The municipal council asks a written question: can the US government access our data in Microsoft 365? The answer has to go to the council clerk next week. You know that the honest answer is not a simple yes or no.
This piece sets out the facts, with sources. It is not a plea to cancel everything tomorrow. It helps you explain the risk to your board, your auditor and that municipal council.
What the CLOUD Act regulates
Microsoft is an American company. As a result, it falls under the Clarifying Lawful Overseas Use of Data Act from 2018, the CLOUD Act.
That act obliges American providers to hand over data to US law enforcement agencies that request it with a valid warrant. Where the data is stored does not matter. A data centre in Amsterdam or Dublin does not change that. Sometimes the provider is not allowed to tell the customer that there was a request.
Microsoft says it challenges such requests where it can, and itself publishes how many government requests it receives. That is a fair nuance. It does not change the fact that legal control lies outside Europe.
Schrems II and what came after
In July 2020, the European Court of Justice declared the Privacy Shield invalid (case C-311/18, Schrems II). The reason: US surveillance laws do not sufficiently protect the personal data of Europeans. Since July 2023, there has been a successor, the EU-US Data Privacy Framework.
That framework is also under fire. It has already been challenged before the European court, and privacy organisations such as noyb have announced further steps. For a municipality, that means: the basis for transfers to the US can fall away again.
What the BIO requires
The Baseline Informatiebeveiliging Overheid (BIO) is the framework of standards for all layers of government and is based on ISO 27001 and 27002. Use the current version; you can find it via digitaleoverheid.nl. For cloud services, four topics are the most difficult:
- knowing where data is stored and processed
- determining who has access, and being able to demonstrate that
- logging access and being able to view those logs yourself
- managing the risks of suppliers
In Microsoft 365, you can set up much of this, but not keep everything in your own hands. Key management and logging run via Microsoft, and ultimate control lies with an American company. Options such as your own keys reduce the risk, but do not solve the question of jurisdiction.
Since 15 August 2026, the Cybersecurity Act has also applied, the Dutch implementation of NIS2 (rijksoverheid.nl, 15 August 2026). Government is one of the sectors. The act asks you to manage the risks in your supply chain, and your cloud supplier is part of that.
What the DPIAs showed
Since 2018, the Dutch central government has had DPIAs carried out on Microsoft products via SLM Rijk. Those reports are public. They repeatedly found high privacy risks, including around diagnostic data that went to the US. Microsoft then made adjustments and the central government made additional agreements.
Contractual agreements help, but they do not solve the question of jurisdiction. A contract between you and Microsoft does not stop a US warrant.
What you can do now
- Make an overview of the data in Microsoft 365, per classification. Policy documents are something different from case files with personal data.
- Read the most recent DPIA by SLM Rijk and note which measures your municipality has taken itself.
- Put the CLOUD Act question in your risk register, with a decision at management level.
- For the most sensitive data, investigate a European alternative. You do not have to move everything at once.
- Support your answer to the council with sources, such as the links in this piece.
Where Noveu fits
Noveu is a Dutch company. Data and backups are stored in a Hetzner data centre in Falkenstein, Germany. Cloudflare (US) sits at the edge of the network. You use mail, files and documents, Messages (beta) and Noveu Meet via a link (beta). What that means per BIO topic, you can read on our page for government.
A conversation about your situation
Together we look at which data is stored where and what a European workplace means for your municipality.
Plan a conversation