Cloud Act and Microsoft 365: where is your data, and who can access it?

The CLOUD Act requires a cloud provider subject to US law to hand over to US courts the data it holds or controls, wherever that data is stored. Enacted on 23 March 2018, it added section 2713 to Title 18 of the United States Code following a dispute in which Microsoft refused to hand over emails stored in its Dublin datacentre; the Supreme Court then dismissed the case as moot on 17 April 2018. The law gives no direct access to servers: it works through legal process (a warrant or court order) served on the provider, in criminal investigations. The provider can ask for it to be quashed if the customer is not a US person and disclosure would risk breaching the law of a country bound to the United States by an executive agreement. The US Department of Justice lists only two signed agreements, with the United Kingdom in 2019 and Australia in 2021. With the European Union, negotiations resumed in March 2023, with no agreement published to date. For a French company, this route of challenge therefore does not currently exist, although the law preserves the international comity analysis developed by case law.

The EU Data Boundary ensures that most of your data is stored and processed in the European Union and EFTA, but Microsoft Corporation remains a US company. Microsoft rolled it out in three phases: customer data for the core services (Microsoft 365, Dynamics 365, Power Platform, Azure) in January 2023, pseudonymised logs in January 2024, then technical support data, with completion announced on 26 February 2025. A Microsoft 365 tenant is in scope if its sign-up country is in the EU or EFTA, unless it has purchased Multi-Geo, according to the Microsoft Learn documentation. Some data still leaves the boundary: remote access by engineers outside the EU when a repair requires it, security operations run globally, part of the Microsoft Entra directory, support case titles, preview services, and any transfer you trigger yourself, such as an email sent outside the EU. The Paris and Marseille datacentres add a contractual commitment: for a tenant created in France, Exchange Online, SharePoint, OneDrive, Teams and Copilot interactions are stored at rest in the country. Note that since 14 September 2026 the admin centre shows the setting “Store Microsoft 365 customer data in-country”, off by default for eligible tenants created after that date. From 14 December 2026, a tenant left with the setting off may see its data moved elsewhere within the EU Data Boundary, according to Microsoft's data residency page. If hosting in France appears in your contracts, check this setting before that date.

Microsoft commits, in its Privacy Trust Center, to redirecting authorities to the customer, notifying the customer unless legally prohibited, challenging any government request where the law allows, and compensating its business customers if it discloses their data in breach of the GDPR. Its transparency report gives the order of magnitude: in the second half of 2025, 190 law enforcement requests concerned enterprise customers worldwide, and 49% led to information being disclosed. Over the same period, Microsoft provided US authorities with content relating to 3 non-US enterprise customers whose data was stored outside the United States, 1 of them located in the EU or EFTA. The risk is low in volume, but not zero. On 10 June 2025, before the French Senate inquiry committee on public procurement, the director of public and legal affairs of Microsoft France, asked to guarantee under oath that French citizens' data would never be passed to US authorities without French consent, replied: “No, I cannot guarantee it”, while adding that it had never happened.

European law does not automatically recognise a foreign order: under Article 48 of the GDPR, a decision by a court of a third country requiring the disclosure of personal data is only enforceable if it is based on an international agreement, such as a mutual legal assistance treaty. The provider is then caught between two legal systems, and this conflict is what Microsoft's promised challenges rely on. For transfers of personal data to the United States, the framework in force is the EU-US Data Privacy Framework, adopted by the European Commission on 10 July 2023 on the basis of the US presidential executive order of 7 October 2022 that sets limits on intelligence activities. The General Court of the European Union dismissed the action brought by French MP Philippe Latombe on 3 September 2025 (case T-553/23), and an appeal is pending before the Court of Justice (case C-703/25 P). The framework applies, but it could fall as Safe Harbor and the Privacy Shield did before it. Note also that it mainly addresses intelligence access: CLOUD Act court requests follow their own rules. For any binding decision, have the analysis validated by your DPO or a lawyer.

Encryption directly affects what a third party can read, provided Microsoft does not hold all the keys. Microsoft 365 already encrypts data at rest with keys managed by Microsoft. Customer Key adds an encryption layer using your own keys, held in Azure Key Vault (two paid Azure subscriptions, two keys per policy). Microsoft 365 still uses these keys, with your authorisation, for search, anti-spam and eDiscovery: the main benefit is revocation, which triggers cryptographic deletion of the data. Microsoft reserves it for Microsoft 365 E5, Office 365 E5 and the Microsoft Purview Suite or Microsoft 365 E5 Information Protection and Governance add-ons; neither Business Premium nor E3 is enough. Double Key Encryption (DKE) goes further: the document is protected by two keys, one of them hosted by you, and Microsoft only has access to one of them. In return, there is no co-authoring, no Office for the web, no search or eDiscovery, and Copilot cannot read these files. In its 2026 documentation, Microsoft intends it for about 5% of a typical organisation's data. It is included in Microsoft 365 E5, listed at €58.13 excluding VAT per user per month against €19.06 for Business Premium (microsoft.com/fr-fr, 26 October 2026, annual commitment), and in the same add-ons. You still need to know what to protect: Purview sensitivity labels, applied manually, are included in Business Premium and E3, as explained in our article on data governance with Microsoft Purview.

ANSSI's SecNumCloud framework addresses jurisdiction, not just location. Its version 3.2 of 8 March 2022 requires a registered office in the EU, share capital and voting rights held by non-EU entities at no more than 24% individually and 39% collectively, and that no non-European subcontractor has the technical ability to obtain the data. S3NS, a Thales subsidiary working with Google Cloud, announced on 17 December 2025 the SecNumCloud 3.2 qualification of its PREMI3NS offering, which covers infrastructure and platform services, not an office suite. Bleu, founded by Orange and Capgemini to provide Azure and Microsoft 365, announced on 17 April 2025 the validation of the first milestone of its qualification, then targeting the first half of 2026. As of 26 October 2026, its website still describes it as “en cours de qualification” (qualification in progress), and according to the specialist press, Microsoft 365 will be qualified after the Azure services. For most SMEs, the priority therefore lies elsewhere. If a public-sector customer, a tender or your NIS 2 obligations raise the question, build this timetable into your plans now.

Start with what can be checked in an hour, then deal with encryption one data category at a time. First, in the Microsoft 365 admin centre, open the data location card (Settings, Org settings, Organization profile, Data location) and check the tenant's geography and the in-country storage setting before 14 December 2026. Next, list the data no third party should read (trade secrets, HR files, health data, live bids) and apply a Purview label to it. For this small share, decide with your DPO whether DKE justifies E5 licences for the users concerned. Finally, record the analysis in your record of processing activities. Our certified consultants can review this with you during a free 15-minute audit, and our security page describes our support around Microsoft 365.