The EU’s data protection watchdog is reviewing the Microsoft 365 report

Back in MarchThe European Commission’s use of Microsoft 365 has been found to violate the bloc’s data protection rules. Since then, we haven’t heard much about this awkward situation. But Monday was the deadline for the EU executive to respond to an order by the European Data Protection Supervisor (EDPS) demanding it stop any infringing data flows and fix its contracts with Microsoft.

On Tuesday, EDPS Wojciech Wiewiórowski confirmed receipt of the Commission’s report, which he said he was now reviewing to determine whether the bloc had complied with the March order. “Given the vast scope of the data and the complexity of the processing operations involved, this analysis will require careful consideration and will be conducted thoroughly within an appropriate time frame,” Wiewiórowski said, suggesting that another long period of radio silence would continue.

The Commission and Microsoft are also challenging the EDPS decision (cases T-262/24 and T-265/24), which further explains the current minimalist records of the EDPS. But 2025 seems to be the decisive year of the issue.