Well, for once you need a commissioned data processing contract with Microsoft to let Microsoft (a third party) process your users private data. And probably a case-by-case study as Office365/Teams/... consists of a wide variety of different services and products and has lots of configurable options as well. And then we had the Datenschutzkonferenz come to the conclusion Office365 is not allowed in 2022. Then a big debate. The EU and several German states and different institutions doing reviews and coming to different conclusions. And the law concerning data safe harbour / EU data boundary got updated. But then we have 2025 now and the situation in the US changes daily. On the upside I believe they've all renewed the Data Privacy Framework certifications so it's legally possible to use the services. But I don't think the debate is entirely solved and over yet. And you'll get some 50+ pages PDF instructions on how to configure your company/organization's cloud office to be in line.

I suppose it's similar for Google? But I see less professional use of their cloud services, I believe it's more popular with smaller organizations and individuals. Honestly I don't know much about that one, I've never considered Google for data that need protection, as that company is one of the largest data leeches on earth.

In any case OP needs to qualify for their NGO programs, as both Google and Microsoft cost about $1,000 a year for like 15 people and that's well above their weight. And I think GDPR compliance and commissioned data processing is a business feature, that's not in your average private Google account.