PremiumIT PRO6 min read
EU Data Boundary: understanding Microsoft's commitment
The EU Data Boundary is Microsoft's initiative to frame the storage and processing of data for in-scope cloud services within the European Union and EFTA. Here's what the commitment really covers, its limits and what IT should check.
✅ How to
- 1What is the EU Data Boundary?
The EU Data Boundary, or EUDB, is a Microsoft initiative. For in-scope enterprise cloud services, Microsoft commits to store and process Customer Data and personal data within a geographic boundary made up of the European Union and EFTA.
The illustration below sums up the principle: a geographic boundary, residency commitments and documented exceptions.
- 2Which countries are included?
The boundary covers the 27 European Union countries plus the EFTA countries: Iceland, Liechtenstein, Norway and Switzerland. Microsoft uses or may use datacenters in these countries for in-scope services.
It is not one single « Europe » datacenter: the scope is a geographic area and depends on each service's configuration.
- 3Which services and data are covered?
The commitment covers services including Azure, Dynamics 365, Power Platform and Microsoft 365, according to the scope defined in the Product Terms. Customer Data is data provided to Microsoft by or on behalf of the customer through the service.
For Microsoft's professional services, Professional Services Data is stored at rest within the boundary. Technical configuration information, such as some resource names, is not Customer Data.
- 4A Microsoft commitment for in-scope services
The EUDB reflects Microsoft's commitment to keep data stored and processed within the European boundary for in-scope services. Microsoft's documentation describes the scope of this commitment and gives organizations a clear way to review the services and configurations that apply to them.
The key point: the EUDB is a Microsoft initiative that supports data residency and governance choices; it is not a mandatory standard that every organization must apply in exactly the same way.
- 5System logs are handled separately
Cloud services generate logs for security, reliability and operations. Personal data in system-generated logs must be pseudonymized, using techniques such as encryption, masking, tokenization or blurring.
Pseudonymization protects identity while allowing authorized teams to analyze incidents and service quality. Minimization, retention and access controls complete the framework.
- 6How IT should assess the scope
For Microsoft 365, a customer whose sign-up location is in the EU or EFTA is in scope for the EUDB. Important: customers with Multi-Geo Capabilities are not in scope for the EUDB, even if their tenant is listed in an EU or EFTA country.
For Azure, check the deployment region and service status because regional and non-regional services have different conditions. For Dynamics 365 and Power Platform, tenant geography, environments and billing address must align.
- 7What this means for Copilot and Cowork
Geography alone is not enough: you must also consider the model and provider processing the request. A Microsoft-operated model and a model delivered by a Microsoft subprocessor do not necessarily have identical commitments.
Before enabling an AI capability, check the provider, region, Product Terms, DPA and applicable EUDB exceptions. That combination is what supports a sound governance decision.
- 8The right reflex
The EUDB is a documented residency and processing commitment, not just a marketing label or a universal guarantee disconnected from the service being used.
Keep an evidence pack with the tenant country, service regions, enabled models, Microsoft 365 admin center settings and documented exceptions. This makes AI decisions understandable and auditable.
The EU Data Boundary is a Microsoft initiative that helps organizations frame their data residency and governance choices. It applies to the services and data covered by Microsoft's commitments; consult the official documentation to understand the scope that applies to you.
📚 Official sources
💬 Comments
No comments yet. Be the first!
✨ Discover more
PremiumUse GPT models in Cowork without enabling Anthropic
Haven't enabled Anthropic for GDPR or governance reasons? Cowork remains fully usable with GPT models. Enable OpenAI as a Microsoft subprocessor to surface GPT 5.5 and GPT 5.6, then let users work with a GPT-centered configuration.
PremiumMicrosoft Copilot: a new name, a new icon, one single app
The Microsoft 365 Copilot app is becoming Microsoft Copilot, with an updated icon. The goal: one single app for work and personal use. Here's what's changing, what you don't need to do, and what IT should watch to keep the transition smooth.
PremiumThe Frontier program: early access to Microsoft Copilot
Frontier is your door to the next Copilot features, ahead of everyone else. Here's a clear rundown of this early-access program: what it is, who it's for, how IT turns it on (with screenshots), how to spot a Frontier feature with real examples, its benefits and its caveats.