On July 16, 2026, the Dutch education and research IT cooperative SURF and the privacy and data-protection consultancy Privacy Company published the results of a joint Data Protection Impact Assessment (DPIA) for self-hosted Nextcloud Enterprise. The DPIA initially identified 15 data protection risks, for which Nextcloud promptly implemented mitigations. For users of Nextcloud Office, the DPIA makes a distinction between the available office suites. Implications for enterprise buyersThe responsibility to ensure data privacy doesn’t end with the vendor. For a market where most vendors’ privacy claims go untested, the DPIA gives Nextcloud a documented account from an independent party, including what it found and what changed as a result.