Directory › AI agent builder › Microsoft Copilot Studio
Is Microsoft Copilot Studio UK GDPR compliant?
In plain English
Copilot Studio can store customer data in the UK (UK South/UK West) when your environment is in the UK geography. Generative AI requests from a UK environment may be processed in the UK or the EU Data Boundary, and Bing web search goes to the US. It is covered by Microsoft's DPA, SOC 2 and ISO 27001 (listed under its former name, Power Virtual Agents).
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | UK region available UK tenants' data is stored in UK South (London) or UK West (Cardiff, Durham). Generative AI for a UK environment runs 'in region or in EU Data Boundary'; Bing search data is processed in the US. | learn.microsoft.com/en-us/microsoft-copilot-studio/data-loca… |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA Microsoft makes the EU Model Clauses available via its Products and Services DPA as a transfer mechanism for data from the EU/EEA, Switzerland and the UK. | learn.microsoft.com/en-us/compliance/regulatory/offering-eu-… |
| SOC 2 | Yes Copilot Studio is listed in scope of Microsoft's SOC 2 offering. | learn.microsoft.com/en-us/compliance/regulatory/offering-soc… |
| ISO 27001 | Yes In scope as 'Power Virtual Agents' (Copilot Studio's former name). | learn.microsoft.com/en-us/compliance/regulatory/offering-iso… |
| Self-hostable | Not published Cloud service only; no self-hosted edition documented. | learn.microsoft.com/en-us/microsoft-copilot-studio/data-loca… |
| Sub-processor list | Public Microsoft publishes an AI sub-processor overview; the full Online Services Subprocessors List is in the Service Trust Portal. View list | learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subp… |
| AI model providers | Azure OpenAI; Microsoft also lists OpenAI and Anthropic as AI sub-processors for Online Services Copilot features use Azure OpenAI; cross-region data movement and Bing are admin-controlled. | learn.microsoft.com/en-us/power-platform/admin/geographical-… |
| Customer data used for training? | No 'We don't use your data to train, retrain, or improve Azure OpenAI Service foundation models.' | learn.microsoft.com/en-us/power-platform/admin/geographical-… |
Questions UK buyers ask
Is Microsoft Copilot Studio UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Microsoft Copilot Studio offers UK data residency; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Yes. AgentSafe UK readiness score: 90/100 (Strong).
Does Microsoft Copilot Studio store data in the UK?
UK tenants' data is stored in UK South (London) or UK West (Cardiff, Durham). Generative AI for a UK environment runs 'in region or in EU Data Boundary'; Bing search data is processed in the US.
Does Microsoft Copilot Studio use my data to train AI models?
'We don't use your data to train, retrain, or improve Azure OpenAI Service foundation models.'
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.