If the business is based in the UK/EU and the MS server is based in the USA or outside the GDPR jurisdiction, there could be legal issues for the company, of course the MS EULA probably has some Claus to say MS are not responsible. Leaving the company at risk of criminal prosecution and potential civil action.