On 1 November 2026, Microsoft updated its Data Protection Addendum (DPA) for Microsoft 365. A new clause caused concern among specialists, reported among others by heise online. Legal experts have partly given the all-clear. Still, the case shows how little influence a company has over the rules under which its email is processed in the cloud.
What has changed
The section “Disclosure of Processed Data” now states: if Microsoft becomes aware of apparent child sexual exploitation and abuse material, it may report it to the National Center for Missing and Exploited Children (NCMEC) or another authority. NCMEC is a private US organisation that performs statutory tasks in combating child abuse.
The purpose of the clause is not in dispute. The debate is about how far it reaches.
What specialists say
Most lawyers read the clause as a right to report, not a right to search. Microsoft may report what it has already become aware of. It does not follow that mailboxes and files are scanned systematically. In normal operation, Microsoft remains a processor bound by the customer’s instructions.
Some questions remain open:
- Disclosure without informing the customer. For requests from authorities, Microsoft usually refers them to the customer. Here, Microsoft can decide on its own and report directly.
- “Another authority” is not defined. The text does not say which organisations this may include.
- Text can be affected too. The clause speaks of material, not just images. Medical reports, therapy notes or records of a counselling service may describe such facts without being problematic themselves.
- Data leaves Europe. The report goes to the United States, regardless of which data centre holds the data.
For most companies nothing changes day to day. Those who handle data of patients, clients or mandates should, however, know the clause and reflect it in their documentation.
What the case shows
The clause itself is not the real issue. More important is that a cloud provider can change its terms unilaterally. The customer learns about it through an updated contract version and can accept or terminate. Afterwards they have to update their privacy notice, records of processing and, where required, the data protection impact assessment.
The Swiss Federal Act on Data Protection requires a processor to handle data only as the company itself would be allowed to. The more often the terms change, the more effort it takes to demonstrate this. See also our article on IT measures under the Swiss Data Protection Act.
Metadata already goes to the US
Regardless of the new clause, certain Microsoft 365 data goes to the United States even when mailboxes are stored in Europe or Switzerland. Microsoft documents these exceptions to the EU Data Boundary itself. They include usernames and email addresses from the directory, security monitoring logs, pseudonymised identifiers and device names for licence validation.
Such metadata looks harmless but reveals a lot: who communicates with whom, when, how often and from which device. For a law firm or a medical practice, this information alone can be confidential. In addition, Microsoft as a US company is subject to US law, such as the CLOUD Act, which can give US authorities access to data stored abroad.
With self-operated Zimbra, logs, directory and licence validation also stay on your servers.
Zimbra: email and calendar under your own control
Zimbra is a platform for email, calendars, contacts and tasks. It runs on your own Linux servers, in your server room or with a Swiss hosting provider. The vendor has no access to the mailboxes, and the company sets the rules for access and retention itself.
For staff, little changes:
- Outlook stays. The Network Edition includes a connector that syncs email, calendars and contacts into Outlook.
- Webmail and smartphone. The Zimbra web client runs in the browser, the usual apps on iPhone and Android.
- Shared calendars and folders work as with Exchange, including delegation and resources such as meeting rooms.
- Archiving under Swiss retention rules can be added with MailStore, also self-operated.
Zimbra does not replace everything Microsoft 365 offers. Teams, SharePoint and co-editing Office documents in the browser are not included. Many SMEs therefore combine Zimbra for email and calendars with Office on the desktop and file storage in their own network.
Who benefits from switching
Self-operated Zimbra suits companies bound by professional secrecy or handling sensitive data in particular: medical and therapy practices, law firms, fiduciaries, counselling services and foundations. Companies that want to reduce their dependence on US providers also find a proven solution here. More background in our article on digital sovereignty.
Those who rely heavily on Teams and SharePoint usually do better staying with Microsoft 365 and updating their documentation for the new clause.
Switching often pays off financially too. Beyond a certain size, server and support costs barely grow, while with Microsoft 365 every additional person means another subscription. From a certain number of users, Zimbra is therefore often cheaper to run.
Running your own system also means responsibility: updates, backups and monitoring need to be handled. We take care of this for our clients.
How to proceed
- Check whether you are affected. Do you process health data, client data or other sensitive information in Microsoft 365?
- Update your documentation. Add the possible disclosure to your privacy notice and records of processing.
- Compare the options. Set costs, features and effort of Microsoft 365 and Zimbra side by side.
- Plan the migration. Mailboxes, calendars and shares are moved, and the DNS records for SPF, DKIM and DMARC are set up again.
We run Zimbra in Switzerland
A BOT is a Zimbra partner and runs Zimbra environments for SMEs on servers in Switzerland, including spam filtering, archiving and backup. We review with you whether a switch makes sense and migrate mailboxes outside business hours. More under email security. If you still run your own Exchange server, see the options in our article on the end of Exchange support.
Frequently asked questions
Is Microsoft now reading our email?
According to most specialists today, no. The clause allows a report when Microsoft is already aware of such material. It does not contain permission for systematic searching. Metadata such as usernames, email addresses and security logs, however, already goes partly to the US.
Do we have to leave Microsoft 365?
Not necessarily. Check whether you process sensitive data and update your documentation. A switch is worthwhile mainly if you want more control over your data anyway.
Can the Zimbra vendor access our data?
No. Zimbra runs on your own servers or with your hosting provider. The vendor supplies the software and updates but has no access to the mailboxes.
How does Zimbra compare on cost?
From a certain number of users, Zimbra is often cheaper to run than Microsoft 365. With Zimbra there are per-mailbox licences, a server and support. Server and support are spread across all users, whereas with Microsoft 365 you pay a monthly subscription for each person. A cost comparison shows where the threshold lies for your company.
