Microsoft Teams, Schrems II and the missing transfer impact assessment: what the Belgian Data Protection Authority's decision 278/2026 tells us
On 9 October 2026, the Litigation Chamber of the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) issued a reprimand to two Belgian public bodies over their use of Microsoft Teams for recruitment interviews. The decision looks back at events from 2020–2021, but it’s reasoning still matters to any organization that relies on US cloud providers.
The facts
In November 2020 and April 2021, a candidate in a public-sector selection procedure took oral exams via Teams on a computer provided by the recruiting body. He complained that external Teams meetings involved unlawful transfers of personal data to the United States. The two bodies had chosen Teams together, so the Data Protection Authority treated them as joint controllers, with Microsoft acting as their processor.
What the Data Protection Authority decided
- It was personal data, even though nothing was recorded. The defendants argued that the meeting wasn't recorded, that the candidate joined as an anonymous participant and that the IP address belonged to a company laptop. The Data Protection Authority rejected each point. Audio and video identify participants directly, and recording “does not alter their personal character”. Diagnostic data (user ID, IP address, event name) was also personal, because the employer could link it to the candidate's name. Citing two judgments of the Court of Justice of the European Union, IAB Europe and EDPS v SRB, the Authority held that data which is personal for the controllers is also personal for their processor.
- There was a transfer to the US. By choosing Microsoft, the defendants made transfers possible. Diagnostic data went to Microsoft Corporation by default, and EU storage of customer data was only guaranteed contractually from November 2022.
- Standard Contractual Clauses without a transfer impact assessment were not enough. Between the Schrems II judgment (16 July 2020) and the EU–US Data Privacy Framework (10 July 2023), the transfers relied on Standard Contractual Clauses. However, no transfer impact assessment had been carried out. Calling the risk “insignificant” because the data was “ephemeral”, or relying on Microsoft's own commitments, did not count as an assessment. The Authority added that Microsoft's Data Processing Agreement itself provides a procedure for responding to US government access requests.
- Article 49 could not be used as a fallback. The “COVID continuity” derogation under Article 49 of the General Data Protection Regulation failed because the safeguards of Article 46, such as Standard Contractual Clauses, were available. Derogations are exceptions, not a safety net.
The result was a reprimand under Articles 44 and 46(2)(c) GDPR for the 2020–2023 period. A separate finding on the absence of a data protection impact assessment was dismissed for lack of evidence. Unusually, the Authority chose to name Microsoft and Teams in the published decision because of how widely the tool is used.
Pierstone's view: key questions
1. Can we rely on Microsoft’s safeguards instead of doing our own assessment?
No. Accountability can’t be outsourced. A vendor’s assurances do not replace your own documented transfer impact assessment. “Microsoft has strong safeguards” is a conclusion you reach after an analysis. It cannot stand in for the analysis.
2. Is an unrecorded Teams meeting still personal data?
Yes. Live audio and video, telemetry and IP addresses can qualify as personal data, especially when the organization can link them to an identifiable person. Default diagnostic data flows to the US are often overlooked and deserve specific attention in any review of cloud software.
3. Do we still need a transfer impact assessment for US cloud providers?
Not for transfers to US companies certified under the EU–US Data Privacy Framework, as the Authority confirms. The Framework provides relief, not immunity, though. A challenge to it is on appeal before the Court of Justice of the EU. If the Framework falls, organizations must immediately switch to another mechanism, such as the 2021 Standard Contractual Clauses, and document their risk analysis. The prudent approach is to keep a transfer impact assessment “on the shelf” for key US vendors now, rather than build one under pressure later.
4. Can the Data Protection Authority still act on breaches from years ago?
Yes. Enforcement is slow, but it does come. Five and a half years passed between the complaint and the decision, and the Authority even had to set aside its own expert report on procedural grounds. Past non-compliance can still lead to a published decision long after the facts.