With the recent announcement of the " Sovereign Cloud Initiative," Microsoft is responding to a development that has long since become a reality for tax advisors: the need to maintain control over data, systems, and keys in European hands. Not only the GDPR, but also professional regulations such as Section 203 of the German Criminal Code (StGB) make it clear that the use of cloud services cannot take place without careful review—and, above all, without impacting the actual control of data.
I have already comprehensively addressed these topics in my book "Data Protection-Compliant Use of Microsoft Cloud Services in Modern Tax Firms." What Microsoft now presents is a concrete answer to precisely those questions that have occupied us as holders of professional secrecy for years.
Microsoft creates clarity: Infrastructure for Europe – in Europe
In the video announcing the announcement, Satya Nadella emphasizes that Microsoft is building "digital infrastructure in Europe, for Europe" – with the goal of giving European organizations full control over their data, their identities, and their encryption keys. This sovereignty is not theoretical, but rather concretely implemented in technical and organizational terms.
Data remains entirely in European data centers – with access restricted to local employees. Encryption is optionally performed using proprietary, externally managed keys. Even Microsoft then no longer has access. Even more importantly, existing Microsoft 365 environments do not need to be migrated. The new sovereignty features can be activated in addition – without system disruption or loss of functionality.
What Sovereign Cloud actually means
This means for tax advisors:
- No dependency on US legal norms (e.g. CLOUD Act )
- GDPR-compliant data storage without compromises
- Maintaining confidentiality with full functionality of modern cloud solutions
- Site control and transparency regarding updates, access and audits
In short: sovereignty over data, processes and systems – a central element of modern law firm strategies.
Legal certainty for tax firms
For tax advisors, this represents a true paradigm shift. It's not about new tools, but about self-determination. We decide where our data is located, who accesses it, how it is encrypted—and within which legal frameworks all this takes place. Concerns about the CLOUD Act or unclear US access options can thus be resolved in a real and verifiable way.
Sovereign cloud models—whether public cloud with EU-only access, hybrid scenarios, or fully local Microsoft 365 installations—open up further possibilities that were previously unavailable. While it was already possible to use M365 and Azure in compliance with GDPR and Section 203 of the German Criminal Code (StGB) with the correct tenant configuration, the need for a DPIA should now diminish, and fears of having to compromise on professional responsibility or compliance should diminish.
What you can do now
- Inventory – Which cloud components are you already using? Where are the risks?
- Develop a future scenario – Which sovereignty option (e.g. Public Sovereign, Azure Local, EKM) is suitable for your law firm?
- Client-independent strategy – It’s not about marketing to clients – it’s about your independence as a consultant.
- Create internal roadmap – technical implementation, IT service provider briefing, key management, compliance check
More about this in my book
In my book, you'll find not only the legal foundations and arguments, but also concrete recommendations for implementation. With the Microsoft initiative now presented, many of these issues will become simpler, more secure—and more European—but compliance, key management, and technical consulting won't become obsolete.
Anyone who is serious about digitalization in their law firm should view this new sovereignty strategy not as an optional extra, but as a key pillar of their own digital identity.
