Moving away from Big Tech step by step: a 12-month plan for a Belgian SME

Daniel Platteau

Why the question arises now

Many Belgian SMEs run on Microsoft 365 or Google Workspace. It is convenient, but it creates a dependency: your data, your e-mails and your tools depend on companies subject to US law, including the CLOUD Act (2018). It allows US authorities to require a US provider to hand over data it holds or controls, even if stored in Europe (the provider can challenge the request, but the decision is no longer yours).

Data transfers to the United States now largely rely on the "Data Privacy Framework". The EU General Court upheld it on 3 September 2025, but an appeal has been pending before the Court of Justice since 31 October 2025. Its two predecessors, Safe Harbor and the Privacy Shield, were struck down by that same Court.

Some organisations have taken the plunge. The German state of Schleswig-Holstein has moved about 44,000 mailboxes and 80% of its workstations to open-source software. In late 2025, the International Criminal Court announced it was leaving Microsoft for the European openDesk suite, after US sanctions against its staff.

Large companies reach the same conclusion: in a Capgemini survey of 1,300 executives published in September 2026, 59% consider full digital sovereignty unrealistic and favour resilience.

The plan in five steps

The timetable is indicative: a five-person business will move faster, an organisation with business software more slowly. The names given are examples, not an exhaustive list.

Months 1-2: take stock

Before migrating anything, list:

• current licences and their renewal dates;
• where your data are (OneDrive, SharePoint, Google Drive, local drives) and how much there is;
• the tools that depend on your Microsoft or Google account: single sign-on to other software, accounting software, telephony;
• "critical" files: spreadsheets with macros, templates, documents exchanged with clients.

This is also the time to check that your domain name is registered in your name: it is what makes it possible to move your e-mail without changing addresses.

Months 3-5: files first

File storage is often the easiest to move, and it holds a good share of your sensitive data. Watch out, though, for access rights and sharing links, which must be recreated. Nextcloud, of German origin and open source, offers sharing, synchronisation and mobile access. It can be hosted by a European provider or on your own server.

Self-hosting is only a good idea if someone takes care of updates, security and backups. A migration is not finished until the backup of the new system has been tested: see our article Protecting your data.

Months 6-8: e-mail

This is the trickiest step, because everyone uses it all the time. Points to watch:

• migrate the archives (old e-mails, contacts, shared calendars), not just new messages;
• check and adjust the DNS records (MX, SPF, DKIM, DMARC): when they are wrong, your e-mails often end up in spam;
• schedule the switch on a Friday evening and warn the team;
• keep the old account read-only for a few weeks.

Months 9-11: office suite

LibreOffice opens and saves Word, Excel and PowerPoint files. For simple documents, the difference is barely noticeable. The difficulties come from Excel spreadsheets with VBA macros and complex layouts exchanged with clients. That is often where it makes sense to keep a few Microsoft licences for the workstations that really need them.

Even Schleswig-Holstein keeps about 20% of its workstations on Microsoft Office for business procedures that still depend on it.

Month 12: video, chat and review

Jitsi Meet or Nextcloud Talk for meetings, Element (Matrix messaging) for team chat: together they replace most of Teams. Then take stock: real costs, problems encountered, what remains to be migrated or kept.

What it really costs

Licence costs partly disappear, but other costs appear: hosting, migration, training and support. Schleswig-Holstein reports more than 15 million euros saved on licences, against 9 million euros invested in migration and development in 2026. For an SME, the main argument is not always savings: it is control over your data and the freedom to change provider.

Pitfalls to avoid

• Migrating everything at once: one step at a time, starting with what hurts least.
• Forgetting training: a tool that confuses the team will be bypassed, often through an uncontrolled free account.
• Confusing location and jurisdiction: data hosted in Europe by a US company may remain accessible to US authorities, on top of the GDPR.
• Swapping one dependency for another: make sure your data can still be exported in open formats.

Test yourself

At ExsIT

We take stock, propose a plan suited to your size, migrate files and e-mail, and train your teams. We can also install and maintain your Nextcloud, with a European host or on your own server, backups included.

Information as of October 2026.

Sources

Born, G. (2025, December 8). Schleswig-Holstein: Schon 80 % der Arbeitsplätze auf LibreOffice umgestellt (in German). Borns IT- und Windows-Blog. https://borncity.com/blog/2025/12/08/schleswig-holstein-schon-80-der-arbeitsplaetze-auf-libreoffice-umgestellt/

Capgemini. (2026, September 8). Most organizations say full digital sovereignty is an unrealistic goal as businesses prioritize resilience over total independence [Press release]. https://www.capgemini.com/at-de/news/press-releases/most-organizations-say-full-digital-sovereignty-is-an-unrealistic-goal-as-businesses-prioritize-resilience-over-total-independence/

Computing. (2025, October 31). International Criminal Court drops Microsoft for open source. https://www.computing.co.uk/news/2025/open-source/international-criminal-court-drops-microsoft

U.S. Department of Justice. (n.d.). CLOUD Act resources. https://www.justice.gov/criminal/cloud-act-resources

WilmerHale. (2025, December 1). European Court of Justice to review challenge to EU-U.S. Data Privacy Framework. https://www.wilmerhale.com/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework