Microsoft updates its privacy rules for commercial cloud contracts, after a EU probe found that it failed to protect data under EU law
Paul Hill / Neowin :
Context & Ripple Effects
Microsoft has been walking a decade-long line between marketing privacy and being held to it. In 2015 it staked its cloud credibility on compliance with the new ISO 27018 standard; a year later the French data-protection authority served formal notice over Windows 10 privacy failings (CNIL's three-month ultimatum), and in 2017 Microsoft answered consumer criticism with a privacy dashboard. This update moves the battleground to where enterprise money actually flows: the contract text itself, after an EU probe found the commercial cloud terms failed to protect data under EU law.
The significance is that the fix is contractual, not architectural — Microsoft is amending the legal terms governing Azure, Microsoft 365, and Dynamics 365 deals rather than changing where data sits. That makes this the hinge between the earlier product-level privacy fights and the deeper commitments that follow, notably the 2021 pledge letting EU commercial customers keep their data in the EU.
First-order effects
- Commercial customers signing or renewing Microsoft cloud contracts in Europe get rewritten privacy terms that close the specific gap EU investigators flagged, shifting compliance risk from the customer's procurement team back onto Microsoft's legal commitments.
- The probe's finding gives EU regulators a documented failure to point at, strengthening their hand in any future enforcement against Microsoft's European cloud business.
Second-order effects
- Once one hyperscaler's contract language is corrected under regulatory pressure, every large buyer's procurement team can demand equivalent terms elsewhere, raising the compliance floor Amazon and Google must match in EU deals.
- The episode feeds directly into the broader European backlash against Microsoft's cloud conduct — the same dynamic that produced the relaxation of its cloud licensing rules in 2022 after rival complaints made running Microsoft software on other clouds expensive.
Third-order effects
- If the pattern holds, EU enforcement effectively converts cloud privacy from voluntary certification exercises like ISO 27018 into binding contractual obligations, making the legal terms — not the data centers — the primary compliance surface for US providers in Europe.
- Each probe-and-amend cycle ratchets toward data-localization expectations, which is exactly where Microsoft landed two years later with its pledge to store EU commercial customers' data inside the EU.
The trend: EU regulators are turning cloud privacy from self-certified standards into enforceable contract terms, with each probe tightening what US hyperscalers must legally promise European customers.