The physical location where data is stored is irrelevant under U.S. law. What matters is control over the data. This applies to Microsoft, Amazon AWS, Google Cloud – and in some cases also to European companies with relevant business relationships in the United States.
For companies subject to the GDPR, this creates a structural compliance problem. Standard contractual clauses, EU data center certifications, and the EU-US Data Privacy Framework cannot resolve this issue.
Furthermore, the opinion even does not rule out that European companies operating through subsidiaries in the United States could be requested, if not “compelled,” by U.S. authorities to disclose data stored in the EU.
U.S. surveillance laws and regulations such as the CLOUD Act (Clarifying Lawful Overseas Use of Data Act of 2018), FISA Section 702 (Foreign Intelligence Surveillance Act), the Stored Communications Act (SCA), or Executive Order 12333 provide U.S. authorities with extensive powers to “compel” companies subject to U.S. jurisdiction to disclose data, or to gain access to data – including data stored abroad – belonging to non-U.S. citizens.
Accordingly, the data protection organization NOYB, led by Max Schrems, had already announced some time ago that it intends to challenge the DPF in court, similar to its actions against Safe Harbour and the Privacy Shield. A third Schrems ruling therefore cannot be ruled out.
As long as U.S. providers remain technically capable and legally obliged to access European data, the use of U.S. service providers for processing personal data of Europeans remains problematic from a data protection perspective and highly questionable in terms of digital sovereignty.
US Supreme Court kippt FTC-Unabhängigkeit: Rechtsgrundlage des EU-US Data Privacy Framework weiter erschüttert Der US Supreme Court hat am 29. Juni 2026 im Verfahren Trump v. Slaughter mit 6:3-Mehrheit entschieden, dass die gesetzlichen Abberufungsschutzregelungen für
Since January 2026, a sophisticated phishing campaign has been active in which attackers send deceptive emails using the legitimate Microsoft sender address no-reply-powerbi@microsoft.com . This is technically possible due to a legitimate feature of Microsoft Power BI: when creating a dashboard, any external email address can be added as a subscriber, and the content of the automatically sent notification can be freely configured.
A report published by Forbes in January 2026 provides the first public evidence that Microsoft has handed over BitLocker recovery keys to the FBI. This was made technically possible by the default configuration of modern Windows versions, which automatically upload recovery keys to the Microsoft cloud. For companies in the DACH region, this results in an immediate need for review:
