Dynamics 365 Sales and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Microsoft says its AI models are not trained on your tenant data or prompts unless your tenant admin opts in to data sharing (off by default).

Vendor's wording: “Microsoft AI models are not trained on and don't learn from your tenant data or your prompts, unless your tenant admin has opted in to sharing data with us.”

Source: learn.microsoft.comArchitected to protect your data at both the tenant and the environment levelChecked on 19 October 2026

Set by the region where your Dynamics 365 environment is hosted; no single default. For Copilot AI features, a European environment uses Azure OpenAI hosted inside the EU Data Boundary.

Vendor's wording: “Europe** In European Union (EU) Data Boundary United States”

Source: learn.microsoft.comRegions where data is processed for Copilots and generative AI features (table)Checked on 19 October 2026

EU hosting available.

Yes. Host the environment in a European region; Copilot AI then runs in the EU Data Boundary. If you allow cross-region data movement, prompts and results may leave your region.

Vendor's wording: “When you allow data movement across regions, your inputs (prompts) and outputs (results) might move outside of your region to the location where the generative AI feature is hosted.”

Source: learn.microsoft.comMove data across regions for Copilots (intro and table)Checked on 19 October 2026

DPA on request.

Yes. The Microsoft Products and Services DPA applies automatically to subscriptions under the Product Terms; no separate signing is described.

Vendor's wording: “When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA).”

Source: microsoft.comDPA landing page, first paragraphChecked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

After a subscription ends, Microsoft keeps your data 90 days in a limited-function account for you to export it, then deletes it within a further 90 days. Copilot prompts and answers are not stored for abuse monitoring.

Vendor's wording: “Microsoft will store your customer data in a limited-function account for 90 days”

Source: microsoft.comData deletion / retention period after terminationChecked on 19 October 2026

At least 5 named for Dynamics 365: ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701, SOC 2 Type 2 and Germany C5. Microsoft lists more attestations elsewhere.

Vendor's wording: “Microsoft Dynamics 365, Dynamics 365 Government, and Dynamics 365 Germany”

Source: learn.microsoft.comIn-scope cloud platforms and servicesChecked on 19 October 2026

Yes. A Power Platform admin turns Copilot in Dynamics 365 Sales on or off in the Power Platform admin center, and controls whether data may move across regions for AI features.

Vendor's wording: “Make sure that your Power Platform administrator has turned on Copilot in Dynamics 365 Sales in Power Platform Admin Center.”

Source: learn.microsoft.comPrerequisitesChecked on 19 October 2026

€56.30 / user / mo.

€56.30 per user/month, paid yearly, excluding VAT (Dynamics 365 Sales Professional).

Vendor's wording: “€56.30 user/month, paid yearly Price does not include VAT.”

Source: microsoft.comDynamics 365 Sales plans, Professional cardChecked on 19 October 2026