--- title: "Azure OpenAI GDPR: Yes — With Microsoft DPA and German Regions" description: "Yes — with the Microsoft DPA signed and EU residency in Germany North or West Central. Your data is not used for training; check AI Act class and works council." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/azure-openai/" language: "en" --- ![Azure OpenAI GDPR compliance and EU data residency for Germany](https://compound.law/assets/images/tools/tools_2.webp) tools # Azure OpenAI GDPR: Yes — With Microsoft DPA and German Regions 11 April 2026 Short answer Azure OpenAI can be GDPR-compliant for German companies when correctly configured with EU data residency and backed by the Microsoft Data Processing Agreement, but procurement teams still need to verify DPA scope, regional settings, training data opt-out, AI Act risk classification, and works council obligations. - Sign the Microsoft DPA and confirm it covers your specific Azure OpenAI service tier and deployment region. - Configure Germany North or Germany West Central to keep production inference and data storage inside the EU. - Assess AI Act risk classification, HIPAA eligibility for healthcare use cases, and works council co-determination rights before rollout. **Yes — Azure OpenAI is GDPR-compliant for German companies when the Microsoft Data Processing Agreement is signed and EU data residency is configured in a German region; your data is never used to train OpenAI models.** This compliance outcome is not automatic, though. Procurement and legal teams still need to verify DPA scope, confirm that Germany North or Germany West Central is active, understand what telemetry may leave the EU, assess AI Act risk classification, and resolve works council obligations before deployment. For a broader comparison of enterprise AI platforms, see the [AI tools assessed by Compound Law](https://compound.law/en-DE/tools/). ## Is Azure OpenAI GDPR Compliant? The short answer is yes — with the right setup. Azure OpenAI can be deployed in a manner that satisfies **GDPR requirements** under Regulation (EU) 2016/679, provided three conditions are met: 1. **Microsoft’s Data Processing Agreement (DPA) is signed.** This establishes Microsoft as an Article 28 processor and sets out obligations around security, subprocessors, breach notification, and data deletion. 2. **EU data residency is configured.** Germany North or Germany West Central must be selected as the deployment region to keep inference and stored data within Germany. 3. **Your organisation has a valid legal basis.** Typically Article 6(1)(b) (contract performance) or Article 6(1)(f) (legitimate interests) for internal use cases, or explicit consent where required. What Azure OpenAI does differently from direct OpenAI API access is critical for GDPR purposes: **Microsoft confirms that data submitted to Azure OpenAI is not used to train or improve underlying OpenAI models.** This removes the training-data risk that makes direct consumer-grade OpenAI products problematic for business use under GDPR. ## Azure OpenAI Data Processing Agreement (DPA) The **Microsoft DPA** is the contractual backbone for any GDPR-compliant Azure OpenAI deployment. It is incorporated into the Microsoft Product Terms and applies automatically once you accept the Online Services Terms, but legal teams should verify the scope rather than assuming automatic coverage. **Where to find and sign the DPA:** Log into the Microsoft Azure portal, navigate to the Compliance section under your subscription, and confirm that the Data Protection Addendum is accepted. Enterprise customers with a Microsoft Enterprise Agreement should confirm that Azure OpenAI specifically — not just Azure broadly — is covered under the agreed service scope, as coverage can vary by subscription tier. Key elements the Microsoft DPA covers: - **Article 28 GDPR processor obligations** — Microsoft commits to process personal data only on your documented instructions. - **Subprocessors** — Microsoft publishes a list of subprocessors and provides notice of additions, with the right to object. - **Security measures** — Technical and organisational measures (TOMs) are described in the Online Services Security Addendum. - **Data breach notification** — Microsoft commits to notify you without undue delay of any security incident affecting your data. - **Audit rights** — You may audit or instruct a third party to audit Microsoft’s compliance, subject to reasonable terms. - **Data deletion** — Upon contract termination, Microsoft commits to delete or return your data within defined timeframes. **Customer obligations under Article 28 GDPR:** As the controller, your organisation remains responsible for documenting the purpose and legal basis for processing, maintaining records of processing activities (ROPA) that reference Azure OpenAI, and ensuring users do not submit data that falls outside the documented purpose. Teams building applications on Azure OpenAI should review the [AI code generation compliance guide](https://compound.law/en-DE/compliance/ai-code-generation/) for how Article 28 obligations apply when developers use the platform to generate or review code. ## EU Data Residency: Germany Regions **Data residency is a configuration decision, not a default.** Azure OpenAI supports two German regions: - **Germany North** — hosted in Hamburg - **Germany West Central** — hosted in Frankfurt am Main Selecting either region means that **model inference and stored data remain within Germany’s geographic boundaries** under standard operation. This satisfies the strongest interpretation of EU data residency for GDPR purposes and avoids the Chapter V transfer risk that arises when data moves outside the EU. However, legal teams should verify four separate residency questions: | Data category | Germany region behaviour | What to verify | | ------------------------------- | ---------------------------------------------------- | ------------------------------------------------------------ | | Inference (prompts and outputs) | Stays in selected region under standard API usage | Confirm cross-region inference features are not enabled | | Stored fine-tuned models | Stored in selected region | Verify fine-tuning and customisation workloads stay in scope | | Telemetry and abuse monitoring | May be processed outside Germany | Review Microsoft’s current telemetry documentation | | Customer support data | Support interactions may involve non-EU staff access | Review support tier and data handling terms | **What may leave Germany:** Microsoft publishes guidance indicating that certain service-quality and abuse-monitoring signals may be processed outside the deployment region. This is the primary residency caveat for Azure OpenAI. For most enterprise use cases, this telemetry does not include prompt or output content, but legal teams should confirm this against Microsoft’s current documentation and reflect it in any DPIA. **Comparison with alternatives:** AWS Bedrock offers Frankfurt and Ireland regions; Google Vertex AI offers EU regions including Frankfurt. Azure OpenAI’s Germany-specific regional option — particularly Germany West Central in Frankfurt — is often preferred by German companies that must cite a specific German jurisdiction for data storage in contracts or regulatory filings. For a detailed EU residency comparison, see the [AWS Bedrock GDPR guide](https://compound.law/en-DE/tools/aws-bedrock/). ## HIPAA Eligibility Azure OpenAI is listed as a **HIPAA eligible service** on Microsoft’s HIPAA compliance page. This means it can be included in a Microsoft **Business Associate Agreement (BAA)** — the contractual requirement under US law for processing protected health information (PHI). **Relevance for Germany:** HIPAA is a US statute, but German healthcare companies that operate internationally, process patient data for US clients, or align their data protection posture with international healthcare standards will find HIPAA eligibility useful for procurement documentation. More directly, German healthcare is governed by **DSGVO** together with sector-specific rules in the **Sozialgesetzbuch (SGB V, X)** and the **Digital-Versorgung-Gesetz (DVG)**. HIPAA BAA status does not replace these obligations, but it signals a contractual maturity in healthcare data handling that supports a broader compliance argument. Healthcare organisations deploying Azure OpenAI should: 1. Confirm the BAA is signed as part of the Azure Enterprise Agreement. 2. Verify that the specific Azure OpenAI service tier is in scope for the BAA. 3. Conduct a **Data Protection Impact Assessment (DPIA)** under Article 35 GDPR for high-risk processing of health data. 4. Map patient data flows to confirm no personal health data reaches the model without appropriate pseudonymisation. ## AI Act Obligations Under the **EU AI Act** (Regulation (EU) 2024/1689), your obligations depend on **how you use Azure OpenAI**, not on the model itself. **General-purpose AI (GPAI) transparency:** Azure OpenAI is built on OpenAI foundation models, which qualify as GPAI models under the EU AI Act. Microsoft, as distributor, takes on obligations for GPAI model transparency and technical documentation. However, **deployers** — businesses building applications on top of Azure OpenAI — carry their own obligations based on the risk category of the resulting system. **Risk classification for common use cases:** - **Minimal risk:** General productivity, drafting documents, internal Q\&A, summarisation. No mandatory obligations beyond good practice. - **Limited risk:** Customer-facing chatbots interacting with individuals without making clear they are AI. **Transparency disclosure is required** under Article 52 EU AI Act. - **High risk:** HR decision support, credit scoring assistance, medical diagnosis tools, educational assessment. Extensive documentation, human oversight, accuracy requirements, and EU database registration apply. For developers using Azure OpenAI on security-related workflows, see the [AI cybersecurity compliance guide](https://compound.law/en-DE/compliance/ai-cybersecurity/). Financial sector firms should consult the [financial services AI regulation guide](https://compound.law/en-DE/ai-act/financial-services/). ## Works Council (Betriebsrat) Requirements In Germany, deploying Azure OpenAI in the workplace can trigger **co-determination rights** of the Betriebsrat under the **Betriebsverfassungsgesetz (BetrVG)**. This is not optional — failure to involve the works council before implementing tools that affect employees can result in an injunction against use. **When co-determination rights apply:** - **§87(1) No. 6 BetrVG** — Technical monitoring of employee behaviour or performance. If Azure OpenAI logs employee inputs, tracks usage patterns, or generates reports on individual activity, this provision likely applies. - **§87(1) No. 13 BetrVG** — Changes to work processes and organisation. Deploying AI tools that materially change how employees perform tasks may require consent. **How to handle it:** 1. Identify all deployment scenarios that could affect employees — customer service agents using AI copilots, HR teams using AI-assisted document review, developers using code completion. 2. Prepare a **Betriebsvereinbarung** that defines approved use cases, data categories processed, employee transparency rights, and monitoring limits. 3. Disclose logging configurations and access controls transparently to the works council. 4. If Microsoft 365 Copilot is deployed alongside Azure OpenAI, the works council review should cover both tools — see the [Microsoft 365 Copilot compliance guide](https://compound.law/en-DE/tools/copilot-microsoft-365/). **Note on employee data under BDSG:** When Azure OpenAI processes data relating to employees — for example, in HR analytics, performance tools, or email-drafting assistants — **§26 Bundesdatenschutzgesetz (BDSG)** applies alongside GDPR, requiring a specific legal basis for processing employee personal data and limiting permissible purposes to employment relationship management. ## Azure OpenAI Deployment Checklist For German legal, security, and procurement teams signing off on an Azure OpenAI rollout: 1. **Accept the Microsoft DPA** — Confirm the Data Protection Addendum is active under your Azure subscription and explicitly covers Azure OpenAI. 2. **Set the deployment region** — Select Germany North or Germany West Central for all production workloads handling personal data. 3. **Conduct a data flow analysis** — Map which personal data categories will be sent to Azure OpenAI, under what legal basis, and for what purpose. 4. **Confirm training data opt-out** — Document the Microsoft contractual commitment that your data is not used for model training and record this in your ROPA. 5. **Assess AI Act risk class** — Classify each use case under the EU AI Act risk framework and apply mandatory obligations accordingly. 6. **Assess HIPAA applicability** — For healthcare use cases, confirm the BAA is signed and the service tier is in scope. 7. **Engage the Betriebsrat** — If employee-related data is involved or employee-facing tools are deployed, begin works council consultation before rollout. 8. **Develop a usage policy** — Define what employees may and may not submit to Azure OpenAI and communicate this through training. 9. **Document the compliance decision** — Record the DPIA outcome (if applicable), the Betriebsvereinbarung, and the legal basis in your AI governance framework. ## How Compound Law Helps Compound Law supports German and DACH companies with: - **DPA review and gap analysis** — Verifying that Microsoft’s Data Processing Agreement scope, subprocessor list, and audit rights meet your specific requirements. - **EU data residency configuration advice** — Reviewing technical and contractual setup to confirm German region deployment is correctly implemented and documented. - **AI Act risk classification** — Mapping Azure OpenAI use cases to EU AI Act risk categories and advising on obligations including transparency, human oversight, and GPAI documentation. - **Works council strategy** — Drafting Betriebsvereinbarungen and supporting co-determination consultations for AI tool deployments. - **Usage policy development** — Writing internal policies that define approved use cases, data handling rules, and employee training requirements. - **DPIA scoping and completion** — Assessing whether a Data Protection Impact Assessment is required and supporting its execution. ## FAQ ### Is Azure OpenAI GDPR compliant? Azure OpenAI can be used in a GDPR-compliant manner by German companies if the Microsoft Data Processing Agreement is signed, EU data residency is configured in Germany North or Germany West Central, and your organisation establishes the correct legal basis under Article 6 GDPR and Article 28 processor obligations. ### Does Azure OpenAI have a Data Processing Agreement (DPA)? Yes. Microsoft provides a Data Processing Agreement through its Online Services Terms and Data Protection Addendum. Customers must accept these terms to establish a valid Article 28 GDPR processor relationship. The DPA covers subprocessors, security measures, breach notification, audit rights, and data deletion. ### Can I use Azure OpenAI in Germany? Yes. Azure OpenAI supports Germany North and Germany West Central as deployment regions. Configuring these regions keeps standard inference and stored data within Germany’s geographic boundaries, which is the strongest available data residency option for GDPR purposes. ### Is my data used to train OpenAI models when using Azure OpenAI? No. Microsoft explicitly states that data submitted to Azure OpenAI is not used to train or improve OpenAI foundation models. This is a key legal distinction between Azure OpenAI and direct access to OpenAI’s consumer or API products. ### Does Azure OpenAI meet HIPAA requirements? Azure OpenAI is listed as a HIPAA eligible service under the Microsoft HIPAA Business Associate Agreement (BAA). Healthcare organisations in Germany operating under both DSGVO and international HIPAA obligations should confirm the BAA is in place and that their specific use case falls within the eligible service scope. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Azure OpenAI can be used in a GDPR-compliant manner by German companies if the Microsoft Data Processing Agreement is signed, EU data residency is configured in Germany North or Germany West Central, and your organisation establishes the correct legal basis under Article 6 GDPR and Article 28 processor obligations. Yes. Microsoft provides a Data Processing Agreement through its Online Services Terms and Data Protection Addendum. Customers must accept these terms to establish a valid Article 28 GDPR processor relationship. The DPA covers subprocessors, security measures, breach notification, audit rights, and data deletion. Yes. Azure OpenAI supports Germany North and Germany West Central as deployment regions. Configuring these regions keeps standard inference and stored data within Germany's geographic boundaries, which is the strongest available data residency option for GDPR purposes. No. Microsoft explicitly states that data submitted to Azure OpenAI is not used to train or improve OpenAI foundation models. This is a key legal distinction between Azure OpenAI and direct access to OpenAI's consumer or API products. Azure OpenAI is listed as a HIPAA eligible service under the Microsoft HIPAA Business Associate Agreement (BAA). Healthcare organisations in Germany operating under both DSGVO and international HIPAA obligations should confirm the BAA is in place and that their specific use case falls within the eligible service scope. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Azure OpenAI GDPR: Yes — With Microsoft DPA and German Regions", "description": "Yes — with the Microsoft DPA signed and EU residency in Germany North or West Central. Your data is not used for training; check AI Act class and works council.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-11T00:00:00.000Z", "dateModified": "2026-04-11T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/azure-openai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Azure OpenAI GDPR: Yes — With Microsoft DPA and German Regions", "item": "https://compound.law/en-DE/tools/azure-openai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Azure OpenAI GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Azure OpenAI can be used in a GDPR-compliant manner by German companies if the Microsoft Data Processing Agreement is signed, EU data residency is configured in Germany North or Germany West Central, and your organisation establishes the correct legal basis under Article 6 GDPR and Article 28 processor obligations." } }, { "@type": "Question", "name": "Does Azure OpenAI have a Data Processing Agreement (DPA)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Microsoft provides a Data Processing Agreement through its Online Services Terms and Data Protection Addendum. Customers must accept these terms to establish a valid Article 28 GDPR processor relationship. The DPA covers subprocessors, security measures, breach notification, audit rights, and data deletion." } }, { "@type": "Question", "name": "Can I use Azure OpenAI in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Azure OpenAI supports Germany North and Germany West Central as deployment regions. Configuring these regions keeps standard inference and stored data within Germany's geographic boundaries, which is the strongest available data residency option for GDPR purposes." } }, { "@type": "Question", "name": "Is my data used to train OpenAI models when using Azure OpenAI?", "acceptedAnswer": { "@type": "Answer", "text": "No. Microsoft explicitly states that data submitted to Azure OpenAI is not used to train or improve OpenAI foundation models. This is a key legal distinction between Azure OpenAI and direct access to OpenAI's consumer or API products." } }, { "@type": "Question", "name": "Does Azure OpenAI meet HIPAA requirements?", "acceptedAnswer": { "@type": "Answer", "text": "Azure OpenAI is listed as a HIPAA eligible service under the Microsoft HIPAA Business Associate Agreement (BAA). Healthcare organisations in Germany operating under both DSGVO and international HIPAA obligations should confirm the BAA is in place and that their specific use case falls within the eligible service scope." } } ] } ] ```