Staying on Microsoft 365 vs moving off it: the CLOUD Act law firms and accountants need to weigh

The decision, and who is facing it

If you run a law firm or an accountancy practice in the Netherlands, Belgium, Germany or anywhere else in the EU, you are almost certainly running your daily work on Microsoft 365 or Google Workspace. Mail, calendar, client files, draft contracts, working papers. That is not a criticism. Both products are mature, reliable and familiar to every new hire you bring in.

But partners and privacy officers at these firms keep asking the same question, usually after a client or a works council raises it first: what actually happens to our client files under the CLOUD Act, and is staying on US software still the right call? This is a genuinely close decision for many firms, not an obvious one, and it deserves a fair answer rather than a scary one.

This article lays out the legal facts, is fair to both options, and ends with a framework you can use in a partner meeting without needing a law degree to follow it.

Option A: staying on Microsoft 365 or Google Workspace

Staying put is a legitimate, common choice, and for many practices it remains the right one for now. Here is the honest case for it, and the honest limits.

The strengths

Microsoft 365 and Google Workspace are good products. Your staff already know them. Integrations with practice management software, e-signature tools and billing systems are mature. Support channels exist, even if they are ticket based. Both companies invest heavily in security engineering, uptime and feature development that a smaller provider simply cannot match feature for feature.

Both providers also offer an EU data region option, and both let you sign a data processing agreement. For a firm that mainly serves domestic clients with no particular sensitivity around foreign government access, this is often enough, at least on paper.

The real limits

The limit is jurisdiction, not location. The CLOUD Act, enacted on 23 March 2018, requires a provider under US jurisdiction to disclose data in its "possession, custody, or control" when ordered to by valid US legal process, a warrant, subpoena or court order, "regardless of whether such communication, record, or other information is located within or outside of the United States" (18 U.S.C. 2713). Choosing the EU data region for Microsoft 365 or Google Workspace decides where your files sit on disk. It does not change which country's courts can order the company to hand them over. Microsoft Corporation and Google LLC are both US companies, wherever their servers are.

This matters specifically for legal and accounting work because the data in question is often privileged: case strategy, settlement positions, undisclosed tax structuring, M&A terms before signing. A foreign government access request does not need to be about your firm at all. It can be about a client, a counterparty, or a matter your firm is merely holding documents for.

There is also a legal basis question sitting underneath this, separate from the CLOUD Act itself. Under GDPR Chapter V, personal data may only leave the EEA on an adequacy decision or safeguards like standard contractual clauses, and Article 48 is explicit that a foreign court order does not by itself make a transfer lawful. The transfer mechanism currently in use, the EU-US Data Privacy Framework adopted by the European Commission on 10 July 2023, replaced two earlier frameworks that were both struck down by the Court of Justice of the EU: Safe Harbor in 2015 (Schrems I) and Privacy Shield in July 2020 (Schrems II), the latter specifically because US surveillance law under FISA Section 702 gave EU citizens no effective remedy. The current framework is itself under challenge: the EU General Court dismissed an action against it on 3 September 2025, the challenger appealed on 31 October 2025, and that appeal is pending before the Court of Justice at the time of writing, with no judgment yet given.

None of this means today's setup is unlawful. It means the legal basis has changed twice before and is being tested again. For firms handling privileged client material, that pattern is worth planning around rather than reacting to after the fact.

Option B: moving daily work to a European provider

Moving mail, files and calendars to a provider that is itself outside US jurisdiction is the other option on the table, and it also has real strengths and real limits worth stating plainly.

The strengths

If the provider has no American parent company and operates its own servers in the EU, the CLOUD Act has nothing to attach to. There is no US entity in the chain that a US court order can reach. That removes the jurisdiction question entirely rather than mitigating it. The GDPR Chapter V transfer question also disappears, because there is no transfer to a third country to assess in the first place. For a firm advising clients on exactly this kind of exposure, being able to say "our own working papers are not subject to it either" is a straightforward, defensible position.

The real limits

A smaller European provider will not match the sheer breadth of a hyperscaler's product catalogue. If your firm depends on deep integrations with a specific US-built add-in, or a large chat and collaboration suite with heavy third-party app ecosystems, check compatibility before you commit. Migration takes planning: mailboxes, calendars, shared drives and permissions all need to move without losing version history or breaking client-facing addresses. And because the market has fewer providers, due diligence on each one matters more; you want a clear answer to "who holds the keys" and "which law applies to you," not a glossy brochure.

The honest summary: Option B trades some ecosystem breadth and a migration project for a jurisdiction that matches where your clients and your obligations actually sit.

Microsoft 365 and Google Workspace vs a European provider: the direct comparison

A decision framework for law firms and accountants

There is no single right answer here for every practice. Use these questions to work out where your firm sits.

• If your client files rarely include US persons, US litigation exposure or cross-border tax structuring, and your partners are comfortable with the current Data Privacy Framework pending its appeal, staying on Microsoft 365 or Google Workspace with an EU data region and a signed processing agreement is a reasonable, defensible position for now. Revisit it when the pending Court of Justice appeal is decided.
• If you regularly hold privileged material for clients who are themselves the kind of target a foreign government request would name, cross-border M&A, sanctions-adjacent sectors, high-net-worth individuals, politically exposed persons, the case for removing the jurisdiction question entirely gets stronger regardless of what the Data Privacy Framework's appeal eventually decides.
• If a client, insurer or regulator has already asked you in writing where your data sits and under which law, that is a sign the question has moved from theoretical to contractual, and it is worth having a written answer ready rather than an assurance.
• If you want a factual answer rather than a sales pitch from your current provider, ask your provider these questions in writing before deciding either way. A provider that answers clearly is doing its job; one that cannot should prompt a closer look.
• If you want the background on how the legal basis for EU-US data transfers has shifted twice already, read how today's compliant setup can change by next year before committing to either path for the long term.

One data point worth knowing, regardless of which side you lean toward: on 10 June 2025, Anton Carniaux, director of public and legal affairs at Microsoft France, testified under oath before a French Senate inquiry. Asked whether he could guarantee that French citizens' data entrusted to Microsoft through the public purchasing body UGAP would never be handed over on a US government order without explicit French authorisation, he answered "Non, je ne peux pas le garantir," while adding that it had never happened so far. Both halves of that answer are relevant to a firm weighing this decision; neither one by itself tells the whole story.

Also worth noting: a Swiss provider answers to Swiss law, not EU law or US law, since Switzerland is outside the EU and EEA but covered by its own adequacy decision. If a client or counterparty asks you to name the exact jurisdiction your working papers sit under, "Switzerland" and "the Netherlands under Dutch and EU law" are both concrete, checkable answers. "The cloud" is not.

Where Binadit fits

If your firm decides the jurisdiction question is worth resolving rather than monitoring, Binadit Workspace is built for exactly this: mail, calendar, drive, office documents, video meetings and appointment scheduling on your own domain, run by Binadit B.V. in Rotterdam, a wholly Dutch-owned company with every server in Netherlands data centres and no foreign parent in the chain. Because there is no US entity involved, the CLOUD Act does not reach it, and there is no third-country transfer to document.

If you want to see how it handles your specific mix of shared mailboxes, client folders and calendar bookings, or get a quote for your firm's size, ask for a demo and a quote, and you will hear back from the one person who actually knows the setup, not a ticket queue.