This is the key sentence but it's not clear to me how to parse it:

"The EDPS has therefore decided to order the Commission, effective on 9 December 2024, to suspend all data flows resulting from its use of Microsoft 365 to Microsoft and to its affiliates and sub-processors located in countries outside the EU/EEA not covered by an adequacy decision."

Does it mean suspend flows to Microsoft anywhere and to its affilietes and sub-processors outside EEA?

Or does it mean suspend flows to (Microsoft and to its affilietes and sub-processors) which are located outside EEA?

In other words can data still flow to Microsoft within EEA?