TL;DR: Germany is moving thousands of government staff off Microsoft and onto open-source software. That story sounds like it belongs to civil servants and IT departments, not to a Gozo restaurant or a small Maltese factory. But the underlying question, who owns the server your business data sits on, applies just as much to a till system or booking app as it does to a government network. Worth five minutes of your time, not a system overhaul.
We wrote about the legal side of this in our guide to data sovereignty for Maltese SMEs. This one is about what it means if your business only ever trades locally.
What Germany Is Actually Doing
The German state of Schleswig-Holstein is moving around 30,000 government workers off Microsoft Office and onto open-source alternatives. Bavaria is doing something similar. This isn’t a trial. It’s a funded, deliberate decision, and the reason behind it is simple: they’d rather control their own data than rely on a foreign company’s servers and terms of service.
You don’t need to follow their example directly. Nobody’s suggesting a Gozo restaurant needs its own IT department or a switch to Linux. What’s worth borrowing is the question they asked themselves, not the answer they landed on.
“We Only Sell Locally” Doesn’t Change Where the Data Sits
This is the bit that catches most small businesses out. It feels like a problem for exporters, multinationals and government suppliers, the kind of business dealing with Brussels or Berlin. If you run a restaurant in Gharb or a small factory supplying other Gozitan businesses, it’s natural to assume none of this touches you.
It does, just not through your customers. It touches you through your software.
Think about what actually runs your business day to day:
- Booking and reservation systems, often built on US cloud platforms.
- Till and point of sale software, which usually stores transaction data with a US-owned provider.
- Cloud accounting, such as QuickBooks or Xero, typically hosted on Amazon or Microsoft infrastructure.
- Staff rotas, payroll and email, commonly running through Google Workspace or Microsoft 365.
None of that has anything to do with who your customers are. A restaurant serving only Gozitan diners can still have every booking, every till transaction and every staff record sitting on a server legally controlled from the United States. Ownership of the software, not the geography of your customer base, is what decides where the exposure sits.
A Worked Example: One Gozo Restaurant, Checked
Take a small restaurant in Gharb. Bookings come through a US-owned reservation platform. The till runs on a point-of-sale system that, underneath its European-sounding brand name, stores transaction data on Amazon’s servers. Payroll goes through a Maltese accountant using cloud software hosted on Microsoft infrastructure. Staff email addresses run through Google Workspace.
None of that is unusual, and none of it is wrong. It’s how most small businesses on the islands are set up, and for day-to-day trading it works fine. But if that restaurant sat down and asked three plain questions, could it export its own booking history and customer list right now, who legally owns each of those four providers, and what would happen to prices or terms if any one of them changed its policy overnight, it would very likely find it doesn’t have ready answers. That’s not a crisis. It’s simply a gap worth closing before it matters.
What to Actually Watch For
None of this means a US-owned provider is doing anything wrong or that you need to migrate off your booking system next week. It means a few practical things are worth checking, in plain terms:
- Can you get your own data out if you need to? If the provider disappeared tomorrow or doubled its price, could you export your bookings, accounts and customer list yourself, or are you stuck?
- Who actually owns the software you use day to day? A lot of small tools marketed as local or European are quietly built on top of Microsoft, Google or Amazon infrastructure underneath.
- What happens if the price changes overnight? Being tied entirely to one foreign-owned provider, for your till, your bookings and your accounts, means you have no leverage if terms or pricing shift.
None of this needs to feel urgent, because for most businesses it genuinely isn’t. But it’s worth doing anyway, for the same reason you’d keep a spare key or a second supplier: not because something’s currently wrong, but because the five minutes it takes to check now is a lot cheaper than the scramble if a provider disappears, gets bought out, or doubles its price with no warning. Businesses that know their own setup have options. Businesses that don’t find out what those options were only after they needed them.
This is really just good business hygiene, the same instinct that makes you keep a backup supplier for stock rather than relying on one, applied to your software instead of your ingredients.
Frequently Asked Questions
I only trade with other Gozitan or Maltese businesses. Does this really apply to me?
Yes, because the exposure comes from your software, not your customers. Where your bookings, till data and payroll are hosted depends on who owns the platform, not who you’re selling to.
Do I need to stop using Microsoft 365 or Google Workspace?
No. For almost every small business here, that would be disproportionate. The useful step is knowing your setup and your options, not switching providers.
Is this actually a legal problem for my business?
Not directly, in most cases. It’s more a practical and commercial question than a compliance one, unless you’re handling particularly sensitive client data, in which case it’s worth a proper look.
What’s the one thing I should check this week?
Whether you can export your own data, bookings, customer list, transaction history, without depending on the provider to do it for you. That’s the single most useful thing to confirm.
Are there Maltese or European alternatives to these tools?
Some, for specific functions like file storage or email. Full local replacements for booking or till systems are limited, which is exactly why knowing your export options matters more than chasing a switch.
Will checking this cost me time or money?
Checking, no, it’s a conversation and a few questions to your providers. Switching, if you ever needed to, could, which is precisely why it’s worth knowing your position before you’re forced into a decision.
A Practical Takeaway
You don’t need Germany’s budget or Germany’s IT department to take the useful lesson from this. The useful lesson is smaller: know what runs your business, know who owns it, and know you could get your own data back if you ever needed to. That’s a sensible check for any business, including restaurants or factories, not a corporate exercise.
If you’d like a straightforward, no-jargon look at what your current setup actually depends on, get in touch and we’ll talk it through.