Högskolan i Skövde

As software as a service (SaaS) adoption increases in both the public and private sectors, so does dependency on specific providers and technologies and the consequent danger of lock-in. This paper reports on how public sector organisations (PSOs) can, and should, avoid lock-in throughout the lifecycle (commissioning, deployment and decommissioning) of their deployment of the Microsoft Office 365 SaaS product (O365). We investigate how 33 PSOs address different lock-in effects, focussing on the City of Gothenburg, and show that none of the PSOs determined possible lock-in effects prior to implementation or were able to provide documented evidence that they would be able to independently access, process and maintain the digital assets processed by the SaaS solution after decommissioning. We also report on jurisdictional and data processing issues, with consequent impact on digital sovereignty.