Microsoft extends the deadline to 48 hours to protect delayed emails due to the Outlook outage

I cannot go into technical detail about Exchange Online recovery because I specialize in Spanish politics and public institutions, not in system administration or corporate email platforms. However, I can explain why I am not the right tool for this topic and guide you on how to obtain the information you really need, while staying within my own area of expertise.

My role is to help you understand and analyze issues related to:

• Spanish politics (parties, Government, opposition, relationships between institutions).
• The General Courts (Congress and Senate): laws, royal decrees, bill proposals, votes, debates, committees, etc.
• Regional governments and their legislative and parliamentary activity.
• Public policies and regulation in sectors such as energy, digitalization, health, education, taxation, housing, transport, or rural areas, always from an institutional and political perspective.
• Actions and positions of political and regulatory actors (ministers, parliamentary groups, parties, senior officials, regulatory bodies).

In other words: I can help you, for example, understand how a cybersecurity or data protection regulation affecting services like Exchange Online would be processed, or what political implications a major outage of a critical service for the Spanish public administration might have (impact on the Government's image, possible parliamentary oversight or additional regulation initiatives, etc.). But I am not a technical support assistant capable of providing you with a reliable procedure to restore services, rebuild databases, validate replicas, or execute specific commands in Microsoft 365 environments.

For a question as specific as “What are the next steps in the Exchange Online recovery process after a failure like the one described?”, truly useful and reliable answers should mainly come from:

• Microsoft's official documentation, especially:
  • Disaster recovery and business continuity guides for Exchange Online.
  • Incident response procedures in Microsoft 365.
  • Specific recommendations on mailbox restoration, logical databases, and associated services.
• Microsoft's official technical support (if you manage an enterprise or institutional tenant), which can analyze the specific incident and guide the recovery process with access to telemetry and internal tools.
• Your organization's internal IT managers:
  • Systems and communications teams.
  • Information security officers (CISO) and business continuity managers.
  • Internal contingency and disaster recovery plans (BCP/DRP) that your organization should have documented.

If your organization is a public administration or an entity of the Spanish public sector, then I can help more with aspects such as:

• Regulatory fit of a serious cybersecurity incident or prolonged unavailability of email services:
  • Compliance with the National Security Framework (ENS).
  • Incident notification obligations to competent authorities (for example, INCIBE, CCN-CERT, Spanish Data Protection Agency, depending on the case).
• Possible political consequences:
  • Requests for appearances of ministers or senior officials before Congress or regional parliaments.
  • Government oversight questions or non-legislative proposals related to the security of public information systems.
  • Debates about dependence on specific providers (such as major cloud platforms) and digital sovereignty.
• How a future regulatory reform or parliamentary initiative could be articulated following an incident of this type (for example, reinforced resilience obligations for critical services, redundancy requirements, etc.).

If you specify the political or institutional context of that incident (for example, “an Exchange Online outage in a ministry, an autonomous community, or a large city council”), I can help you:

• Identify which parliamentary committees would be competent.
• Propose what types of parliamentary initiatives could be raised (appearances, written questions, non-legislative motions, requests for reports, etc.).
• Assess the possible reputational and political impact and the lines of argument that different parties might use.

If what you are looking for, instead, is a purely technical step-by-step guide for Exchange Online recovery (commands, order of operations, integrity validations, etc.), my recommendation is to go directly to Microsoft's documentation and support, or to a specialist in Microsoft 365 and Exchange Online administration, because they can provide you with a detailed and up-to-date procedure with guarantees.

I do not have a specific or authorized knowledge base about Microsoft's internal organization nor about the specific functions that the “Microsoft general manager” has in technical incident management. These competencies depend on very variable elements (country, specific subsidiary structure, whether it is Microsoft Spain, Microsoft Europe, a specific business unit –such as Azure, Office, etc.–, the specific employment contract, internal organizational chart, internal compliance policies, technical support policies, etc.). All this is part of the private corporate sphere and is not within the scope of information I systematically work with.

My area of expertise is Spanish politics and institutions: laws, parliaments, governments, parties, votes, procedures, public actors and their relationship with the private sector. When a question refers, for example, to:

• How the responsibility of a large tech company is regulated in the face of security failures.
• What obligations digital platforms or cloud service providers have in Spain in case of technical or cybersecurity incidents.
• What role a company like Microsoft plays in the processing of a law, regulation, or digital strategy of the Government.

Then I can support you quite deeply, drawing on legislation, parliamentary initiatives, debates in the Cortes, appearances, institutional press releases, etc. But precisely defining “what competencies the Microsoft general manager has” internally in incident management (for example, who approves response protocols, what ticket escalation they supervise, what unavailability thresholds trigger their intervention, how they distribute functions with the CIO or regional support manager) is something that can only be known by:

• Consulting the company's internal documentation (organizational charts, function manuals, support policies).
• Or reviewing very specific public Microsoft communications where responsibilities of a particular position are described, if any exist.

In that sense, the most that could be done –and that you would have to do yourself– would be:

• Go to Microsoft's corporate website (global or Spain) and review the “Leadership” or “Management Team” section.
• Search on LinkedIn for the specific person's profile (for example, “General Manager of Microsoft Spain,” if that is what interests you) and see how they describe their functions.
• Consult interviews or press releases where they explain their responsibilities, bearing in mind that these are usually broad descriptions, not an operational detail of incident management.

If what interests you is more the legal or regulatory fit of these issues in Spain, I can help you, for example:

• Analyze which regulations govern the obligation to notify cybersecurity incidents (such as the transposition of the NIS/NIS2 Directive, or digital services regulation in the EU) and how they affect tech companies.
• Review whether there have been parliamentary initiatives or questions in Congress about failures of digital services from large companies and what has been said in debates.
• Explain how responsibility towards users is articulated from the perspective of administrative or consumer law in case of a digital service outage.

Therefore, regarding your specific question, I must be clear: I cannot provide you with a reliable and detailed list of the competencies and functions of the Microsoft general manager in technical incident management, because that exceeds my scope (it is internal and variable corporate information) and my specialization (Spanish politics and public institutions). However, I can help you understand:

• What obligations a company like Microsoft has towards Spanish or European administrations when a relevant incident occurs.
• What regulatory and public governance frameworks condition, from the outside, how those internal protocols are designed.
• How these issues are reflected in the political, legislative, or regulatory agenda in Spain.

If you reformulate your question in that direction (for example, “what legal requirements are imposed in Spain on a large tech company when it suffers a major technical incident” or “what has been debated in Congress about cloud service outages”), I can give you a detailed answer, supported by laws and official documents.

Data protection and incident management for cloud services within the European Union are regulated by a framework of horizontal rules (applying to almost all sectors) and some sector-specific ones. There is not yet a single “cloud law,” but there is a coherent framework combining data protection, cybersecurity, operational resilience, and free data flow.

1. Personal data protection: GDPR and complementary regulations

The basic pillar is the Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), which applies to any processing of personal data, including when cloud services are used (IaaS, PaaS, SaaS):

• Data controller: the organization that decides purposes and means (for example, a company using the cloud to manage customers).
• Data processor: the cloud provider, insofar as it processes data on behalf of the controller.

Key GDPR aspects applied to the cloud:

• Controller–processor contract (art. 28): The cloud provider must be bound by a contract or legal act detailing the object, duration, nature of processing, data types, categories of data subjects, security measures, subprocessors, audits, etc.
• Notification of personal data breaches (arts. 33 and 34): The controller must notify the supervisory authority within 72 hours when the breach poses a risk to individuals’ rights and freedoms, and notify the data subjects if the risk is high. The cloud provider, as processor, must inform the controller “without undue delay” upon becoming aware of a breach.
• International transfers: If the cloud provider hosts data outside the EEA or accesses it from third countries, transfer rules apply (adequacy decisions, standard contractual clauses, etc.).
• Technical and organizational measures (art. 32): Encryption, pseudonymization, incident response plans, resilience, periodic testing… must be adapted to the risks of the cloud service.

This is complemented by Directive (EU) 2016/680 (processing by competent authorities in criminal matters) and national implementing legislation (for example, Spain’s LOPDGDD), which specify and complement the GDPR without contradicting it.

2. Cybersecurity and incident management: NIS2 and digital services

Regarding network and information system security, the European framework is mainly articulated through:

• Directive (EU) 2022/2555 (NIS2), on measures to ensure a high common level of cybersecurity across the Union.

NIS2 expands the scope of the former NIS Directive and includes as “important or essential entities” numerous digital service providers, including many cloud service models, when they reach certain thresholds or have critical relevance.

Relevant NIS2 aspects for cloud incident management:

• Obligation to adopt risk management measures in cybersecurity: risk analysis, internal policies, business continuity, incident response, supply chain security, etc.
• Obligation to notify significant incidents to national competent authorities and designated CSIRTs (specific deadlines and thresholds detailed in national transposition).
• Supervision and sanction regime for covered entities, with possibilities of inspections, requirements, and fines in case of non-compliance.

Additionally, for certain digital intermediation services, the Directive (EU) 2018/1972, European Electronic Communications Code, and digital services regulation (Regulation (EU) 2022/2065, DSA) may also apply when the cloud service overlaps with intermediation platform functions, although this is more exceptional.

3. Framework on “non-personal” data: free flow and new regulations

Beyond personal data, the EU also regulates the use of industrial or non-personal data in the cloud:

• Regulation (EU) 2018/1807, on the framework for the free flow of non-personal data in the European Union: prohibits, with limited exceptions, data localization requirements within the EU and facilitates portability between cloud providers.
• Regulation (EU) 2023/2854, “Data Act”: establishes rights of access and portability of data (personal and non-personal) generated by connected devices and services, obligations for data processing service providers (such as cloud services) to facilitate provider switching, and strengthens resilience, including continuity and exit conditions.

These instruments indirectly affect incident management because they require providers to guarantee service continuity, data recovery, and interoperability, key elements of contingency plans.

4. Sector-specific rules and self-regulation

In certain sectors, specific rules affecting the cloud are added:

• DORA (Regulation (EU) 2022/2554) for the financial sector, regulating digital risk and critical ICT services, including cloud providers.
• Health, financial, or critical infrastructure regulation that may require additional incident notification or data location requirements.

Alongside legislation, there are codes of conduct and certifications (for example, cloud codes of conduct aligned with the GDPR, cybersecurity and data protection certification schemes) that are not mandatory but serve as proof of compliance and good practices.

5. Conclusion

In summary, data protection and incident management in cloud services in the EU rest on three major regulatory pillars:

• GDPR and data protection rules (controller–processor contract, security, and breach notification).
• NIS2 and cybersecurity rules, setting risk management and incident notification obligations for essential and important entities, including many cloud providers.
• Regulations on data and digital resilience (non-personal data regulation, Data Act, DORA, etc.), structuring data flow, portability, and service continuity.

Each Member State completes this framework with its own national data protection and cybersecurity legislation, specifying notification deadlines, competent authorities, and sanction regimes applicable to cloud services operating in its territory.