Hessian Data Protection Authority Approves Microsoft 365 Use in Public Administration with Conditions

Hessian State Data Protection Officer Alexander Roßnagel has granted approval for the use of Microsoft 365 software within Hessian public authorities and companies, provided strict data protection compliance is observed. This decision is based on a comprehensive 120-page report by the Hessian data protection authority, which offers a legal framework for the software's deployment in the public sector.

Microsoft 365 applications such as Word, Outlook, and PowerPoint can now be used in Hessen, but must be configured correctly to meet data privacy regulations. Concerns had previously arisen due to Microsoft 365 being a cloud service, with the German Data Protection Conference raising seven critical points in November 2022 about how personal data is processed by the US-based company.

Roßnagel emphasized the need for users to properly configure Microsoft’s settings to ensure compliance, and the detailed report provides recommendations to assist authorities in doing so. This move provides important legal certainty for the use of Microsoft 365 in Hessian public administration while addressing longstanding privacy concerns.