The discussion about data protection, cloud sovereignty and how to deal with US providers such as Microsoft, Google and Amazon is taking on a new dimension in Switzerland. A joint resolution by the cantonal data protection officers and the Federal Data Protection and Information Commissioner (FDPIC) stipulates that Swiss authorities may no longer use cloud services from American providers in future - including Microsoft Office 365 online and AI services based on it.

This decision is a drastic step that will have far-reaching effects on administration, public institutions and, in the medium term, probably also private companies.

Background: The end of the Privacy Shield and Switzerland's position

In 2020, the European Court of Justice annulled the Privacy Shield agreement between the EU and the USA, which led to considerable uncertainty regarding the transfer of personal data to US providers.

The Swiss FDPIC came to a similar conclusion - independently of the EU. In his Statement from September 8, 2020 he noted:

The Privacy Shield regime does not provide an adequate level of data protection for data transfers from Switzerland to the USA in accordance with the Swiss Data Protection Act (DPA). As a result, the FDPIC removed the reference to ''adequate data protection under certain conditions'' for the USA from his list of countries.

This made it clear that any use of a US cloud service by Swiss authorities is legally sensitive - and now the consequences follow.

The new resolution: No more US cloud services in Swiss authorities

The recently adopted resolution by the data protection authorities represents a clear turning point: Authorities in Switzerland may no longer use US cloud providers.

This includes in particular

• Microsoft Office 365 Online
• Cloud-based services from Microsoft, Google, Amazon (AWS), Meta etc.
• building on this AI modules such as Copilot, chat-based services or analysis platforms

The data protection authorities argue that:

1. US laws (e.g. Cloud Act, FISA 702) grant US authorities far-reaching access options,
2. the standard of protection in the USA does not correspond to the Swiss DPA,
3. Swiss authorities cannot ensure compliance with the FADP as long as data is stored with a US cloud provider.

This decision now presents administrations with enormous technical and organizational challenges - especially where Office 365 or other cloud-based systems are deeply integrated into the processes.

And now? Effects and expected developments

The resolution currently concerns authorities - but it is unlikely to stop there.

Experts expect that private companies that:

• operate critical infrastructures,
• fulfill safety-relevant tasks or
• process particularly sensitive data,

could be affected by similar restrictions in a next step.

This would force a large part of the Swiss economy to examine alternatives to American cloud services - in particular to identify providers that can guarantee data storage at 100 % in Switzerland.

What does this mean for management bodies, boards of directors and supervisory boards?

Against the backdrop of these regulatory developments, the question of a secure, legally compliant board portal even more important.

Back in July 2020, Loomion CEO Christopher Knabe analyzed which criteria are relevant when selecting a board portal in a specialist article in the BOARD magazine published by Bundesanzeiger Verlag - especially after the end of the Privacy Shield. Many of these points are becoming even more important due to current developments in Switzerland:

• Swiss or European data storage
• No processing by US subcontractors
• End-to-end security without cloud risks
• Access restrictions and zero-knowledge architectures

Solutions such as Loomion, which can be operated in full compliance with the GDPR and are not based on US cloud infrastructure, are therefore increasingly becoming a strategic choice - and Loomion is currently the only board management software provider on the market that meets all these criteria.

Conclusion: A turning point for Switzerland's digital sovereignty

The resolution is more than just a data protection notice - it is a paradigm shift. It forces public authorities and, in the future, presumably also private companies to look at sovereign, European or Swiss alternatives. US cloud services, which have been the standard for years, will no longer be viable in key areas.

For companies that rely on data protection-compliant, locally operated solutions at an early stage, this not only creates legal certainty - but also an important competitive advantage.

Do you have any questions about this article or are you looking for a secure board management solution that keeps your data in Switzerland? Talk to Christopher Knabe, a proven expert in the field.