If you're running Microsoft 365 for your Swiss business, there's a question worth asking: where is your data actually stored? The answer matters for compliance with Switzerland's revised Federal Act on Data Protection (nDSG), for your CLOUD Act exposure, and — increasingly — for what you can honestly tell clients and auditors about how you protect their information.
The short answer is: unless you took specific steps when setting up your tenant, your data is probably not in Switzerland.
How Microsoft data residency works
When a Microsoft 365 tenant is created, Microsoft assigns it a home region based on the billing country. For Swiss businesses, this typically means your data is provisioned in Microsoft's European Union data centres — most commonly in the Netherlands or Ireland — not in Switzerland.
Microsoft does operate two Swiss data centres: one in Zurich (Switzerland North) and one in Geneva (Switzerland West). But these are available only if your tenant was specifically provisioned for Switzerland or migrated there. It's not automatic, and most businesses have never checked.
Why this matters: Switzerland's nDSG governs the transfer of personal data to third countries. If your M365 data is stored in EU data centres, you need adequate protection in place — typically Standard Contractual Clauses. If it's in Switzerland, the domestic legal framework already applies.
How to check where your data is right now
Checking takes about two minutes. You need Global Administrator access to your Microsoft 365 tenant.
Step 1: Open the Microsoft 365 Admin Centre
Navigate to admin.microsoft.com and sign in with your Global Admin account.
Step 2: Go to Settings → Org Settings → Organisation Profile
In the left-hand navigation, click Settings, then Org settings, then the Organisation profile tab.
Step 3: Click "Data location"
Scroll down to find "Data location" and click on it. You'll see a table showing each Microsoft 365 workload and the region where your data is stored.
Step 4: Read the results
Look at the "Country or region" column for Exchange Online, SharePoint Online, OneDrive, and Teams. If you see "European Union" or a specific EU country, your data is not in Switzerland.
What the workloads actually contain
- Exchange Online — your emails, calendar, and contacts
- SharePoint Online — team sites, document libraries, and intranet content
- OneDrive for Business — individual file storage for each user
- Microsoft Teams — chat history, meeting recordings, and channel files
- Microsoft Copilot — AI processing data (check Microsoft's current documentation, as this varies by service)
Can you move your data to Switzerland?
Yes — but it's not a simple toggle. Microsoft's Advanced Data Residency (ADR) add-on allows existing tenants to request migration to Switzerland. This requires a valid Microsoft 365 business subscription, purchasing the ADR add-on, submitting a migration request, and waiting for Microsoft to complete it — which can take several months for larger tenants.
New tenants set up today with Switzerland as the billing country may be provisioned in Swiss data centres from the start, but this is not guaranteed without explicitly selecting Swiss data residency.
Note on Copilot: Microsoft Copilot data handling is more complex, and residency guarantees differ from core M365 workloads. If you're using or considering Copilot, this requires a separate review.
The CLOUD Act question
Even if your data is stored in Swiss Microsoft data centres, it remains subject to the US CLOUD Act — a US law that allows American authorities to compel US-headquartered companies, including Microsoft, to produce data stored anywhere in the world.
For most businesses this risk is acceptable and well-managed. For regulated financial institutions or companies handling particularly sensitive data, it may warrant using a genuinely sovereign Swiss cloud provider — such as Exoscale or SafeSwissCloud — instead.
What to do next
Check your data location today using the steps above. If your data is in Switzerland, document this for your compliance records. If it's in the EU, assess whether your current contractual protections are adequate and whether migration is warranted. If you're unsure what any of this means for your nDSG obligations, get advice.
I offer a fixed-price M365 compliance assessment starting from CHF 900 — data residency audit, CLOUD Act exposure, nDSG gap analysis, and written documentation. The first 30 minutes is free.