Cloud Solutions for Businesses in Germany: A Practical Guide

Whether it is Microsoft 365 in the office, an ERP system in a provider's data centre or virtual servers in Frankfurt: cloud solutions are everyday reality for companies in Germany. At the same time there is a lot of uncertainty – above all about data protection (GDPR / DSGVO), costs and the question of which systems belong in the cloud at all.

In this guide I explain the main cloud models, the legal requirements in Germany, typical cost traps and a proven path to cloud migration – the way I deliver cloud projects as a Microsoft Azure certified (AZ-104) IT engineer with 13+ years in IT support and infrastructure.

What are cloud solutions? IaaS, PaaS and SaaS

Instead of buying, running and replacing their own servers every five years, companies rent capacity from a cloud provider. Depending on how much the provider takes over, there are three service models:

Most small and medium-sized businesses (SMEs, in German KMU) start with SaaS – usually Microsoft 365 – and then move servers and applications step by step to IaaS or PaaS.

Public, private, hybrid or multi-cloud?

In practice the hybrid cloud is the most common model in Germany: Active Directory and some line-of-business applications still run in the company's own server room, while email, files and new applications live in the cloud. Microsoft Entra Connect synchronises the user accounts, so employees need only one password.

Benefits of cloud solutions for German companies

• Scalability: add or reduce resources in minutes instead of weeks of hardware procurement.
• Predictable operating costs (OPEX): monthly billing instead of large investments (CAPEX) in servers and storage.
• Mobile and hybrid work: access data and applications from anywhere – protected with MFA.
• High availability: data centres with redundant power, cooling and connectivity that an SME could hardly afford itself.
• Less maintenance: the provider handles hardware replacement, firmware and – with PaaS and SaaS – operating system updates.
• Help with the skills shortage: the IT team focuses on users and projects instead of hardware.

Data protection and compliance: GDPR, C5 and NIS2

For companies in Germany, data protection is the most important factor when choosing a cloud. Check these points before signing any contract:

• Data processing agreement (DPA / AVV): if the provider processes personal data on your behalf, a contract under Art. 28 GDPR is mandatory. The large providers include it by default.
• Data location: choose a region in Germany or the EU – for example Azure Germany West Central (Frankfurt) and Germany North (Berlin), AWS eu-central-1 (Frankfurt) or Google Cloud europe-west3 (Frankfurt) and europe-west10 (Berlin).
• Transfers to the USA: for US providers, the adequacy decision on the EU-US Data Privacy Framework has applied since 2023. Microsoft also stores and processes EU customer data within the EU Data Boundary.
• BSI C5: the Cloud Computing Compliance Criteria Catalogue (C5) of Germany's Federal Office for Information Security (BSI) is the German audit standard for cloud security. Ask for a current C5 attestation.
• NIS2: Germany's NIS2 Implementation Act has been in force since 6 December 2025. Companies in scope must demonstrate risk management – including the security of their cloud providers in the supply chain.
• GoBD: tax-relevant data and records must be archived in an audit-proof way for the statutory periods, in the cloud as well.

If you need maximum data sovereignty – for example because of the US CLOUD Act – you can choose German and European providers such as STACKIT, IONOS Cloud, Open Telekom Cloud or Hetzner, or additionally encrypt critical data with your own keys (customer-managed keys).

The shared responsibility model

The most common misconception: “The provider takes care of everything.” In reality, security is shared between provider and customer – and the boundary moves with the service model:

Identities and data are always your responsibility. Even with Microsoft 365 you should back up mailboxes, OneDrive and SharePoint with your own backup solution – the recycle bin and retention policies are not a backup.

Cloud security: the most important measures

• MFA for every account plus Conditional Access, so sign-ins are only possible from known devices and countries.
• Least privilege: roles with minimal rights (RBAC) and separate, protected accounts for administrators.
• Backups following the 3-2-1 rule, with at least one immutable copy, tested regularly.
• Encryption at rest and in transit (TLS) – enabled by default at the large providers.
• Monitoring and logging, e.g. with Microsoft Defender for Cloud and Azure Monitor, including alerts on suspicious sign-ins.
• Patch management for all your own VMs and endpoints, e.g. with Intune or Azure Update Manager.

Keeping cloud costs under control

The cloud is not automatically cheaper – it is more flexible. Without control, costs grow quickly. These measures work well:

• Set up budgets and cost alerts, e.g. with Azure Cost Management or AWS Budgets.
• Rightsizing: size VMs by their actual usage, not by the old server.
• Use reservations and savings plans for systems that run permanently – often a large saving compared with pay-as-you-go.
• Shut down test and development VMs automatically, for example in the evening and at weekends.
• Apply tags for department, project and cost centre so every invoice can be allocated.
• Include data egress and licence costs in your calculation from the start.

Cloud migration in 6 steps

• 1. Inventory: which servers, applications, data volumes and dependencies exist? Who uses what?
• 2. Goals and requirements: define costs, availability, data protection, data location and timeline.
• 3. Strategy per system: rehost (move 1:1 as a VM), replatform (e.g. to a managed database), replace (with SaaS), retain (keep on-premises for now) or retire (switch off).
• 4. Build the foundation (landing zone): set up identities, networking, permissions, policies, backup and monitoring – before the first application moves.
• 5. Pilot and migration: start with a non-critical system, test, inform users and then migrate in waves.
• 6. Operate and optimise: monitor costs, security and performance continuously and decommission the old infrastructure in an orderly way.

Hands-on: allow Azure resources only in Germany and the EU

An Azure Policy makes sure nobody accidentally creates resources outside the permitted regions. This is how I create a resource group in Frankfurt and allow only regions in Germany and West Europe for the whole subscription (Azure CLI):

# List available regions
az account list-locations -o table

# Create a resource group in Frankfurt (Germany West Central)
az group create --name rg-company-prod --location germanywestcentral

# Assign the built-in policy "Allowed locations"
az policy assignment create \
  --name eu-regions-only \
  --policy e56962a6-4747-49cd-b67b-bf8b01975c4c \
  --params '{"listOfAllowedLocations":{"value":["germanywestcentral","germanynorth","westeurope"]}}' \
  --scope /subscriptions/<subscription-id>

Common mistakes in cloud projects

• Moving servers 1:1 without any adjustment and then being surprised by the costs.
• No separate backup for Microsoft 365 or cloud data.
• Admin accounts without MFA and too many global administrators.
• Publicly reachable storage and remote desktop ports without protection.
• Involving data protection too late – DPA, record of processing activities and deletion concept are missing.
• No documentation and no training – users and IT support don't know the new processes.

Frequently asked questions about cloud solutions

• Are cloud solutions GDPR compliant? Yes, if the provider offers a data processing agreement under Art. 28 GDPR, processes data in Germany or the EU, and you implement access rights, encryption and documentation properly yourself.
• Which cloud is best for companies in Germany? It depends on your existing IT: companies using Windows, Active Directory and Microsoft 365 are usually productive fastest with Microsoft Azure; for maximum data sovereignty, German providers such as STACKIT, IONOS Cloud or Open Telekom Cloud are a good fit.
• How much does a cloud solution cost? Costs depend on usage – compute, storage, data transfer and licences. Rightsizing, reservations and budgets make costs predictable; the providers' pricing calculators help with a first estimate.
• Where are the cloud data centres in Germany? Microsoft Azure runs the Germany West Central (Frankfurt) and Germany North (Berlin) regions, AWS the eu-central-1 region in Frankfurt, and Google Cloud the europe-west3 (Frankfurt) and europe-west10 (Berlin) regions.
• Do I still need a backup in the cloud? Yes. Under the shared responsibility model you are responsible for your own data – including SaaS services such as Microsoft 365.
• How long does a cloud migration take? For small companies with a few servers often a few weeks; for larger environments with many line-of-business applications several months, in planned migration waves.

Conclusion

Cloud solutions make companies in Germany more flexible, more secure and less dependent on their own hardware – when they are introduced with a plan. Start with an inventory, choose data centres in Germany or the EU, settle data protection early, protect identities with MFA and keep an eye on costs from day one. If you have questions about your cloud environment or Microsoft Azure, feel free to contact me.