Microsoft 365 and Swiss Data Protection: The Limits of Delegated Compliance

October 21, 2026By David Papaux

Office software, email and collaborative storage have shifted, within a few years, to hosted suites. For a Swiss law firm or company, the question is no longer whether Microsoft 365 is used, but whether that use withstands scrutiny under data protection law. The following analysis is deliberately critical: not because the cloud would be unlawful as such, but because compliance there becomes a service bought off the shelf, difficult to verify and largely dependent on foreign law. The self-hosted open-source alternative offers no immunity, but it shifts control to where the controller can actually exercise it.

What the LPD actually requires

Since the entry into force of the loi révisée sur la protection des données, the framework is clear: processing principles (art. 6), appropriate security in light of the risk (art. 9), information of data subjects (art. 19), impact assessment in the event of high risk (art. 22), and criminal sanctions of up to 250 000 francs imposed on natural persons (art. 60 ss). Nothing in this regime requires or prohibits the cloud; everything requires being able to demonstrate, with supporting documents, that the processing is lawful, proportionate and secure.

Transfers abroad and US law: the point of friction

The difficulty is not technical; it is legal. European hosting of Microsoft 365 does not preclude the application of US law to data processed by the parent company and its downstream processors, in particular the CLOUD Act. The Union case law on transfers, in particular the Schrems II judgment, has made this analysis unavoidable for any controller established in Switzerland that exports data to the United States.

The Federal Council's recognition of the Data Privacy Framework as of 15 September 2024 has eased the situation for certified companies. It does not resolve it. Certification covers specific entities and categories of data, it is revocable, it remains contested, and it changes neither the scope of foreign surveillance measures nor the position of the support provider located outside the certified perimeter. For sensitive data within the meaning of art. 5 LPD — health data, proceedings, political opinions in a file — the exercise amounts to a documentary challenge.

Outsourcing does not transfer responsibility

The LPD is less formalistic than art. 28 du RGPD, but the result is identical: the controller remains accountable for the result. Yet auditing proprietary code is impossible; it is reduced to reading ISO 27001 attestations or SOC 2 reports prepared by or for the provider. For the lawyer, professional secrecy (art. 321 CP) is added to this: entrusting files to an infrastructure whose access escapes the firm's effective control is not neutral, and federal law additionally imposes specific precautions.

Internally, an employer deploying a collaborative suite with telemetry, logging and productivity tools must respect the employee's protection of personality (art. 321a CO); unauthorized access to or misappropriation of data by an employee or a third party falls under art. 179novies CP. These risks exist regardless of the hosting, but they are more difficult to control when it is unknown where and by whom the logs are kept.

Impact assessment: an often skirted exercise

The federal authority regularly reminds us: the impact assessment under art. 22 LPD must concern the concrete processing, including its legal environment. Copying the provider's compliance questionnaire is not one. A serious analysis requires identifying the actual data flows, the successive processors, the storage and support locations, and then weighing the residual risk. This is precisely where files are often incomplete.

The self-hosted open-source option: a structural advantage

A suite such as Nextcloud, combined with Collabora Online, installed on an infrastructure chosen and administered in Switzerland, changes the nature of the problem. The code is auditable, transfers abroad disappear, logs remain under control, reversibility is real and costs become predictable. This is not an argument of technological sympathy, but of law: demonstrating compliance becomes possible because the controller controls the components.

The advantage is, however, structural, not automatic. A self-hosted server that is poorly updated, without strong authentication, without tested backups, without access segregation or usable logging, exposes more than a large, correctly configured platform. The LPD is technology-neutral: it requires appropriate security and effective governance. Self-hosting shifts the burden of proof; it does not eliminate it, and it presupposes internal skills or a contractually committed partner.

A governance requirement, not a provider requirement

The decisive criterion is therefore not « cloud or local server », but the ability to document the choice, to justify the balancing, to monitor the processor and to periodically reassess the decision. A firm that keeps Microsoft 365 without an analysis of transfers or compensatory measures takes a risk that is difficult to defend; a firm that migrates to open source without a security policy or a recovery plan has gained nothing. Compliance is proven, not bought.