Is Business Central GDPR-compliant, and where does the data live?

Business Central can be run in a GDPR-compliant way. The decisive part is not the platform, but how you set up permissions, data flows and AI in the project. Where the data lives is settled, the responsibility for the configuration stays with you.

Where does your data reside?

Business Central Online runs in the Microsoft cloud. For customers with an EU tenant region, Microsoft stores the core data in data centres inside the EU and assigns the service to the EU Data Boundary. In normal operation, your productive business data therefore does not leave the European area.

Source: Microsoft Learn: What is the EU Data Boundary?

The qualifier "in normal operation" matters. There are defined exceptions, certain support scenarios for instance, in which data can leave the area. You should know those exceptions and have them documented rather than assume them, because in an audit nobody asks about the rule, they ask about the exceptions.

In practice that means: check the region when the environment is created, record which region was chosen, and know who could change it later. It is a decision of a few minutes with an effect across years.

Who is responsible for what?

Microsoft is the processor, you remain the controller in the sense of the GDPR. That division of roles is not negotiable and has an uncomfortable consequence: the platform can be fully compliant and your own system still not be.

Source: Microsoft Learn: General Data Protection Regulation

The basis is the data processing agreement that Microsoft provides through its online terms. The platform brings the technical and organisational measures with it. Whether your system ends up compliant, however, is decided by how you set it up: which roles see which data, how long documents are retained, which interfaces pass data outwards.

These three points are project work and not a setting you make once. They belong in the implementation, not in a review months after go-live when the structures have long since grown.

Which part will no data centre take off your hands?

The most common gap in mid-sized companies is not where the data sits but the permission structure that has grown over the years. If in practice everyone sees everything, an EU data centre helps little, because the GDPR asks about purpose limitation and data minimisation and not about geography.

Source: Microsoft Learn: Security in Business Central

Data minimisation, clean roles and a deliberate approach to personal data fields are therefore the real effort. The usual starting point is a handful of broad roles that have grown by individual permissions over the years, until nobody can say precisely why who is allowed to see what.

This is exactly where we start: we set up permissions, retention and data flows so that control stays with you. The test for it is simple: can you say, for any given role, within two minutes which personal data it sees?

How do AI and Copilot look from a GDPR perspective?

Copilot and AI agents work on your business data. For the EU the same regional boundaries apply as for Business Central itself, and Microsoft does not use your business data to train its foundation models.

Source: Microsoft Learn: Copilot FAQ

What matters is that you clarify, before switching it on, which data an agent may see and change. That control is provided for and documented, but it has to be set deliberately, otherwise the preconfigured default scope applies, and nobody chose that one on purpose.

Source: Microsoft Learn: Configure Copilot and agent capabilities

The substance stays the same as without AI: an unclean data foundation does not get better through an agent, only effective faster, and in both directions. AI sharpens an unclean data foundation, it does not heal it. This article puts the practice in order and does not replace legal advice.