Microsoft 365 in Swiss public administrations
Whitepaper in French. 17 pages, March 2026.
For cantons, communes, and public hospitals using Microsoft 365. Since Privatim's resolution of 18 November 2025, sensitive data may go to an international cloud only if the public body encrypts it and the provider cannot reach the keys. The paper explains which Microsoft options fail that test and two set-ups that pass. Download it to bring a clear, sourced position to your data-protection officer or cantonal authority.
Get the download
Tell us where to send the link. A business email is required.
Since 18 November 2025, Privatim's resolution has changed the question for every canton, commune, and public hospital using Microsoft 365. A Swiss data centre is not enough. Bring Your Own Key is not enough. Most Microsoft key options fail the test.
Two set-ups pass. The paper explains both, with the sources behind each conclusion, and a table that compares them on cost, operational risk, and fit. It also describes how DuoKey deploys the external key.
Download it and bring a clear, sourced position to your data-protection officer or cantonal authority.
FAQ
Is there a German version?
Yes, dated April 2026, with the same content. It has its own download page.
What did Privatim decide?
Sensitive personal data, and data under a legal duty of confidentiality, may sit with an international cloud provider only if the public body encrypts it and the provider cannot access the keys.
Is a Swiss data centre or Bring Your Own Key enough?
No. A Swiss location does not stop a US CLOUD Act order. With Bring Your Own Key the key is in Azure Key Vault, which Microsoft runs. Microsoft Managed Keys and the EU Data Boundary fail for the same reason.
What are the two options that pass?
Keep sensitive files on local systems and use Microsoft 365 for everything else, as the canton of Bern does. Or use Double Key Encryption, named in Zurich's draft law, with the second key held outside Microsoft.
Is this legal advice?
No. The paper says so, and recommends checking with your cantonal data-protection authority.