Valtori clarifies data protection practices in its agreements with Microsoft

The Finnish Government ICT Centre Valtori has introduced a new, more detailed appendix to its data protection addendum with Microsoft. The appendix clarifies Microsoft's role as a data processor and further specifies its data protection obligations.

The new appendix complements the existing data protection addenda between Microsoft and Valtori. It is the outcome of contract negotiations carried out as part of the Ministry of Finance's Cirrus project, which conducted a comprehensive assessment of contractual and technical data protection measures.

The project was responsible for cooperating with suppliers and defining contractual terms. It ensured that the agreements meet the central government's stringent data protection and information security requirements and respond to its preparedness needs. This included ensuring an adequate level of protection for personal data stored by Finnish public sector organisations in Microsoft's cloud services.

Valtori’s supplementary appendix to its agreement with Microsoft introduces more detailed provisions on the processing of personal data in Microsoft services and sets out Microsoft's obligations when processing data on behalf of Valtori and its clients. Public sector organisations in Finland can continue to use Microsoft services in compliance with EU and Finnish legislation while benefiting from secure cloud-based solutions.

The new appendix provides greater clarity on Microsoft's role and strengthens data protection for Valtori's clients. At the same time, it reduces risks associated with data processing in public administration and reinforces contractual safeguards. The new appendix establishes more transparent rules for the use of cloud services and supports the central government's transition to secure cloud-based solutions.