The technical core of the issue is that Windows 11 requires a Microsoft account by default during setup, which means BitLocker keys are automatically linked to the user’s online identity and stored in the Microsoft cloud. In the Home edition, this cloud storage is effectively mandatory. Even in Enterprise and Education editions, cloud storage may be active depending on Group Policy configuration and is promoted by Microsoft as the recommended approach.
By comparison, Apple stores FileVault keys via iCloud Keychain using end-to-end encryption, meaning Apple itself has no access and therefore cannot hand over keys even under legal compulsion. Microsoft, by contrast, has structural access to these keys and provides them when legally required.
If BitLocker keys are stored in the Microsoft cloud, the factual control over the encrypted data no longer lies exclusively with the organization. As a result, the protective effect of encryption against third parties – including U.S. authorities based on the CLOUD Act – is limited. This directly affects the assessment of technical safeguards under Article 32 GDPR, the execution of Transfer Impact Assessments (TIA) when using Microsoft cloud products in the context of international data transfers, and the records of processing activities as well as the outcome of the Data Protection Impact Assessment (DPIA) under Article 35 GDPR.
In addition, it must be considered that the U.S. CLOUD Act enables U.S. authorities, under certain conditions, to access data managed by U.S. companies – regardless of where the data is stored. As a U.S.-based corporation, Microsoft is also subject to this jurisdiction.
Companies are particularly exposed if they use Windows Home editions, operate devices without dedicated Group Policy configuration, rely on managed device environments with default settings, or list BitLocker in their DPIA or technical and organizational measures (TOM) catalogue as an effective security measure without documenting the key storage location.
2026 is once again a year of numerous simultaneous developments in data protection in Germany and across Europe: the highest GDPR fine ever imposed in Germany, another EU-wide coordinated enforcement action – this time focusing on transparency and information obligations – and key implementation phases of various EU digital laws, including the new transparency requirements
The U.S. Supreme Court ruled on June 29, 2026, in Trump v. Slaughter, by a 6–3 majority, that the statutory removal protections for commissioners of the Federal Trade Commission (FTC) violate the constitutional separation of
Storing corporate data in European data centers operated by U.S. providers does not rule out access by U.S. authorities. A legal opinion by the University of Cologne, commissioned by the German Federal Ministry of the Interior and published in December 2025, confirms that U.S. authorities have extensive access to cloud data stored in Europe.
