Nextcloud as an Alternative to Microsoft Cloud Services

Microsoft's cloud services are criticized from a data protection perspective; Nextcloud is a strong alternative. We very often hear from companies with sensitive datathat they are concerned about the development especially about GDPR compliancethe transfer of data to the USAall the way to access by US authorities. German data protection authoritieshave also repeatedly voiced concerns, backed by important court decisionssuch as Schrems II (explanation follows). We explain here what has made Microsoft problematic in recent years for companies with sensitive data and why Nextcloud is an alternative to Microsoft cloud services.

Lack of data protection with Microsoft cloud services:

• Data transfer to the USA and Schrems II: A central problem is the transfer of personal data to third countries, especially to the USA. The European Court of Justice, in the Schrems II ruling (2020), declared the EU-US Privacy Shield invalid and made clear that data transfers to the USA are only permissible if an equivalent level of protection as in the EU is ensured. In practice, this is difficult to implement: The Data Protection Conference found that using Microsoft 365 is “completely impossible without transferring personal data [to third countries]”. Even if Microsoft operates data centers in Europe, certain data (for example support and telemetry data) flow to the USA or can be accessed from there.
• Access by US authorities (CLOUD Act):Regardless of contractual protective clauses, the risk remains that US authorities access EU data. The US CLOUD Act requires US companies such as Microsoft, by order, to disclose data even if it is located on servers in Europe. In other words: European users’ data on EU servers is not safe from access by US authorities as long as a US provider has control. This very concern led, for example, in Hesse in 2019 to the state data protection officer prohibiting the use of Office 365 in schools. He argued that the decisive question was whether a school could store children’s personal data “in a European cloud that is, for example, possible access by US authoritiesis exposed to” — which he denied.

Would we therefore generally advise against Microsoft? No, because it always depends on the company and the objectives. As long as no personal data are processed, and no special protection classes are affected (e.g. health data, employee profiles, etc.), the relevance under data protection law is significantly lower. Microsoft services can here, with suitable documentation and additional agreements (Standard Contractual Clauses, EU data boundary), be used in a legally defensible way!

We recommend Nextcloud as a privacy-friendly alternative

In comparison, Nextcloud— an open-source platform for file hosting and collaboration — offers several key advantages in terms of data protection and data sovereignty. Nextcloud is often referred to as a European alternative to the major US cloud providers. Especially for companies and public authorities that value GDPR compliance, Nextcloud addresses many of the problem areas mentioned above with Microsoft’s services.

At e-pixler, we rely on a self-hosted Nextcloud solution that we operate individually, maintain, and adapt to our customers’ needs. With Nextcloud, not only can files be managed securely, but contacts and calendars can also be centrally synchronized and organized. An email client is also integrated directly — everything bundled in a single, clear desktop interface. Especially for companies with sensitive data, Nextcloud offers the advantage of working in full compliance with the GDPR, since all data remains in the company’s own infrastructure. We enable the installation of additional plugins, offer through so-calledGroup Foldersthe possibility to share higher-level folder and data areas in a structured way, and thus create centralShared Data Spacesfor teams. Our goal is to provide a flexible, secure, and privacy-friendly cloud solution — without dependence on US providers.

What makes Nextcloud so interesting for companies with sensitive data:

• Full data sovereignty and GDPR compliance: With Nextcloud, all data remains under your company’s control. There is no transfer to third countries as long as the server location is deliberately chosen within the EU. This makes compliance with the GDPR much easier, as there is, for example, no risk from the CLOUD Act. Numerous Nextcloud providers advertise that they provide a GDPR-compliant cloud based on Nextcloud. From the user’s perspective, Nextcloud offers high data security and privacy: The solution supports end-to-end encryption, multi-level access controls, and comprehensive audit logs. We use Nextcloud for ourselves and for many customers with sensitive data. So far, it is the best and most pleasant solution.
• Integration into existing IT infrastructures: Nextcloud can be seamlessly integrated into existing IT environments. It supports common standards and directory services — for example, connection to Active Directory/LDAP for user management — so that user accounts and permissions can be managed centrally. The integration of existing storage is also possible (e.g. network shares, S3 storage), allowing Nextcloud to serve as a unified interface can serve as distributed data storage. Through a variety of plugins and apps we can expand the functionality and adapt it to business needs. Nextcloud can replicate many of the familiar functions of Microsoft 365, but under your control.
• GDPR compliance: Nextcloud was designed from the ground up with data protection in mind. Through hosting in your own legal jurisdiction and full administrative rights, GDPR requirements can be implemented more effectively. For example, data remains on servers in your own country, which meets the requirements for data minimization, purpose limitation, and storage limitation. Functions such as data export and deletion concepts can be implemented more easily with Nextcloud, since all data is centrally under the organization's control.

Nextcloud enables comprehensive data sovereignty and control

For German companies with sensitive data, Nextcloud is therefore an attractive alternative to leverage the productivity benefits of a cloud without compromising their own data protection obligations. The combination of openness, self-hosting capability, and strict EU legal compliance can ensure that all personal data are protected and processed in compliance with the GDPR—an aspect that is becoming increasingly important in times of Schrems II and the CLOUD Act. Convenience also does not have to be sacrificed with Nextcloud, as many familiar functions from Microsoft are also available.

Are you looking for a GDPR-compliant solution for your company?
Then let's talk, we will be happy to advise you on integrating Nextcloud!

Click here for our IT systems house services.