Directory › RPA and agentic automation › UiPath
Is UiPath UK GDPR compliant?
In plain English
UiPath Automation Cloud has had a UK region on Microsoft Azure since June 2024, and the software can also run on your own infrastructure. It holds SOC 2 Type II, ISO 27001 and ISO 42001. Free and Community organisations are stored in the EU, while paid plans can choose their region.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | UK region available UK is an Automation Cloud region (GA on Azure, June 2024). Free/Community organisations are stored in EU community data centres; Pro trial, Pro and Enterprise use the region chosen at creation. | docs.uipath.com/automation-cloud/automation-cloud/latest/adm… |
| DPA and UK GDPR transfer terms | DPA, UK not explicit A cloud DPA is published. The privacy page names SCCs and the DPF (for EEA, UK or Swiss transfers to the US); we could not confirm UK Addendum wording. | www.uipath.com/legal/trust-and-security/privacy |
| SOC 2 | Yes SOC 2 Type II. | www.uipath.com/legal/trust-and-security/privacy |
| ISO 27001 | Yes ISO/IEC 27001 (and ISO/IEC 42001). | www.uipath.com/legal/trust-and-security/privacy |
| Self-hostable | Yes UiPath offers on-premises software in addition to Automation Cloud. | www.uipath.com/legal/trust-and-security/privacy |
| Sub-processor list | Public Downloadable sub-processor list linked from the privacy page. View list | www.uipath.com/legal/trust-and-security/privacy |
| AI model providers | Azure OpenAI, Anthropic Claude, Google Gemini (also Amazon Bedrock) Third-party generative AI supported by Automation Cloud. | www.uipath.com/legal/trust-and-security/privacy |
| Customer data used for training? | Partly / conditional 'Our contracts with the third parties providing the models restrict the usage of data for training those models.' No wider statement on UiPath's own use was found. | www.uipath.com/legal/trust-and-security/privacy |
Questions UK buyers ask
Is UiPath UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, UiPath offers UK data residency; its DPA status is "DPA, UK not explicit"; SOC 2: Yes; ISO 27001: Yes. AgentSafe UK readiness score: 79/100 (Good).
Does UiPath store data in the UK?
UK is an Automation Cloud region (GA on Azure, June 2024). Free/Community organisations are stored in EU community data centres; Pro trial, Pro and Enterprise use the region chosen at creation.
Does UiPath use my data to train AI models?
'Our contracts with the third parties providing the models restrict the usage of data for training those models.' No wider statement on UiPath's own use was found.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.