What are the data residency/privacy rules for using Open AI models with Azure?

Question

What are the data residency/privacy rules for using Open AI models with Azure?

Maxime Kaufman 20

I want to use Open AI LLM(s) API for University research, and I have strict data residency/privacy requirements. I would like to know if: 1) I can set data residency/processing to ONLY EU based servers. 2) What control I have of the data processing by Microsoft. I understand that the prompt/response data are not sent to Open AI, but how are they used by Microsoft, and what control do I have over how it is used?

Thank you.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Can you restrict processing to EU‑based servers only?

OpenAI now lets eligible API customers create new Projects with European data residency. Requests sent through these EU Projects are processed in‑region and not stored at rest on OpenAI servers. For details, refer to https://learn.microsoft.com/en-us/answers/questions/2262985/azure-openai-service-in-europe

What control do you have over Microsoft’s data processing?

When using Azure OpenAI Service, Microsoft provides:

Geographic control: Choose regional or Data Zone deployment within the EU so that all input/output and logs never leave the EU (more at https://learn.microsoft.com/en-us/answers/questions/2262985/azure-openai-service-in-europe)
Data isolation: Prompts and completions are not shared with OpenAI, are not used to train Microsoft’s or OpenAI’s base models, and remain private to your tenant.
Abuse monitoring: Automated AI reviewing may occur in-region, with optional human review—also restricted to EU personnel when the tenant is EU-based. There's an option to disable logging/storage of abusive prompts entirely with approval.
Customer-managed keys and deletion: You can use Azure’s customer‑managed encryption keys and delete any stored data at any time

More at more at https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy

How are the prompt/response data used by Microsoft?

Here is how Azure handles your data:

Data Use Case	Description
Service provision	Processes prompts/responses only to generate outputs.
Content/security filtering	Real-time filters run in-region to catch harmful or policy‑violating content
Abuse monitoring	Samples flagged inputs/outputs can undergo human review—EU-based if your deployment is within the EU . You can apply to disable this entirely. \|
No model training	Microsoft does not use your data for training its models or any third-party models .
Data storage	Stored only if you use features like Threads, embeddings, or uploaded files—and always in the region you choose .

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin