data in the EU.

The project, the EU Data Boundary for the Microsoft Cloud, began in January 2023, went on for two more years, and finally wrapped up this February, Microsoft said. With its completion, European customers can store and process data for Microsoft core cloud services, including Microsoft 365, Dynamics 365, Power Platform, and most Azure services, within the EU and European Free Trade Association regions (EFTA).

A growing number of tech giants and cloud providers offer European data residency programs along the lines of the EU Data Boundary. These help customers comply with European local privacy and data protection laws like the GDPR, Germany’s Federal Data Protection Act, and the U.K.’s data protection legislation. Data residency refers to the physical location of an organization’s data, as well as the local laws and policy requirements imposed on that data.

According to Microsoft, for cloud services supported by the EU Data Boundary, customer data and “pseudonymized” personal data are stored and processed in datacenters located in countries within the EU or EFTA. “Professional services data,” which includes data that’s provided to Microsoft, like certain log data, is stored at rest.

Microsoft notes that, for specific Azure services, customers may have to obtain a professional services data storage commitment. This page outlines the requirements.

EU regulators have spent years flagging concerns about how Microsoft processes the data of users of its cloud services, including in relation to the legal basis Microsoft claims for processing data and a lack of clarity in the wording of its cloud services contracts. To be fair, Microsoft isn’t the only target. In May 2023, Meta was fined $1.3 billion by Ireland’s data privacy watchdog over data transfers to the U.S.

In July 2023, the EU and U.S. agreed on a new “Data Privacy Framework,” allowing data transfers as long as particular privacy guarantees and protections were made. Microsoft nonetheless last year announced plans to keep all European cloud customers’ personal data within the EU.