Microsoft announced on June 16, 2025 that data stored by its European cloud customers will remain within Europe and comply with local laws.

Operations will be managed by local personnel, ensuring that customers maintain full control over their data.

This decision responds to concerns from European companies and governments regarding data being transferred outside the continent, particularly to the US.

In April, Microsoft outlined its strategy for protecting user data while expanding its cloud and AI infrastructure in Europe.

These measures will adhere to European regulations that aim to limit the influence of large tech companies.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ Europe’s data sovereignty journey reflects shifting power dynamics in global tech

The Microsoft announcement is part of a longer journey that began with GDPR implementation in 2018, when the company first committed to putting “customers in control of their own data” 1.

This evolution accelerated after a 2018 Dutch government investigation found Microsoft in violation of GDPR through “large scale and covert collection” of user data from Office applications, affecting over 300,000 government computers 2.

The geopolitical context is significant. 97% of Europe’s cloud market is dominated by US and Chinese providers, creating fundamental tensions between European sovereignty desires and foreign cloud dependency 3.

Microsoft’s new approach represents a direct response to increasing European regulatory pressure, including requirements for data localization, transparency, and protection from foreign government access that have intensified since 2018.

The company’s strategy demonstrates how US tech giants must now balance their global operations with localized governance, shown by their creation of a European board of directors to oversee data center services 4.

2️⃣ The technical architecture of true data sovereignty goes beyond data location

Microsoft’s evolution shows that simply storing data within European borders isn’t sufficient for true sovereignty. The entire operational model must be transformed.

Their new approach addresses who can access the data by requiring that “all remote access by Microsoft engineers to the systems that store and process European data would be approved and monitored by European resident personnel in real-time” 5.

Recent Microsoft developments