[{"data":1,"prerenderedAt":443},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/eu-data-act-cloud-switching-microsoft-365-exit-january-2027-posts_en":51,"/en/blog/eu-data-act-cloud-switching-microsoft-365-exit-january-2027-surround-posts_en":433},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":369,"description":370,"extension":371,"faq":372,"howto":390,"image":425,"meta":427,"navigation":428,"path":429,"seo":430,"stem":431,"__hash__":432},"posts_en/en/3.blog/22.eu-data-act-cloud-switching-microsoft-365-exit-january-2027.md","Six Months to 12 January 2027 – How the EU Data Act Rewrites the Microsoft 365 Exit Math for German SMEs and Public-Sector Bodies",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"Regulation & Contract Law",{"type":63,"value":64,"toc":359},"minimark",[65,69,86,93,100,105,120,123,149,156,160,166,169,193,206,210,213,233,244,248,251,276,283,287,290,335,339],[66,67,53],"h1",{"id":68},"six-months-to-12-january-2027-how-the-eu-data-act-rewrites-the-microsoft-365-exit-math-for-german-smes-and-public-sector-bodies",[70,71,72,73,77,78,81,82,85],"p",{},"On ",[74,75,76],"strong",{},"12 January 2027"," a chapter of cloud marketing that has effectively prevented provider switching for years comes to a close in the EU. From that date, ",[74,79,80],{},"Article 25 of Regulation (EU) 2023/2854 – the EU Data Act –"," bans all ",[74,83,84],{},"egress and switching fees"," for data-processing services. This applies to Azure, AWS, Google Cloud, Microsoft 365, Salesforce, Oracle Cloud – to every provider serving EU customers.",[70,87,88,89,92],{},"For ",[74,90,91],{},"German SME IT leaders, school authorities and public bodies"," who are already considering leaving Microsoft 365 on data-protection grounds, this date changes the math. Until now, data export, interim costs for parallel operation and additional fees for compliance exports were hard migration costs. From the cut-off, these line items disappear entirely. Anyone planning with six months' lead time has a clean switching moment on 12 January 2027.",[70,94,95,96,99],{},"This post explains the Data Act, describes the concrete clauses for SaaS switching, weighs the economic effect against the ",[74,97,98],{},"Microsoft price increase of 1 July 2026"," and delivers a six-month checklist in the HowTo section to use 12 January 2027 operationally.",[101,102,104],"h2",{"id":103},"what-the-eu-data-act-is-and-what-it-does-to-cloud-contracts","What the EU Data Act is – and what it does to cloud contracts",[70,106,107,108,111,112,115,116,119],{},"The EU Data Act was enacted as ",[74,109,110],{},"Regulation (EU) 2023/2854"," and became fully applicable on ",[74,113,114],{},"12 September 2025",". Chapter VI of the regulation – Articles 23 to 31 – specifically governs switching between providers of data-processing services. The legislator's reasoning is stated explicitly in Recital 79: ",[74,117,118],{},"economic and technical lock-in effects"," should be dismantled because they hamper European competitiveness and undermine digital sovereignty.",[70,121,122],{},"The three central obligations for cloud providers:",[124,125,126,133,139],"ul",{},[127,128,129,132],"li",{},[74,130,131],{},"Article 23 – Right to switch."," Customers have an inalienable right to switch providers, take their data and exportable digital assets with them, and reach functional equivalence at the new provider.",[127,134,135,138],{},[74,136,137],{},"Article 24 – Notice periods and contract clauses."," The maximum notice period is two months. Clauses that violate this are partly void – including in already-running contracts.",[127,140,141,144,145,148],{},[74,142,143],{},"Article 25 – Switching and egress fees."," Until 12 January 2027 only at the level of direct, transparently documented cost. From 12 January 2027 ",[74,146,147],{},"entirely prohibited",".",[70,150,151,152,155],{},"A common misunderstanding at the outset: the Data Act is not limited to infrastructure (IaaS). Article 2(8) defines data-processing services broadly – ",[74,153,154],{},"Software-as-a-Service is expressly included",". Microsoft 365, Google Workspace, Salesforce, HubSpot: all are subject to the switching regime.",[101,157,159],{"id":158},"what-microsoft-already-promised-in-2024-and-what-the-data-act-makes-of-it","What Microsoft already promised in 2024 – and what the Data Act makes of it",[70,161,72,162,165],{},[74,163,164],{},"13 March 2024"," Microsoft announced that customers leaving the Azure platform entirely would no longer pay egress fees. AWS and Google Cloud followed in the same week. The trigger was foreseeable: the Data Act was already in the Official Journal, and competition authorities in Berlin, Paris and Rome had signalled investigations for abuse of dominance.",[70,167,168],{},"In practice, the concessions remained narrow:",[124,170,171,181,187],{},[127,172,173,176,177,180],{},[74,174,175],{},"Azure"," waives the egress fee only when ",[74,178,179],{},"all subscriptions are cancelled simultaneously",". Partial migrations remain charged.",[127,182,183,186],{},[74,184,185],{},"AWS"," explicitly excludes certain services – CloudFront, Direct Connect and cross-region transfers between AWS accounts.",[127,188,189,192],{},[74,190,191],{},"Google Cloud"," refunds the fee retroactively against proof – a bureaucratic process many SMEs never complete.",[70,194,195,196,199,200,205],{},"The Data Act turns these selective concessions into a ",[74,197,198],{},"hard, unconditional legal obligation"," from 12 January 2027. Also for partial migrations, also for individual mailboxes, also without bureaucratic refund applications, also for SaaS-specific data types. The compliance frame will sit at the ",[201,202,204],"a",{"href":203},"/en/blog/microsoft-copilot-flex-routing","Bundeskartellamt",", which has already classified Microsoft under § 19a GWB as an undertaking of paramount cross-market significance since 2023.",[101,207,209],{"id":208},"why-12-january-2027-is-the-economically-best-switching-date","Why 12 January 2027 is the economically best switching date",[70,211,212],{},"Anyone working through the migration cost between a switch in September 2026 and a switch in January 2027 today runs into three items that change on the cut-off:",[124,214,215,221,227],{},[127,216,217,220],{},[74,218,219],{},"Egress fees."," A SharePoint volume of 8 TB currently costs around 380 euros to export from Azure. From 12 January 2027 – zero.",[127,222,223,226],{},[74,224,225],{},"Compliance exports."," Teams chat history export via the eDiscovery API is currently a paid extra – around 0.20 euros per mailbox per export. At 2,000 users that is 400 euros. From the cut-off – zero.",[127,228,229,232],{},[74,230,231],{},"Contractual exit clauses."," Enterprise Agreement contracts with remaining term include penalty clauses for early termination. Those clauses collide with Article 24 Data Act from 12 January 2027 and become partly void.",[70,234,235,236,238,239,243],{},"Combined with the ",[74,237,98],{}," – public sector up to plus 13 percent, business tariffs up to plus 16 percent – switching in January 2027 costs a typical body with 1,000 users roughly 18,000 to 26,000 euros less than switching in September 2026. The context for that pricing calculation is set out in the post ",[201,240,242],{"href":241},"/en/blog/hanover-license-fiasco-microsoft-365-schools-2026","Three months after the Hanover halt",", which quantifies the price-increase effects in the education sector.",[101,245,247],{"id":246},"what-the-data-act-does-not-regulate-the-three-remaining-gaps","What the Data Act does not regulate – the three remaining gaps",[70,249,250],{},"The Data Act is a contract law, not a data-protection law and not a security law. Three areas are expressly untouched:",[124,252,253,264,270],{},[127,254,255,258,259,263],{},[74,256,257],{},"Access under CLOUD Act, FISA 702 and Executive Order 12333."," The US authority access exposure to data held with US providers is not changed by the Data Act. Anyone who would have exited under Article 44 GDPR still has to exit. The ",[201,260,262],{"href":261},"/en/blog/cloud-act-2026","CLOUD Act post"," covers the 2026 access position including the most recent FISA Court interpretation.",[127,265,266,269],{},[74,267,268],{},"Functional equivalence for SaaS."," Article 30 requires functional equivalence only for IaaS. For SaaS the weaker standard \"exportable data in a common format\" applies. That was the compromise between European and US providers during negotiations – and it is a real loss in day-to-day switching.",[127,271,272,275],{},[74,273,274],{},"Compliance metadata."," Retention policies, DLP rules, sensitivity labels, eDiscovery cases: none of these compliance artefacts fall under the export obligation. Anyone who wants them back at the target has to rebuild them.",[70,277,278,279,282],{},"The three gaps are the subject of a Commission evaluation, whose interim report of ",[74,280,281],{},"17 June 2026"," proposes a fix for the second Data Act amendment in 2028. Until then they must be planned around.",[101,284,286],{"id":285},"what-it-leaders-should-decide-now","What IT leaders should decide now",[70,288,289],{},"The Data Act is not a demand to switch – it is an enabler. For IT leaders who are already considering a switch on data-protection, economic or strategic grounds, it moves the favourable migration window opening to 12 January 2027. The three central decisions by end of September 2026:",[124,291,292,303,322],{},[127,293,294,297,298,302],{},[74,295,296],{},"Finish contract inventory."," By end of August 2026 build the internal contract matrix. Without this basis no defensible switching plan is possible. The post on ",[201,299,301],{"href":300},"/en/blog/nis2-gdpr-microsoft-paradox","NIS2 and the Microsoft paradox"," shows why the contract inventory is required for NIS2 compliance in any case.",[127,304,305,308,309,313,314,318,319,148],{},[74,306,307],{},"Fix target architecture."," By mid September 2026 name the European target architecture. For public authorities ",[201,310,312],{"href":311},"/en/blog/opendesk-partner-program-2026","openDesk"," is the obvious candidate, for SMEs a combination of ",[201,315,317],{"href":316},"/en/blog/nextcloud-for-smes","Nextcloud, Element and Collabora",". The full alternatives matrix is under ",[201,320,321],{"href":321},"/en/alternativen",[127,323,324,327,328,331,332,148],{},[74,325,326],{},"Set the calendar."," By end of September 2026 lay out the concrete six-month calendar, with training blocks, test phase, parallel phase and cut-over on 12 January 2027. For an initial assessment of your own calendar, the entry point is ",[201,329,330],{"href":330},"/en/contact",". The operational line items for managed operation of a European environment are under ",[201,333,334],{"href":334},"/en/pricing",[101,336,338],{"id":337},"conclusion","Conclusion",[70,340,341,342,344,345,348,349,348,352,355,356,358],{},"The EU Data Act turns the hyperscalers' voluntary concession into an unconditional legal obligation on ",[74,343,76],{},". For German SMEs, school authorities and public bodies looking to exit Microsoft 365, it opens the economically most favourable switching window since the dawn of the cloud era. The combination of ",[74,346,347],{},"removed egress fees",", ",[74,350,351],{},"shortened notice periods",[74,353,354],{},"partly void exit clauses"," and the ",[74,357,98],{}," shifts the switching break-even several months earlier. Six months are a realistic preparation time. The ten steps in the HowTo section are the operational roadmap for it.",{"title":360,"searchDepth":361,"depth":361,"links":362},"",2,[363,364,365,366,367,368],{"id":103,"depth":361,"text":104},{"id":158,"depth":361,"text":159},{"id":208,"depth":361,"text":209},{"id":246,"depth":361,"text":247},{"id":285,"depth":361,"text":286},{"id":337,"depth":361,"text":338},"2026-07-28T00:00:00.000Z","On 12 January 2027 the EU Data Act bans egress and switching fees outright. What that means for Microsoft 365 contracts and how IT leaders should plan now.","md",[373,376,379,382,387],{"q":374,"a":375},"What exactly changes on 12 January 2027?","Article 25 of Regulation (EU) 2023/2854 – the EU Data Act – bans all switching charges and data egress fees for providers of data-processing services in the EU as of 12 January 2027. It applies to Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service alike. In the transition phase since 12 September 2025, fees are only allowed at the level of direct, transparently documented costs of the switching operation – no longer as a routine pricing lever. From the cut-off date, even these cost-recovery charges must disappear.",{"q":377,"a":378},"Does the rule apply to Microsoft 365 at all – or only to Azure?","Both. The Data Act defines data-processing services in Article 2(8) very broadly. Microsoft 365 is captured as a SaaS offering. The switching right in Article 23 therefore covers Exchange mailboxes, OneDrive files, SharePoint libraries, Teams chat history and Intune configurations. From 12 January 2027 Microsoft must guarantee technical and contractual switchability without fees – including for SaaS-specific data types such as mailbox exports or OneNote containers.",{"q":380,"a":381},"Didn't Microsoft already abolish egress fees back in 2024?","Only partially. Microsoft, AWS and Google Cloud announced in March 2024, under regulatory pressure, that they would waive egress fees when customers left the platform entirely. In practice the waiver is conditional. At Azure it applies only when all subscriptions are cancelled at the same time. Services like CloudFront (AWS) or ExpressRoute (Azure) are partly excluded. The Data Act turns this discretionary concession into a hard legal obligation from 12 January 2027 – with no conditions, covering partial migrations, hybrid scenarios and individual mailboxes.",{"q":383,"a":384},"What about functional portability? Can I really take my Exchange mailboxes to a European provider?",{"Article 30 of the Data Act only requires \"functional equivalence\" for IaaS":385},{" For SaaS – that is, Microsoft 365 – the weaker standard applies":386},"export of exportable data in a structured, commonly used and machine-readable format",{"q":388,"a":389},"Does the Data Act change anything about the CLOUD Act problem?","No. The Data Act governs the contractual side – switchability and portability. The US-authority access issue under CLOUD Act, FISA 702 and Executive Order 12333 is untouched. If you are exiting Microsoft 365 today because of the US access exposure, you continue to exit on data-protection grounds (Article 44 et seq. GDPR). If you now switch additionally for economic reasons, you are using two parallel legal frameworks – but the underlying reason to leave stays the same.",{"name":391,"description":392,"totalTime":393,"steps":394},"Prepare the switching moment cleanly in six months","A concrete checklist for IT leaders to make 12 January 2027 a defensible contractual switching date and use it operationally.","P180D",[395,398,401,404,407,410,413,416,419,422],{"name":396,"text":397},"Document the current contract state","In month one map every contract with Microsoft, the reseller and any intermediaries into a contract matrix. Columns – contract type (EA, CSP, MPSA), term, ordinary notice period, extraordinary termination grounds, data processing agreement with date, sub-processor list. Without this basis no defensible switching plan can be built.",{"name":399,"text":400},"Inventory data classes","In month two inventory every data category across the Microsoft 365 tenant – Exchange mailboxes, OneDrive personal folders, SharePoint libraries, Teams chat history, calendars, OneNote notebooks, Intune device profiles, Defender configurations. For each class record – volume, legal retention period, criticality, exportable format under Article 25 Data Act.",{"name":402,"text":403},"Fix the target architecture","In month three decide the target architecture. Realistic 2026 alternatives – Nextcloud plus Element plus Collabora for collaboration, Open-Xchange plus Nextcloud plus Jitsi for communication, openDesk for the public sector. The categorised vendor list is under /en/alternativen. The target architecture is the basis of the comparative cost model.",{"name":405,"text":406},"Model the costs","In month four run two cost models in parallel. Model A – stay on Microsoft 365 with the price increases effective 1 July 2026, projected over 36 months. Model B – switch to a European stack with a one-off migration effort and recurring operating cost. For 500 to 2,000 users the break-even is typically 14 to 22 months.",{"name":408,"text":409},"Plan the migration window","In month five fix the migration window. Recommendation – migration start on 12 January 2027 with a six-month parallel phase through end of June 2027. During that phase critical mailboxes and files run on both platforms. After 30 June 2027 the Microsoft tenant is deactivated. This timeline exploits the fully abolished egress-fee regime under the Data Act.",{"name":411,"text":412},"Prepare contract termination","In month six prepare the contractual termination with the reseller or directly with Microsoft. Article 24 Data Act caps the maximum notice period at two months. Existing contracts with longer periods become partly void on that point from 12 January 2027 onwards. Submit termination in writing on 12 January 2027, effective 12 March 2027.",{"name":414,"text":415},"Execute the data export","From 12 January 2027 start the export process. Exchange mailboxes via the Migration Batch endpoint as PST or directly via IMAP to the target provider. OneDrive and SharePoint via the Microsoft Graph export as folder structure. Teams chat history via the compliance export interface as JSON. All exports run in parallel to production – Microsoft must provide them without extra charge.",{"name":417,"text":418},"Reconstruct compliance","In the first migration month rebuild the compliance metadata – retention policies, DLP rules, access roles, audit logs. Those artefacts are not part of the Data Act export claim and must be rebuilt in the target system. For public authorities under Article 30 GDPR and for regulated sectors under DORA or NIS2 this reconstruction is audit-relevant.",{"name":420,"text":421},"Stage user communication","Communicate to end users in three stages. Twelve weeks before the switch – announcement with schedule and training offer. Four weeks before – concrete click-through guides and support channels. On switch day – kickoff with on-site support in the first three days. Switch success depends 60 percent on user communication and 40 percent on technology.",{"name":423,"text":424},"Document the shutdown","After Microsoft tenant deactivation obtain written confirmation of complete data deletion – Article 28(3)(g) GDPR. Without this confirmation an open GDPR position remains in the record of processing activities. Keep the confirmation as an annex to the contract file for the retention period of the personnel data involved.",{"src":426},"https://images.unsplash.com/photo-1451187580459-43490279c0fa?w=1200&q=80",{},true,"/en/blog/eu-data-act-cloud-switching-microsoft-365-exit-january-2027",{"title":53,"description":370},"en/3.blog/22.eu-data-act-cloud-switching-microsoft-365-exit-january-2027","Ng_inGkKMa6k52-DvJ0fgknOWIzBhTbXihdW7h7dcfA",[434,438],{"title":435,"path":241,"stem":436,"description":437,"children":-1},"Three months after the Hanover freeze – What the 60,000-license fiasco reveals about Microsoft 365 in schools and how school authorities can prepare cleanly for the 2026/27 school year","en/3.blog/21.hanover-license-fiasco-microsoft-365-schools-2026","On 21 April 2026 Hanover froze 60,000 M365 licenses. Three months later, the case shows what school authorities must change before the 2026/27 school year.",{"title":439,"path":440,"stem":441,"description":442,"children":-1},"Hospitals caught between NIS-2, KHZG expiry and mandatory ePA – Why German clinics should exit Microsoft 365 now","/en/blog/hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","en/3.blog/23.hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","NIS-2 registered, ePA in regular operation, KHZG funding ending – for hospital IT, Microsoft 365 is no longer a viable target architecture. The sovereign path.",1788852143400]