Something happened in Switzerland in mid-November that hardly anyone expected in this form: The country's data protection commissioners passed a clear, almost historic resolution. The message behind it is simple - and at the same time highly controversial: public authorities should no longer outsource their most sensitive data to international cloud services such as Microsoft 365 without hesitation. Why is that?
Because responsibility for particularly confidential data - health records, social cases, criminal investigations, internal documents - must not be handed over to companies that can never technically completely rule out access to this data. This is precisely the essence of the Swiss decision. You don't have to be deeply involved in IT to understand the basic idea. In the past, important files were stored in a locked filing cabinet in the town hall. Today, the same data is often stored somewhere abroad - on the servers of large US corporations, which in turn use their own partner companies and subcontractors. And even if these providers assure us that everything is secure, the authorities themselves can no longer really check this.
There is also a point that is often overlooked in the public debate: US companies can be forced to hand over data under US laws such as the CLOUD Act - even if this data is actually stored in Europe. For European countries, and even more so for a country like Switzerland, which traditionally places great value on independence, this is a heavy burden. Against this backdrop, the Swiss data protection authorities have now made their position clear:
If a public authority stores data that is specially protected or even covered by official secrecy, then no one else - not even a cloud provider - must be able to access it. And as long as there is no real end-to-end encryption where the authority alone manages the keys, this is simply not feasible with today's cloud services.
Switzerland is thus pulling the ripcord - out of caution, tradition and a deeply rooted understanding that state data is a particularly valuable asset. And interestingly, German authorities, data protection officers and IT managers are now also taking a very close look at whether a new standard is emerging here.
What the Swiss resolution really says
How Heise Online and Inside IT As we reported in our report, the body responsible for this decision is the Data Protection Conference privatim, an association of the Federal Data Protection Commissioner and all cantonal supervisory authorities. Although its decisions are not laws, they carry enormous weight. In practice, many authorities implement their guidelines as if they were binding - because they specify what is permissible and responsible from a data protection perspective. Who is the resolution aimed at? The target group is public authorities:
- Federal authorities
- Cantonal offices
- Municipalities
- Courts
- state institutions
Private companies are not formally affected by the resolution. However, if the standards for state institutions are set so strictly, the private sector will find it difficult to take a much more lax approach in future - especially in areas such as healthcare, education and insurance.
The key message: sensitive data does not belong in international clouds
The Resolution formulates it carefully but unequivocally: most sensitive government data must not be outsourced to cloud services as long as the providers could have technical access. And this does not apply to just any niche applications, but precisely those cloud products that many administrations now use as standard, including
- Microsoft 365
- Google Workspace
- Various SaaS applications from international providers
The sticking point is always the same: there is no real end-to-end encryption where the authority holds the keys and the provider is technically excluded. As long as the cloud service itself rolls out updates, carries out configurations or has administrator rights in the event of support, theoretical access remains - and that is more than enough of a risk for Swiss data protection experts.
Why Switzerland is drawing this line
The Swiss decision follows a clear logic that could be summarized with a classic, almost old-fashioned principle:
You can't really protect what is not in your own sphere of influence. Three motives are at the heart of this:
- Protection of state sovereigntyState data is a foundation of sovereignty. If international providers - possibly under foreign jurisdiction - could theoretically access it, the state loses a piece of this sovereignty.
- Protection of official secrecy: Official secrecy is particularly important in Switzerland. It is not only intended to prevent political intrigue, but also to ensure the trust of citizens. As soon as data leaves the country, this trust becomes more difficult to guarantee.
- Protection of particularly sensitive personal dataHealth data, police files, social cases - these are all areas where unauthorized access would have serious consequences. And even the slightest risk is considered unacceptable here.
Which data is particularly affected?
The resolution explicitly refers to:
- particularly sensitive personal data
- Data subject to statutory confidentiality (official secrecy)
- Data from police, justice, social services, health, administration
For such information, the resolution calls for a standard that today's SaaS systems do not offer: full encryption under the sole control of the authority. Without this standard, outsourcing to international clouds is „inadmissible in most cases“ - according to the wording.
What is left for authorities to do?
Technically speaking, they only have a narrow corridor:
- Cloud storage with its own upstream encryption
- Operation of own key infrastructure
- or completely local solutions, i.e. on-premise or Swiss providers
This does not mean that authorities are no longer allowed to use the cloud at all. But they must ensure that the provider has no way of reading the data in plain text. And this is precisely what is virtually impossible to implement in practice with most modern cloud tools, because these systems can only perform their functions if they process the data themselves. Switzerland is thus indirectly saying:
„Use the cloud sparingly and only where you can really control it.“
And that in itself is a remarkable step - one that is also causing discussion outside Switzerland.
The five core arguments - from the lack of end-to-end encryption to the contract lottery
1. lack of genuine end-to-end encryption
The most important point is also the simplest: as long as a cloud provider has technical access to data, it is not permitted to use it for particularly sensitive information. And this is precisely where practically all international SaaS offerings fail - even if they call themselves „secure“, „certified“ or „data protection-compliant“. Why? Because services such as Microsoft 365, Google Workspace or other large cloud platforms only work if they can process the data from our work: Documents, emails, calendars, meetings, chats. The systems analyze, search, synchronize and connect content - that's their business model.
Genuine end-to-end encryption, where the authority alone holds the key and the provider has no insight, would make these functions largely impossible. This is precisely why providers do not offer complete separation in this respect. And that is why the Swiss data protection experts say:
„As long as this is not possible, we cannot use such systems in good conscience.“
2. non-transparent subcontractor chains and lack of control
Large cloud providers work with a huge network of subcontractors. These structures are often distributed globally, change regularly and are almost impossible for outsiders to understand. Even if there is an official contract with Microsoft or Google, the following often applies in the background:
- Other companies provide support
- External teams carry out maintenance work
- other service providers host or manage parts of the infrastructure
For a public authority, this means that it cannot know exactly who has or could have access and when. And this contradicts the principle that a public authority must be able to see where its data is located at all times and who can potentially access it. The Swiss authorities have deliberately emphasized this point because transparency and accountability are closely linked.
3. unilateral contract amendments - the cloud as a legally wobbly basis
One risk factor that is often overlooked is the contract design. Many cloud providers reserve the right to change their terms and conditions at any time - sometimes with very short lead times. This is somehow acceptable for private companies, but:
The principle of predictability applies to public authorities. The administration must be able to document and justify which data is processed and how. However, if the framework conditions change spontaneously - because the provider inserts new clauses or restricts existing ones - a situation arises in which the authority can no longer assess its own legal compliance with certainty.
Swiss data protectionists consider this „contract lottery“ to be incompatible with state obligations. A state cannot rely on business models that can be changed at any time - without co-determination.
4. loss of control and fundamental rights risk
As soon as data leaves the country or is processed outside its own area of responsibility, a risk arises: the state loses some of its control.
This may seem abstract at first glance, but it is very concrete in everyday life: if an error occurs, if data is compromised or if a legal dispute arises, a public authority can no longer ensure that it can manage without outside help. And this is precisely what contradicts the basic idea of a functioning public administration:
A state must be able to act on its own in an emergency - without being dependent on external companies or foreign legal systems. Swiss data protectionists have a traditional, almost old-fashioned approach here - and this is precisely what makes their position so consistent. State tasks remain state tasks. And state data belongs in state hands.
5 The US CLOUD Act - the heart of the concerns
The CLOUD Act is perhaps the most important background to this whole discussion. This US law obliges American companies to hand over data to US authorities on request - even if this data is stored abroad and is actually subject to the protection of foreign laws. For Switzerland, this is an absolute no-go.
This would theoretically make it possible for US authorities to gain access to sensitive Swiss administrative data without involving Swiss courts or authorities. Even if the cloud providers assert that they will only release such data under strict conditions, the basic problem remains:
The authority loses sovereignty over its data - simply by choosing the technical service provider. For a country that has traditionally upheld its independence, this is a risk that is not worth taking. And it is precisely this point that the Swiss data protection experts are making very clear.
Switzerland versus Microsoft 365 - and Germany is watching closely | heise & c't
Switzerland versus the EU - two ways of dealing with Microsoft 365
While Switzerland takes a very cautious approach and explicitly warns authorities against outsourcing sensitive data to international SaaS services, the European Union takes a different approach. It is trying to find a middle way through agreements, contractual improvements and technical adjustments - one that does not fundamentally ban cloud services, but rather aims to make them „usable“ by imposing conditions.
This difference is remarkable and says a lot about how differently states deal with the issue of digital sovereignty.
Switzerland: caution, data sovereignty and a clear boundary
The Swiss position can be summarized in one sentence:
„What I can't control, I won't let out of my hands.“
Switzerland is thus sticking to a traditional principle: state data - especially secret or particularly sensitive data - remains in the country or is encrypted in such a way that no one but the authorities themselves can access it. It is a deliberate return to old principles, transferred to the present of the digital world.
The EU: treaties, exemptions and compromise solutions
The European Union is taking a different approach. It wants to use the advantages of large cloud platforms without banning them completely. To this end:
- New contracts negotiated
- Data protection assurances added
- Control mechanisms and audits introduced
- Technical guarantees supplied subsequently
The decision by the European Data Protection Supervisor that the EU Commission may use Microsoft 365 in compliance with data protection regulations under certain conditions is exemplary. Similar statements are now being heard from several member states - including parts of Germany. The basic idea:
„We regulate the cloud instead of banning it.“
But this approach is based on trust in the providers - and on the fact that complexity remains manageable. Critics argue against this: The larger the platform, the more difficult it is to control.
Germany between two worlds
Germany is caught between a rock and a hard place. Some state data protection authorities are more cautious, others are more practically oriented.
In the school sector, for example, there have already been strict decisions against Microsoft 365, while at a federal level work is being done on solutions that enable its use. The result: a patchwork quilt.
This is precisely why many are now looking at the Swiss line - because it sets a clear standard for the first time instead of working its way through compromises.
Two philosophies collide
To put it in a nutshell, there are two opposing schools of thought:
- The Swiss tradition: „Our data stays with us - or it stays encrypted and nobody else sees it.“
- The European pragmatics: „We need modern platforms - so we are coming to terms with them as best we can.“
Both paths have their strengths. But Switzerland is sending out a clear signal: it shows that a state can consciously focus on digital independence in the 21st century without becoming dependent on global corporations.
And this attitude alone is already causing authorities, data protection officers and IT departments throughout Europe to take a closer look at whether previous practice is really as irrefutable as it has always seemed.
| Criterion / Topic | Swiss view (privatim / authorities) | Current EU/German practice or opinion |
|---|---|---|
| Target group | Public institutions: Confederation, cantons, municipalities, courts, etc. | Public authorities & administrations (in part), but many public authorities also continue to use SaaS clouds; partly inconsistent regulations depending on the country and federal state. |
| Data type / sensitivity | Data requiring special protection or confidentiality (health, police, social services, official data, etc.) - restrictive cloud use required. | Cloud use also possible for sensitive data - depending on risk assessment, data protection measures and provider contract; often compromises and individually different handling. |
| End-to-end encryption / key sovereignty | Only acceptable if the authority itself controls the key and the provider is technically excluded; otherwise use is not permitted. | Standard clouds are used, even without own key sovereignty; provider encryption is usually sufficient, provided data protection contracts and requirements exist. |
| Subcontractors / transparency of the infrastructure | Subcontractor chains are considered too opaque - no permitted use with critical data. | Subcontractor chains are accepted - with proof of compliance, certifications and contractual regulations, but transparency is often limited. |
| Contract amendments / legal security | Unilateral contract amendments by providers are a no-go - state obligations must not be risked. | Services are used even if providers can change contracts; authorities/companies take risks - often with legal agreements and control mechanisms. |
| Danger from US laws (e.g. CLOUD Act) | US laws are considered an unacceptable risk - cloud use prohibited for sensitive data as long as providers may be subject to US court orders. | Despite the CLOUD Act, international clouds are used; risk is often considered acceptable, with reference to protection mechanisms, data boundary or EU standard contractual clauses. |
| Recommended alternatives | On-premise, Swiss/European providers with key sovereignty, own infrastructure or strongly encrypted storage solutions. | Hybrid cloud, providers with data centers in Europe, cloud services subject to conditions; frequent use as long as compliance standards are met. |
| Philosophy / basic attitude | Precautionary principle, control, state sovereignty and maximum data sovereignty. | Pragmatism, ability to compromise, risk management and trust in contractual/technical framework conditions. |
A look across the border: why Germany needs to take a closer look now
The Swiss resolution comes at a time when German authorities and companies are already increasingly unsure about how to deal with cloud services. On the one hand, the economy is pushing towards the cloud - promising automation, collaboration and cost efficiency. On the other hand, the question is: how much control do we give up?
This is precisely where the Swiss decision has a signal effect. It holds up a mirror to Germany and shows what happens if you think things through to the end. This affects not only ministries and authorities, but also schools, law firms, doctors' surgeries, SMEs and anyone who works with sensitive data. The Swiss basically say:
„We use modern technology - but not at the cost of our independence.“
This sentence could easily be written above a German digital strategy. It is not yet - but the decision from Bern has given the discussion new momentum.
The question that no company can ignore
Companies today have to ask themselves a seemingly simple question - a question that would hardly have been asked ten or fifteen years ago:
„Who has access to our data in case of doubt?“
In the past, the answer was clear: yourself. Today it is often: „That depends.“
And it is precisely this „depends on it“ that is a problem for many organizations. As soon as data is stored in cloud systems, it is no longer the company alone that decides who can access it. It decides:
- the provider
- its subcontractors
- its data processor
- foreign authorities (in the case of US providers even without European consent)
If you look at it soberly, you quickly realize that there are fewer and fewer clear answers to the question of real data sovereignty.
And that's why the Swiss line suddenly no longer seems old-fashioned - but decidedly modern.
The middle class between comfort and loss of control
Many medium-sized companies in Germany are currently caught between two poles:
- The convenience of modern cloud platforms
- Files synchronized everywhere
- Video conferencing in seconds
- Integrated e-mail, calendar and communication systems - The desire for control, confidentiality and independence
- especially for confidential data
- strategic trade secrets
- intellectual property
- Customer or employee data
The Swiss decision shows one possible direction: you can use technology, but you don't have to blindly follow every trend. Some ways are convenient, but convenient is not always safe.
Current survey on digitalization in everyday life
My own cloud moment with HostEurope
I have been following this Swiss development particularly closely because I found myself in a very similar situation some time ago. HostEurope wanted my entire e-mail system - without consultation, without further inquiry - to be simply migrated to Microsoft 365 become. This would have meant that my communications would suddenly be stored in an international cloud, under conditions that I cannot control and with the risk of foreign authorities gaining access in case of doubt.
For me, that was a clear point at which I said: Stop - not like this. I deliberately decided against HostEurope because I don't want my data to be moved to a system over which I ultimately no longer have any real control. This one moment made me realize once again how quickly you can get caught up in structures that you never wanted - and how important it is to pull the ripcord yourself before others take control of your data.
What the development means for all of us
If you take a sober look at the developments of recent years, you might think that the world is moving at full speed towards technological dependency. Everything is being centralized, standardized and moved to the cloud - often without really examining the long-term consequences.
And now a small country in the middle of Europe is coming along and reminding everyone that it is possible to act differently: thoughtfully, respectfully, carefully - and with a clear view of one's own responsibilities. This Swiss attitude is not a step backwards. It is a return to the old question that many have almost forgotten in the hectic pace of digitalization:
„Who is responsible if something happens?“
If the answer to this is no longer clear, then something is wrong.
What this means for each individual
Ultimately, this decision does not only affect public authorities or large companies - it affects everyone who produces, stores or exchanges data.
- You don't have to be a technician to understand that every outsourcing costs a piece of control.
- You don't have to be a data protection expert to realize that sensitive information is better off if you know where it is.
- And you don't have to be a lawyer to realize that foreign laws are problematic if they could decide on your own data.
Common sense is enough. And this is exactly what Switzerland is trying to bring back to mind.
The decision from Bern is not a call for hostility towards technology, but an appeal to our own standards. It's a reminder that digitalization doesn't mean blindly handing ourselves over to the biggest providers - it means asking ourselves how much responsibility we are handing over. About the topic Cloud and data sovereignty I had already written an article about this in the past.
Entrepreneurs who opt for ERP software without the cloud will find helpful information in this separate article.
In a way, Switzerland is showing us something that we have all known for a long time but often suppress: Sovereignty does not begin with technology - it begins with attitude. With the way you make decisions. With the willingness to question things critically.
And with the courage to take a different path if necessary, if it is more sensible.
Frequently asked questions
- Why has Switzerland taken such a strict stance towards international cloud services such as Microsoft 365?
Switzerland follows a clear principle: state data must be protected in such a way that no one other than the responsible authority can access it. International cloud providers can technically and legally never completely rule out the possibility of data being accessible to them in an emergency - be it for maintenance reasons, through administrator rights or through government requests from their home country. This is an unacceptable risk for particularly sensitive data, such as that processed in the administration, justice, police or healthcare systems. The Swiss data protection authorities are therefore drawing the logical conclusion and severely restricting cloud use as long as there is no genuine end-to-end encryption under the sole key sovereignty of the authority. - Does this decision apply to all data or only to certain categories?
The resolution is primarily aimed at data that is particularly sensitive or subject to confidentiality - including health data, social files, investigative information and internal communications with authorities. Switzerland requires the highest security standards for these categories, which international SaaS platforms currently do not meet. Less sensitive data may still be outsourced, but only after careful risk assessment and in compliance with certain protective measures. - Are companies in Switzerland also affected?
Formally, the resolution is aimed exclusively at government agencies. In practice, however, it will also have an impact on companies, especially those that process sensitive or legally protected data - for example hospitals, insurance companies, banks or educational institutions. If public authorities are no longer allowed to use certain services, it will be more difficult for private organizations to classify the same services as „completely unproblematic“. - What is the biggest technical problem with Microsoft 365 from a Swiss perspective?
The central problem is the lack of genuine end-to-end encryption. Microsoft 365 requires access to content in order to enable functions such as search, indexing, team chats, calendars, anti-spam or AI features. This means that servers and administrators can technically always see the plain text. Even if Microsoft emphasizes that it does not do this, the possibility remains - and it is precisely this theoretical possibility that poses a risk to the Swiss authorities. - What role does the US CLOUD Act play in the decision?
The CLOUD Act obliges US companies to hand over data at the request of American authorities - even if this data is stored abroad. For Switzerland, this means that even if Microsoft uses European or Swiss data centers, data may have to be made accessible to American authorities. This possible access contradicts the Swiss understanding of sovereignty and official secrecy. The CLOUD Act is therefore cited as a serious counterargument. - Why are treaties or „EU data borders“ not enough for Switzerland?
Contracts and technical protection measures are valuable instruments, but they do not change the legal reality. If a US company is obliged to hand over data, there is no contract about it. In addition, large cloud providers can change their terms and conditions at any time. The Swiss data protection experts therefore say: legal certainty is not created by promises, but by actual control over the data - and this control is not fully given in SaaS clouds. - What does the resolution mean in concrete terms for authorities?
In future, authorities will have to prove that they are not outsourcing sensitive data in such a way that a cloud provider could access it. In practical terms, this means that Microsoft 365 and other international SaaS platforms may no longer be used for such data. Authorities must either rely on local solutions, switch to Swiss providers or use their own encryption mechanisms where the provider has no access whatsoever. - Can authorities continue to use cloud services if they use their own encryption?
Yes - but only if the authority retains complete control over the keys and the provider is technically excluded. The problem is that many cloud services no longer work at all if content is encrypted before processing. In practice, Microsoft 365 would therefore only be usable as a pure data storage solution - without collaboration tools, email system, calendar, Teams or automated Office functions. - How does the Swiss position differ from the EU's current line?
The EU is trying to make the use of Microsoft 365 compliant with data protection regulations through agreements, audits and contractual guarantees. The aim is to utilize the advantages of the cloud without fundamentally questioning them. Switzerland, on the other hand, relies on the precautionary principle and draws a clear line: without complete control over the data, use is not permitted. This creates a contrast between European pragmatism and Swiss consistency. - How are German authorities reacting to this development?
Many German state data protection authorities are keeping a close eye on the Swiss decision. Some have already been critical of Microsoft 365 themselves - for example in schools, where tracking mechanisms and unclear data flows have been criticized. The Swiss resolution could serve as an argumentation booster: If a country with high standards restricts usage, it becomes more difficult for German authorities to take a more liberal line without being able to justify it well. - Why does transparency play such an important role for subcontractors?
Large cloud providers use global networks of partners and subcontractors for support, maintenance and technical services. It is almost impossible for a public authority to understand which companies could have access and when. It is precisely this lack of transparency that makes it impossible to properly assess risks. Switzerland sees this as a fundamental problem: a public authority needs to know who could access its data - and this is virtually impossible in complex cloud structures. - How does the decision influence the debate on digital sovereignty in Europe?
The Swiss stance acts as a catalyst. Many EU countries have been talking about digital sovereignty for years, but often rely on the same global providers. Switzerland is now showing that a state can also consistently act differently. This decision will reignite the European debate - especially in the areas of justice, administration and health data, where a strict line could seem particularly sensible. - What can companies learn from this development?
Companies should be aware that outsourcing data always means a loss of control. The Swiss decision is a reminder that it is important to carefully consider which data is transferred where. Companies should consider whether some critical areas are better left locally or in sovereign infrastructures - even if the cloud seems more convenient at first glance. - Is the Swiss decision a step backwards into the past?
No - it is rather a return to fundamental principles that are sometimes lost in digitalization: Responsibility, control, traceability. Switzerland uses modern technologies, but it does not accept losing sovereignty over its most sensitive data in the process. This attitude seems old-fashioned, but is actually future-oriented. - What alternatives do authorities or companies have if they want to avoid cloud services?
There are several options: local servers, Swiss or European providers with strict data sovereignty, hybrid models with their own encryption or completely self-operated infrastructure. These options are not as convenient as clicking on „Subscribe to Microsoft 365“, but they strengthen control - and are completely sufficient for many sensitive applications. - What role does your own HostEurope incident play in this context?
The incident is a typical example of how quickly you can get caught up in structures that you didn't want. If a provider wants to migrate your emails to Microsoft 365 without consulting you, you lose part of your sovereignty at the same time - and completely without being asked. Your decision to opt out immediately was ultimately a step in the same direction that Switzerland has now officially taken: Control instead of convenience. For this very reason, the story is a good example of the practical relevance of the Swiss position. - What does all this mean for private individuals who do not work in the public sector?
Private individuals should also be more aware of where their data is stored. Many people today automatically use international platforms without considering how far these companies can see into their digital lives. The Swiss decision is a reminder that you should not simply treat your own data as a minor matter - because security always starts with the personal decision of who you trust. - How could the situation develop over the next few years?
It is quite possible that Switzerland is setting a trend with this resolution that will later be taken up in the EU. The discussion about sovereignty is getting stronger, not weaker. States and companies will increasingly realize that the cloud is not a law of nature, but a choice. And like any choice, it can be reconsidered - especially if the risks seem greater than the convenience at some point.
