Microsoft Copilot Studio and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No by default. Microsoft says customer data is not used to train or improve Microsoft AI models or third-party models (such as OpenAI's), unless the tenant admin opts in to data sharing (off by default; US tenants only at time of reading).

Vendor's wording: “Are NOT used to train or improve Microsoft AI models, unless your tenant admin opts in to sharing data with us.”

Source: learn.microsoft.comFAQ for Copilot data security and privacy in Power Platform, "What happens to my data when I use Copilot?"Checked on 19 October 2026

In the Microsoft Azure region (geography) chosen for the customer's tenant and environments; if a tenant's location is not in Microsoft's table, data is stored in the United States.

Vendor's wording: “If a tenant's location isn't listed in the data locations table, data is stored in the United States.”

Source: learn.microsoft.comData locations in Copilot Studio, 'Data locations' sectionChecked on 19 October 2026

EU hosting available.

Yes. Choose an environment region inside the EU Data Boundary; a tenant with an EU or EFTA billing address is in scope when all its environments are in an EU region.

Vendor's wording: “if a customer provisions a tenant with a billing address in the EU or EFTA, that tenant will be in-scope for the EU Data Boundary if the customer also creates all of its environments within a geographic region inside the EU Data Boundary.”

Source: learn.microsoft.comGeographic data residency, 'EU Data Boundary (EUDB) compliance'Checked on 19 October 2026

DPA on request.

Yes. Copilot Studio is a Power Platform Core Service, so Microsoft's standard Data Protection Addendum applies automatically as part of the Product Terms when you subscribe.

Vendor's wording: “When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA).”

Source: microsoft.comMicrosoft Products and Services DPA page, introductionChecked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

Agent conversation transcripts are kept in Copilot Studio storage for up to 28 days then deleted automatically; the Dataverse copy is cleared by a job after 30 days by default, and the customer can change that period.

Vendor's wording: “Transcript data is retained in Copilot Studio storage for up to 28 days to support proper agent functionality and is automatically deleted after this period.”

Source: learn.microsoft.comConversation transcripts, retention notesChecked on 19 October 2026

12 frameworks named, including SOC audits and 7 ISO standards (ISO 9001, 20000-1, 22301, 27001, 27017, 27018, 27701), plus HIPAA, HITRUST, FedRAMP, PCI DSS, CSA STAR, UK G-Cloud, OSPAR, K-ISMS, MTCS Level 3, Spain ENS High.

Vendor's wording: “Microsoft Copilot Studio is compliant with the ISO standards listed in the following table.”

Source: learn.microsoft.comCopilot Studio compliance overview, 'ISO compliance' and list of standardsChecked on 19 October 2026

Yes. Admins set data policies in the Power Platform admin center that govern the use and availability of Copilot Studio features and agent capabilities, such as knowledge sources, connectors, actions and publication channels.

Vendor's wording: “Admins can use data policies in the Power Platform admin center to govern the use and availability of Copilot Studio features and agent capabilities, including:”

Source: learn.microsoft.comSecurity and governance, data policies sectionChecked on 19 October 2026

€173.30 / mo.

EUR 173.30 per pack per month, each pack covering 25,000 Copilot Credits, tenant-wide. A pay-as-you-go option has no upfront commitment (per-credit rate not shown). VAT not stated for this product.

Vendor's wording: “With Copilot Credit packs, a customer pays up front (€173.30/pack/month for 25,000 Copilot Credits).”

Source: microsoft.comCopilot Studio plans and pricing, 'How credits work' FAQChecked on 19 October 2026