The technical core of the issue is that Windows 11 requires a Microsoft account by default during setup, which means BitLocker keys are automatically linked to the user’s online identity and stored in the Microsoft cloud. In the Home edition, this cloud storage is effectively mandatory. Even in Enterprise and Education editions, cloud storage may be active depending on Group Policy configuration and is promoted by Microsoft as the recommended approach.
By comparison, Apple stores FileVault keys via iCloud Keychain using end-to-end encryption, meaning Apple itself has no access and therefore cannot hand over keys even under legal compulsion. Microsoft, by contrast, has structural access to these keys and provides them when legally required.
If BitLocker keys are stored in the Microsoft cloud, the factual control over the encrypted data no longer lies exclusively with the organization. As a result, the protective effect of encryption against third parties – including U.S. authorities based on the CLOUD Act – is limited. This directly affects the assessment of technical safeguards under Article 32 GDPR, the execution of Transfer Impact Assessments (TIA) when using Microsoft cloud products in the context of international data transfers, and the records of processing activities as well as the outcome of the Data Protection Impact Assessment (DPIA) under Article 35 GDPR.
In addition, it must be considered that the U.S. CLOUD Act enables U.S. authorities, under certain conditions, to access data managed by U.S. companies – regardless of where the data is stored. As a U.S.-based corporation, Microsoft is also subject to this jurisdiction.
Companies are particularly exposed if they use Windows Home editions, operate devices without dedicated Group Policy configuration, rely on managed device environments with default settings, or list BitLocker in their DPIA or technical and organizational measures (TOM) catalogue as an effective security measure without documenting the key storage location.
US Supreme Court kippt FTC-Unabhängigkeit: Rechtsgrundlage des EU-US Data Privacy Framework weiter erschüttert Der US Supreme Court hat am 29. Juni 2026 im Verfahren Trump v. Slaughter mit 6:3-Mehrheit entschieden, dass die gesetzlichen Abberufungsschutzregelungen für
Storing corporate data in European data centers operated by U.S. providers does not rule out access by U.S. authorities. A legal opinion by the University of Cologne, commissioned by the German Federal Ministry of the Interior and published in December 2025, confirms that U.S. authorities have extensive access to cloud data stored in Europe.
Since January 2026, a sophisticated phishing campaign has been active in which attackers send deceptive emails using the legitimate Microsoft sender address no-reply-powerbi@microsoft.com . This is technically possible due to a legitimate feature of Microsoft Power BI: when creating a dashboard, any external email address can be added as a subscriber, and the content of the automatically sent notification can be freely configured.
