In particular, the Commission has failed to provide appropriate safeguards to ensure that personal data transferred outside the EU/EEA are afforded an essentially equivalent level of protection as guaranteed in the EU/EEA.

"Furthermore, in its contract with Microsoft, the Commission did not sufficiently specify what types of personal data are to be collected and for which explicit and specified purposes when using Microsoft 365."

The EC has been ordered to suspend all data flows through the use of Microsoft 365 to Microsoft and any of its tentacles that might reside outside the EU / EEA and not covered by an adequacy decision.