Microsoft Power Automate and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No for the Copilot AI features: Microsoft says customer data is not used to train Microsoft AI models unless the tenant admin opts in to optional data sharing, which is off by default.

Vendor's wording: “Are NOT used to train or improve Microsoft AI models, unless your tenant admin opts in to sharing data with us.”

Source: learn.microsoft.comWhat happens to my data when I use Copilot? / How does Copilot use my data?Checked on 19 October 2026

In the geography set as the tenant's default location when the organisation is created; environments can be placed in a chosen geo, and data stays inside the geo apart from stated exceptions.

Vendor's wording: “When your organization establishes a tenant, it establishes the default geographical (geo) location.”

Source: learn.microsoft.comData locationChecked on 19 October 2026

EU hosting available.

Yes. When creating an environment you choose the region; an environment created in the EU and EFTA runs in European data centres and keeps data inside EU Data Boundary regions.

Vendor's wording: “if your environment is created in the European Union (EU) and European Free Trade Association (EFTA), then your app is deployed in European data centers.”

Source: learn.microsoft.comHow do I find out where my app is deployed?Checked on 19 October 2026

DPA in the terms.

Yes. Data processing terms for the plan sit in Microsoft's Products and Services Data Protection Addendum, which is an addendum to the Product Terms that apply when you subscribe.

Vendor's wording: “the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA).”

Source: microsoft.comMicrosoft Products and Services Data Protection Addendum (DPA)Checked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

Cloud flow run history is kept 30 days in storage, counted from the run's start time. A period for deletion after cancellation was not found on the pages read.

Vendor's wording: “Run retention in storage 30 days Run retention is calculated using a run's start time.”

Source: learn.microsoft.comDuration and retention limitsChecked on 19 October 2026

Power Automate is listed as an in-scope service for 3 ISO standards on Microsoft's compliance pages: ISO/IEC 27001, 27018 and 27701. A SOC report was not confirmed on a page that could be read.

Vendor's wording: “Power Automate cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite”

Source: learn.microsoft.comMicrosoft in-scope cloud platforms and servicesChecked on 19 October 2026

€13.00 / user / mo.

EUR 13.00 per user per month, paid yearly. The page states the price does not include VAT.

Vendor's wording: “Power Automate Premium €13.00 user/month, paid yearly Price does not include VAT.”

Source: microsoft.comPower Automate Premium card (Ireland site)Checked on 19 October 2026