Some German providers claim that using ChatGPT on a German server is secure and GDPR-compliant. GDPR-compliant may be officially true, but security is absent. US law forces Microsoft and other US companies to cooperate with US authorities, and we are not allowed to learn anything about it (this is called "spying on foreigners" or "US security interests").
"We absolutely want to use ChatGPT, so it has to be secure. And if it is not secure, we simply define it as secure."
It is very easy: host ChatGPT on a tenant (server) in Germany or Europe in the Azure cloud. In other words, in a supposedly secure data space that would belong only to you. After all, the server is in Germany and is therefore supposedly secure.
Bullshit.
There really are German companies that sell this or something similar as a solution. Instead of ChatGPT, they use either Claude or Gemini, and instead of Azure, either AWS.
About ChatGPT in the Azure cloud, Microsoft writes:
The text gives cause for thought. We take it apart sentence by sentence. What is not discussed here are so-called AI anonymisers, which supposedly anonymise texts automatically before they are sent to the insecure ChatGPT. That is just as much bullshit. First, a treat (it applies to all cloud services from US companies):
Parts of the following explanations deal specifically with Microsoft's privacy promises. At their core, the points of criticism apply to all US companies, some of which do not even bother with (questionable) promises and are just as insecure or even more so (if there is any comparative for "insecure" at all).
Microsoft's privacy promises: what they really mean
All of the following quotes refer to the Microsoft page on Azure privacy.
Original: "Microsoft protects your data through clearly defined and proven policies and processes for responding to requests, strong contractual commitments and, where necessary, legal action."
Reality: As a US company, Microsoft is legally obliged under FISA Section 702 and the CLOUD Act to hand over customer data on official order, regardless of its own policies or contracts. Contractual commitments (e.g. SCCs) are simply overridden by a US warrant. Legal action against US authorities is structurally hopeless.
Original: "We believe that all government requests for data should be directed to you."
Reality: This opinion is legally irrelevant. Under FISA Section 702, requests are not addressed to the customer but directly and secretly to Microsoft. The customer is deliberately bypassed, and Microsoft is bound by a gag order and may not inform them.
Original: "We do not give any government agency direct or unrestricted access to customer data."
Reality: Under EO 12333, the NSA can intercept data before it even reaches Microsoft, by tapping undersea cables. Microsoft does not have to "give" any access at all, because the data is intercepted outside its control. EO 12333 also allows this data to be passed on in bulk to 16 other US agencies, without a court order.
The promise protects against exactly one type of access, the direct, unrestricted one, which practically never occurs. All real access mechanisms under US law are either indirect (Microsoft delivers the data itself) or formally restricted (limited to certain data), but identical in effect for those affected: their data ends up with US authorities, without their knowledge and without legal protection.
Original: "Microsoft follows strict principles and transparency requirements for data requests."
Reality: Transparency ends where US law begins. Under FISA Section 702 and the SCA (Stored Communications Act), there is a statutory gag obligation. In many cases Microsoft cannot and may not inform affected customers. Transparency is structurally made impossible.
Original: "We assume that you have control over your own data."
Reality: EU customers have de facto no control over their data. In Schrems I & II, the CJEU found that US surveillance laws (especially FISA 702) are incompatible with EU fundamental rights because they give data subjects no effective legal protection. Non-US citizens have no enforceable rights against US authorities. Microsoft merely assumes that you have control over your data, while benevolently acknowledging that the opposite may be the case at any time.
Original: "Therefore, we will not disclose data to government agencies unless you instruct us to or we are legally required to do so."
Reality: The exception "legally required" is the normal case, not the exception. The CLOUD Act, FISA 702 and the SCA create far-reaching statutory disclosure obligations. The addition "or you instruct us to" obscures that Microsoft must hand over this data even without any customer instruction, and if it must, it may not even inform the customer.
Original: "Microsoft reviews all government requests to ensure they are valid and appropriate."
Reality: The review is carried out exclusively under US law, not under the GDPR. What is "valid" under US law (e.g. a CLOUD Act warrant or a FISA 702 directive) violates EU law under GDPR Art. 48, since no recognised international agreement underlies it. Microsoft is structurally unable to comply with both legal systems at the same time.
Original: "If customer data is requested from Microsoft, we direct the requesting party to request the data directly from the customer."
Reality: Under FISA Section 702, exactly this is ruled out. The agency approaches Microsoft by directive, not the customer. Microsoft has no legal means of referring the NSA or the DOJ to the customer.
Original: "If Microsoft is required to disclose customer data or grant access to it, we will promptly notify the customer and provide a copy of the request, unless we are legally prohibited from doing so."
Reality: The final clause "unless we are legally prohibited from doing so" makes the entire commitment worthless. Under FISA 702, the SCA and the CLOUD Act, notifying the customer is regularly prohibited by law. In the most practically relevant cases, intelligence surveillance and law enforcement, the customer learns nothing. The notification promise therefore only applies to the legally uninteresting exception.
Conclusion: Viewed strictly, Microsoft's privacy promises are not legally enforceable guarantees but declarations of intent that are systematically undermined by US law. They are in direct contradiction to GDPR Art. 44 ff. (third-country transfers) and Art. 48 (access orders from authorities) and give EU customers a false sense of security.
US spying by law
The GDPR is incompatible with US law. US companies have to choose:
- Comply with the GDPR and get into trouble with the American judiciary or government
OR instead - Ignore the GDPR and keep the American judiciary or government happy.
Doing both at the same time is impossible, as a review of US law shows.
The most important US legal bases that affect us Germans and other foreigners (from a US perspective) are the following.
1. FISA Section 702
- Allows the US government to force US providers by directive to hand over the communications of foreign targets
- No individual judicial approval per target, mass access possible
- Leads to "incidental collection" of EU citizens' data
- Declared incompatible with EU fundamental rights by the CJEU twice (Schrems I & II)
- Providers may not inform those affected (gag obligation)
2. Executive Order 12333 (EO 12333)
- Gives US intelligence agencies far-reaching powers for "signals intelligence" worldwide, without a court order
- Allows the NSA to share private data in bulk with 16 other agencies without warrants
- Core problem according to the CJEU: mass surveillance by tapping undersea cables, with data intercepted before it arrives in the USA
- No effective legal protection for non-US citizens
3. CLOUD Act (2018)
- Enables US law enforcement to request data held abroad by US companies by warrant
- Collides directly with GDPR Art. 48: EU data may only be transferred to third countries on the basis of a recognised international agreement, and a CLOUD Act warrant is not one
- US providers are caught in a dilemma: complying with the CLOUD Act = GDPR violation; refusing = US contempt of court
- Standard Contractual Clauses (SCCs) do not solve the problem, because a warrant overrides contractual commitments
4. SCA – Stored Communications Act (1986)
- Governs the voluntary and compelled disclosure of stored digital communications (emails, cloud data) by ISPs
- A warrant is required for content less than 180 days old, while for older data a subpoena sometimes suffices, which falls well short of GDPR standards
- Outdated (1986), long since overtaken by modern cloud services; creates legal uncertainty for international providers
- Forms the basis of the CLOUD Act, whose problems (see above) build directly on it
- No equivalent to GDPR data subject rights (access, erasure, etc.)
In short:
All four sets of rules allow US authorities to access the personal data of EU citizens without sufficient legal protection for those affected, in direct contradiction to GDPR Art. 44 ff. (third-country transfers) and Art. 48 (access orders from authorities). The CJEU has therefore struck down two EU-US data transfer frameworks (Safe Harbor, Privacy Shield) (Schrems I and II); the current EU-US Data Privacy Framework also faces a new lawsuit.
Server location Germany: no guarantee for ChatGPT on Azure
Hopefully humanity will soon be wiped out by AI. Then the individuals who claim that a server location in Germany or Europe is a guarantee of security will disappear too.
No matter where a server is located: whoever has the access credentials can access that server.
Only dim-witted people claim that the server location is a guarantee of data security.
It does not matter where the server is! Whether in
- Germany
- Europe
- America
- Timbuktu or
- on the moon
Anyone with the access credentials can access your server, no matter where it is. Anyone.
What is also factually true, however: if the server is not in Germany or Europe, GDPR compliance is not really given. That certainly applies to US locations. No German company that values the security of customer data will operate a server in the USA if it could also be operated in Germany. OK, the BSI may be an exception. But the BSI is not a company either, but a federal agency that acts questionably in parts.
Purpose creep: US reuse of data
It gets worse: not every US agency may collect data from EU citizens. But the NSA often may, for certain purposes. Once the NSA has received the data, it can be passed on to other US agencies that actually had no access.
Furthermore, the other US agencies can then process the data (in particular analyse it or even pass it on again) for purposes other than those originally permitted under US law.
EU citizens, by contrast, have no legal protection whatsoever:
- No right of access against US authorities (≠ GDPR Art. 15)
- No right to erasure (≠ GDPR Art. 17)
- No possibility for non-US citizens to sue before US courts
- No duty to notify when data is shared between agencies
- No purpose limitation, so data can be reused indefinitely
Paying for cloud services in USD: a legal catastrophe
If you think that is already very bad, you are still missing an important piece of information. It concerns IEEPA / OFAC, the often underestimated lever. Behind these cryptic abbreviations lies a simple fact. Whoever pays their invoices in US dollars submits (often unintentionally and unknowingly) to the American legal system.
Paying invoices in USD "voluntarily" subjects you to US jurisdiction.
Microsoft promises privacy. OFAC and IEEPA operate one level deeper, in payment transactions. Anyone who depends on US cloud services has structurally placed their business operations under the influence of the US Treasury, regardless of all privacy promises, contracts or EU legal frameworks.
Dependence on US cloud services: tough luck?
The previous figure mentioned the SDN list. SDN stands for Specially Designated Nationals and Blocked Persons List.
This is a list maintained by the US Treasury (OFAC) of persons, companies and organisations with which US persons are in principle not allowed to do business and whose assets under US jurisdiction are frozen.
Who is on it: terrorists, drug traffickers, state actors from sanctioned countries (Iran, North Korea, Russia, etc.), as well as companies and individuals close to them. In 2019, according to the German Stiftung Wissenschaft und Politik, the list already contained over 13,000 entries.
What being listed means:
- All assets under US jurisdiction are frozen
- US persons and US companies (including Microsoft) may not carry out transactions with SDN entries
- This also applies to companies that are owned 50% or more by an SDN (the so-called "50% Rule"), even if the company itself is not listed
The relevance for EU companies is enormous: an EU company that is placed on the SDN list loses access to all US cloud services.
The Patriot Act and the PRISM programme (known since Edward Snowden) are not to be discussed further here. They are just as relevant for Microsoft customers as for customers of other US companies. However, it is reported that in 2007 Microsoft was the first "partner" of the PRISM spy programme.
Alternative to cloud AI
The truth is: the more general and vague the use of AI, the more you depend on large cloud models such as ChatGPT or Gemini. Using these LLMs is not secure, as shown above. Your data is not safe there.
Focus, focus, focus.
Which process do you specifically want to optimise with AI?
Even if OpenAI verbally assures you that your data will not be used for AI training: does that also mean that your data is not looked at or reviewed? Don't worry, everything is safe with OpenAI and Microsoft! Just enter all your trade secrets, customer data and assets. Nothing will happen. Nobody will siphon off your knowledge. Promise.
Nowadays, huge AI models can be run on hardware that costs about 35,000 euros. That is feasible for many companies. Realistically, though, it will not happen.
The solution is to focus on specific use cases. Here on the Dr. DSGVO blog you will find numerous examples of what is meant by that and by pre-designed AI applications.
This makes optimised, secure AI possible: the AI runs on your hardware in your data centre, or via colocation in a data centre of your choice, or on a rented server located exclusively in Germany.
It is your decision. Digital sovereignty is possible. You just have to want it.
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
