Directory › Workflow automation › Microsoft Power Automate
Is Microsoft Power Automate UK GDPR compliant?
In plain English
Power Automate cloud flows run in your Power Platform environment's region, and the UK geography offers UK South, UK West and UK East. It is covered by Microsoft's DPA and is in scope for SOC 2 and ISO 27001. Copilot features are on by default in UK regions unless an admin turns them off.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | UK region available Environments can be created in the United Kingdom geography (UK South, UK West, UK East); cloud flows are deployed in that region. | learn.microsoft.com/en-us/power-automate/regions-overview |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA EU Model Clauses in Microsoft's DPA cover transfers from the UK; Power Automate is in scope. | learn.microsoft.com/en-us/compliance/regulatory/offering-eu-… |
| SOC 2 | Yes Listed in scope of Microsoft's SOC 2 offering. | learn.microsoft.com/en-us/compliance/regulatory/offering-soc… |
| ISO 27001 | Yes Power Automate cloud service is in scope of Microsoft's ISO/IEC 27001 certification. | learn.microsoft.com/en-us/compliance/regulatory/offering-iso… |
| Self-hostable | Not published Cloud flows are a Microsoft-hosted service; no self-hosted edition is documented. | learn.microsoft.com/en-us/power-automate/regions-overview |
| Sub-processor list | Public Microsoft AI sub-processor overview; full list in the Service Trust Portal. View list | learn.microsoft.com/en-us/microsoft-365/copilot/copilot-subp… |
| AI model providers | Azure OpenAI (Copilot in Power Automate) Copilot is enabled by default in regions with Copilot GPUs, including the United Kingdom, unless an admin turns it off. | learn.microsoft.com/en-us/power-automate/regions-overview |
| Customer data used for training? | No Microsoft does not use your data to train Azure OpenAI foundation models. | learn.microsoft.com/en-us/power-platform/admin/geographical-… |
Questions UK buyers ask
Is Microsoft Power Automate UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Microsoft Power Automate offers UK data residency; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Yes. AgentSafe UK readiness score: 90/100 (Strong).
Does Microsoft Power Automate store data in the UK?
Environments can be created in the United Kingdom geography (UK South, UK West, UK East); cloud flows are deployed in that region.
Does Microsoft Power Automate use my data to train AI models?
Microsoft does not use your data to train Azure OpenAI foundation models.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.