Swiss government says give M365, and all SaaS, a miss as it lacks end-to-end encryption
- Securityish
- Privacy & Personal Security
Quick Summary
Switzerland’s Conference of Data Protection Officers, Privatim, has urged public bodies to avoid using Microsoft 365 and other SaaS services due to security concerns. The resolution highlights the lack of true end-to-end encryption in most SaaS solutions, which could allow providers to access sensitive data. This matters as it raises significant privacy and security risks for organizations handling confidential information.
The Securityish Brief
Why SaaS Security Matters
The resolution from Privatim emphasizes the risks associated with using SaaS solutions like Microsoft 365, particularly for Swiss government agencies. Without end-to-end encryption, sensitive data could be exposed to unauthorized access, undermining privacy and security.
Organizations should be aware that many SaaS providers can change their terms unilaterally, which may weaken existing privacy protections. This lack of control over data security can lead to potential violations of fundamental rights, especially for sensitive personal data.
For everyday users and organizations, this highlights the importance of scrutinizing the security measures of cloud services before adoption. Users should consider whether their data is adequately protected and whether they can trust the provider to maintain confidentiality.
As the resolution suggests, avoiding large international SaaS providers may be prudent for organizations that handle particularly sensitive information. This could involve exploring alternative solutions that prioritize strong encryption and user control over data.
Key Takeaways
- Review the security features of any SaaS applications your organization uses, focusing on encryption capabilities.
- Consider alternative cloud solutions that offer stronger privacy protections and end-to-end encryption.
- Stay informed about changes in terms and conditions from your service providers to ensure ongoing compliance with privacy standards.
- Limit the sharing of sensitive data with cloud services that do not guarantee adequate security measures.
- Educate team members about the risks associated with using SaaS applications and promote best practices for data protection.
Key Terms & Concepts
- SaaS: Software as a Service (SaaS) refers to cloud-based applications that are hosted on the internet and accessed via a web browser.
- end-to-end encryption: End-to-end encryption is a method of data transmission where only the communicating users can read the messages.
- Privatim: Privatim is Switzerland’s Conference of Data Protection Officers that addresses data protection issues and provides recommendations.
- CLOUD Act: The CLOUD Act is a U.S. law that allows law enforcement to access data stored by U.S. companies, even if the data is stored overseas.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2025/12/01/infosec_news_in_brief/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
