On 14 September 2026 Microsoft added a setting to the Microsoft 365 admin centre, the console from which an organisation’s administrators manage its accounts, and the selection recorded there takes effect on 14 December 2026. Called “Store Microsoft 365 customer data in-country”, it is open to eligible organisations whose Microsoft 365 account is registered to France, Germany, Norway, Sweden or Switzerland, and it decides where the data of these services is kept:
With the setting on, Microsoft keeps that data stored in Switzerland. With it off, Microsoft may store the data regionally within its EU Data Boundary: the countries of the European Union and the European Free Trade Association – EFTA – in which it commits to store and process client data. From 14 December Microsoft may begin moving data for organisations that have left the setting off, and it says not all data moves on the day.
Administrators find the setting under Settings > Org settings > Organization profile > Data location. It is off by default for organisations that opened their Microsoft 365 account after 14 September. Microsoft tells older organisations to check the Message Center, the admin centre’s notice board, for their own starting position. Turning the setting on after data has moved starts a return that Microsoft says can take about six months. Organisations that never joined Microsoft’s earlier programme for moving their data into the country may not be eligible. Organisations that pay for Microsoft’s Advanced Data Residency or Multi-Geo options do not see the setting, because those offerings already govern where their data sits.
The setting covers storage. Processing, the moment Copilot reads a request and composes an answer, sits under a separate commitment. In November 2025 Microsoft listed Switzerland among the countries due to receive in-country Copilot processing in 2026. Its update of 3 April 2026 changed that for EU and EFTA countries, where processing will be delivered at regional level aligned with its EU Data Boundary commitments. A Swiss organisation that turns the setting on keeps the data Copilot stores in Switzerland, while each request may be processed elsewhere in the boundary. Microsoft excludes models from Anthropic, an AI company it uses as a subprocessor, from the boundary, and leaves them switched off by default for Swiss organisations.
The Swiss Financial Market Supervisory Authority, FINMA, permits outsourcing abroad under its Circular 2018/3 “Outsourcing”, which has applied since 1 April 2018. The company must be able to guarantee expressly that it, its auditor and FINMA can enforce their right to inspect and audit information, and the possibility of restructuring or resolving the company in Switzerland must be assured. FINMA describes the circular as technology-neutral and requires appropriate allowance for the higher risks of outsourcing outside Switzerland. For personal data, Switzerland’s Data Protection Ordinance already lists the other countries in the boundary as guaranteeing an adequate level of data protection.
Either position can be defended in an outsourcing file. A position nobody took is harder to defend: on 14 December the recorded selection applies, and bringing data back after a late change can take about six months. The decision belongs with the people who answer for the outsourcing arrangement, with the reason written down.
Put this on your agenda, we can help you get there.