Services · Special service · Professional secrecy
Client and patient data demand particular care. Anyone who wants to use Microsoft 365, Microsoft Copilot or Azure OpenAI has to bring contractual documents, access rights and the actual data processing together. arades supports law firms and medical practices as well as the software vendors and IT service providers working for them — technically and organisationally, with a clear separation between technical review and legal assessment.
Two entry points
Persons bound by professional secrecy and their service providers ask different questions. Both routes lead to the same technical foundation: which information goes where, who is allowed to access it, and which documents evidence that?
You want to use modern tools and to understand which information goes where and who is allowed to access it. We classify your existing Microsoft services, make technical gaps visible and plan the next step. We involve your internal IT and your data protection or legal advisers as needed.
Your application processes information on behalf of persons bound by professional secrecy. We help you structure data paths, resources, permissions and operational requirements and prepare Microsoft procedures. That lets you explain to your customers more precisely how your solution works and which evidence exists.
Our approach also addresses tax advisers, auditors, notaries, psychotherapists and further professions with special duties of confidentiality. Which requirements apply depends on the activity, the country and the specific processing, and is considered separately for each set of professional rules.
Legal framework · Germany
The following paragraphs name the framework within which the technical work takes place. They are a classification for the conversation, not a legal assessment of your project.
Professional secrecy (§ 203 StGB). § 203 of the German Criminal Code (Strafgesetzbuch) makes the violation of private secrets a criminal offence and names the professions concerned — among them physicians, lawyers, tax advisers, notaries and psychotherapists. The provision applies in Germany. It is not a Europe-wide rule, and it does not approve any product.
Other contributing persons — “sonstige mitwirkende Personen” (§ 203 (3) StGB). The use of external service providers is expressly addressed in § 203 (3) StGB. In substance, not verbatim: persons bound by professional secrecy may disclose third-party secrets to other persons who contribute to their activity, to the extent that this is necessary in order to make use of the activity of those contributing persons. “Soweit” — to the extent that — limits the scope; it is not a condition. The provision grants no blanket permission; it permits disclosure exactly as far as making use of that activity requires. What is necessary in an individual case is assessed by your legal advisers — we make technically visible which data a service actually sees.
§ 43e BRAO. For lawyers, § 43e of the German Federal Lawyers' Act (Bundesrechtsanwaltsordnung) sets out particular requirements for making use of services, for selecting the service providers and for the contractual obligations involved. That provision applies to the legal profession. It is not transferred unchecked to physicians, to other professions or to other countries.
Processing by a processor (Art. 28 GDPR). Processing by a processor is a legal concept of data protection law. It governs the relationship between controller and processor and does not answer the question arising from professional rules. Professional secrecy and data protection are two examinations side by side, not one.
Microsoft amendments. For certain regions and purchasing routes, Microsoft provides amendments that address the protection of secrets. Which version applies to your purchasing route, whether it has been accepted and which scope it covers is something we examine on the actual contract. An amendment replaces neither a suitable configuration nor the examination of further parties involved.
arades provides technical and organisational services. We give no legal advice, grant no clearance under professional rules, and we do not certify that you are legally compliant. The legal assessment is made by the appropriate professionals — we supply the technical facts on which that assessment can rest.
Our services
The building blocks can be commissioned individually. Each delivers a self-contained result that retains value even if the next block is postponed. Scope, effort and responsibilities are agreed in writing beforehand.
Which Microsoft and AI services do you already use, which data do you process with them, which documents and responsibilities exist? We bring the technical and organisational information together and prioritise the next steps by risk and effort.
Your result: an understandable inventory with a prioritised list of gaps, explicitly named open legal questions and a recommendation on how to proceed. No blanket compliance certificate.
We review the existing tenant and the licence requirement, obtain the Microsoft documents needed for your purchasing route and document the applicable amendment with its version, acceptance and term. Where purchasing is indirect, certain contract documents are provided via the upstream contracting partner. Obligations of your IT partner are handled separately.
Your result: a traceable state of documents and responsibilities with clearly assigned next steps. You coordinate the legal assessment with your responsible advisers.
A purchasing route does not answer who can administer or read content. Within the commissioned scope we examine the partner relationship, delegated administration rights, Azure roles, guest sharing and application permissions, and plan measures for the minimum necessary rights.
Your result: a role overview of the access paths examined, concrete changes and documented evidence. What is examined is what was commissioned — not automatically every conceivable access path.
Model, deployment type, region or data zone, data flows, storage features, monitoring and application logs are considered separately. Where Modified Abuse Monitoring is relevant to your project, we clarify the prerequisites and the application route and accompany preparation and follow-up. We track quota and capacity as a separate matter.
Your result: an architecture and data-flow overview, structured application documents and a traceable approval status. Microsoft decides on applications and capacity; neither an approval nor a date can be promised.
Classifying documents, opening up internal knowledge or preparing communication: we delimit a pilot case, define data sources, permissions, data minimisation, deletion and human review of results, and accompany the agreed implementation through to handover into operations.
Your result: a clearly defined use case with technical checks, usage rules, responsibilities and handover. We commit only to what a named implementation team can deliver.
Decision support
Not every project needs an application of its own. These four routes are usually available; which one fits depends on the task, the data path and a defensible operating effort.
Can fit if it already covers the required task well and if its contractual, data and operating conditions match your requirements. We support the selection factually and delimit the remaining integration and operating effort.
Can fit if the work takes place predominantly in your Microsoft environment. Among the aspects to consider are permissions, the knowledge sources connected and additional features beyond the base scope.
Can fit if you need to shape the data flow and the integration deliberately. It brings additional architecture and operating responsibility — and with it the responsibility to master logging and storage features yourself.
Can make sense if requirements cannot be met appropriately with an intended cloud service. We include such alternatives in the architecture decision without presenting them as a standard offering of ours.
How we work together
Open legal assessments and missing vendor confirmations are named, not smoothed over. That is the difference between a project status and a feeling.
You describe your profession, your country, the existing environment and the intended use. For the first contact we need neither client files nor patient information.
We record technical data paths, existing documents and access. Whatever is open appears as an open point in the document — with a responsibility and a next step.
You receive a delimited scope of services with results, responsibilities and effort. Necessary applications and third-party decisions remain recognisable as such.
We carry out the commissioned measures, document the results and hand the agreed operating information to the named responsible party.
Where we work
We offer advisory and technical support to organisations in Europe. We consider professional secrecy and data protection on the basis of your country, your profession and your specific application. German rules such as § 203 StGB and § 43e BRAO do not form a uniform European legal framework; translating a German provision is no clearance for another country.
Which Microsoft contract options and purchasing routes are available is something we check for your location and the intended services. Licence delivery, invoicing and contract version are clarified per customer country before we commit to anything. Switzerland and the United Kingdom are in Europe but are not EU member states and are considered separately.
In which languages we can support a specific project is confirmed before we commit. A website in three languages is no evidence of assured support in every language.
Honest boundaries
Legal assessment. The assessment of your project under professional rules and under data protection law is made by your legal or data protection advisers. We prepare it technically and state what is still missing for it.
Vendor decisions. Microsoft decides on applications, approvals, quota and capacity. We clarify prerequisites, compile documents and follow up on the status — commitments on outcome or date are not part of that.
Clinical expertise and medical devices. We work on infrastructure, data paths and vendor support. Classifying an application under medical device law and assessing it clinically are not part of our scope.
Completeness of an examination. What is examined is the commissioned scope. A role overview of the access paths examined is not a complete tenant audit, and an application that has been submitted is not an approval.
Frequently asked questions
That can only be answered meaningfully for the specific use. Professional rules, data protection, contractual scope and technical processing have to be considered together. We support the technical and organisational preparation and implementation; we give no blanket legal clearance.
Processing by a processor under Art. 28 GDPR answers the data protection side. For Germany, the confidentiality requirements under professional rules have to be considered alongside it; for the legal profession, § 43e BRAO sets out particular duties when making use of services. We bring existing documents and open points together for the responsible legal review.
We do not assume such blanket coverage. The contract version, the specific service and additional features are examined individually. An amendment also replaces neither a suitable configuration nor the examination of further parties involved.
According to the Microsoft documentation, for cases approved accordingly the storage of prompts and completions described there and the human content review for abuse monitoring do not apply. Automated checks may continue to take place. Other storage features of the service and the logging of your own application have to be considered separately.
No. We clarify the prerequisites, prepare the documents and follow up on the status. Microsoft decides on the approval. We handle additional capacity and quota applications as a separate matter.
First we review the existing environment and possible purchasing and integration routes. Whether changes or a move are necessary depends on the actual contract and the technical starting point — not on a matter of principle.
No. Which access is needed is clarified for the specific service. Licence purchasing and administrative permissions are different questions; roles, application permissions and actual access options are considered separately, and we document what has been set up.
Yes. Cooperation with your internal IT or your existing service provider can be part of the agreed approach. We define responsibilities and the access required together and record them in writing.
Yes. We delimit the scope by your project and your need for support, not by the size of the organisation. For small units without IT capacity of their own, the route usually begins with taking stock.
We offer Europe-wide cooperation and check the local requirements as part of it. German provisions and German-language amendments are not readily transferable to other countries; professional rules, health data requirements, contract options and delivery regions are examined separately for each country.
Sources · checked on 24 October 2026
Legal rules and vendor information change. We name the primary sources with the date of checking, so that you can verify the status yourself.
§ 203 StGB — violation of private secrets. Statutory text on the “Gesetze im Internet” portal of the German Federal Ministry of Justice, at www.gesetze-im-internet.de/stgb/__203.html. Documents the German statutory framework and the professions concerned.
§ 43e BRAO — making use of services. Statutory text on the “Gesetze im Internet” portal, at www.gesetze-im-internet.de/brao/__43e.html. Documents the particular German requirements for the legal profession.
Art. 28 GDPR — processor. Regulation (EU) 2016/679, at eur-lex.europa.eu, CELEX 32016R0679. Documents the data protection concept of processing by a processor, not the assessment under professional rules.
Microsoft Partner Center — CSP contract documents. Documentation of the region-specific contract documents and standard amendments. Documents the provisioning route, not universal coverage of all AI services.
Microsoft — data processing and privacy for Azure OpenAI models. Vendor documentation on storage, logging and abuse monitoring. Basis for the statements on Modified Abuse Monitoring.
Microsoft — Abuse Monitoring. Vendor documentation on the application and its prerequisites. Documents the application procedure; no approval or processing deadline can be derived from it.
CCBE — technical guide on the use of AI tools and models by lawyers, 27 March 2026. Guide of the Council of Bars and Law Societies of Europe (PDF). European professional reference; not a legal review of your project.
Related services
Copilot adoption, Copilot Studio, RAG applications — the technical implementation behind the use case.
View →
Purchasing route, contract documents and licence requirement — the basis for building block 02.
View →
Cybersecurity duties with a protected interest of their own — alongside professional secrecy, not instead of it.
View →
Risk classification and evidence for AI applications — a further examination in its own right.
View →
30-min initial call or 45-min architecture conversation
Profession, country, existing environment, desired outcome — that is all we need to start. We discuss with you which technical support makes sense and which points have to be clarified before an implementation. Client files and patient information do not belong in the first contact.
