Does Microsoft 365 have a GDPR Data Processing Agreement?

Yes — a Data Processing Agreement is available at https://aka.ms/DPA.

Where does Microsoft 365 store data?

Microsoft 365 stores data in: EU (optional).

Is Microsoft 365 ISO 27001 certified?

Yes — ISO 27001 is listed among Microsoft 365's certifications.

EU Compliance Profile

Microsoft 365

HQ: US

EU (optional)

Sovereignty score

out of 100

Last verified: 1 May 2026

Track this vendor

Data Processing Agreement

Data Processing Agreement availableView DPA

Sub-processors

Microsoft affiliatesLinkedIn

Certifications

ISO 27001ISO 27018SOC 2FedRAMP

Looking for EU-hosted alternatives?

Explore vendors with verified EU data residency to reduce Cloud Act exposure and simplify GDPR compliance.

Browse EU-resident vendors →

Missing a vendor from your stack?

Request a compliance page and we'll research and add it.

Sub-processor Changelog

No sub-processor changes recorded yet.

Embed this vendor cardFree

Add Microsoft 365's EU compliance card to your own site or internal wiki. Updates automatically when data changes.

<iframe
  src="https://eurocomply.app/embed/vendor-card?slug=microsoft-365"
  width="320" height="160"
  frameborder="0" scrolling="no"
  title="Microsoft 365 EU Compliance Card"
  style="border:none;border-radius:8px">
</iframe>

Track Microsoft 365

Monitor Microsoft 365 for DPA updates, sub-processor changes, and renewal deadlines. Get notified when something material changes — before it becomes a compliance issue.

Start tracking for free