Independent: no vendor pays for coverage · Every row dated and sourced · UK GDPR and ICO in plain English · AI-assisted research, human-checked · How we test · Edited by Annie Vane
On personal plans, assume your chats are stored and processed in the United States. UK data residency is a business feature, and only some vendors offer it: OpenAI stores data at rest in the UK for eligible new ChatGPT Enterprise, Edu and API customers; Microsoft stores Microsoft 365 Copilot data at rest in the UK for UK tenants; Google's Gemini Enterprise has a UK region by allowlist. Anthropic offers no UK option. Even then, "residency" usually means where data is stored, not everywhere it is processed. This tracker shows, plan by plan, what each vendor offers and the page each answer came from.
Last checked: rows dated individually below (sources read 16 October to 1 November 2026) · Written by Annie Vane, editor · Evidence: Documentation review
Prepared with AI assistance for research and drafting; every date and source was checked by me before publishing. How we test
Cite this page: AI Agents UK, "UK data residency for AI tools (tracker)", last checked 1 November 2026, https://aiagents.org.uk/uk-data-residency-ai-tools/. Data: CSV. You may quote rows with credit and a link. Information, not legal advice.
Key facts
- No personal plan from OpenAI, Anthropic, Microsoft or Google offers UK data residency.
- OpenAI: UK storage at rest for eligible new ChatGPT Enterprise, Edu and API customers since 24 October 2025. ChatGPT Business is not listed.
- Microsoft: Microsoft 365 Copilot data is stored at rest in the UK for UK tenants; UK in-country processing is now expected by the end of 2026, a year later than first planned.
- Google: Gemini Enterprise can keep data in its UK region (europe-west2), but only if Google adds you to an allowlist, and not every model runs there.
- Anthropic: the API offers US-only or global processing; there is no UK option.
- The EU Data Boundary does not cover the UK. "EU residency" is not UK residency.
What data residency is, and what it isn't
Data residency is a vendor's promise about where your stored data sits (your chats, files and outputs "at rest"). It is useful, but it is narrower than most people assume. It usually does not promise:
- Where the model runs. A prompt stored in London may still be processed by a model in the US or the EU. Microsoft says generative AI for UK Copilot Studio environments "may be processed in the UK or in the EU Data Boundary", and Bing web search data goes to the United States.
- Who can see it. Support engineers and security teams in other countries may still have access under the vendor's terms.
- What sub-processors do. A third-party model inside a product can sit outside the promise. Microsoft says Anthropic models inside Copilot and Copilot Studio are excluded from its in-country processing commitments and are switched off by default for UK customers.
- That you no longer need a transfer mechanism. If any processing happens outside the UK, UK GDPR still treats it as a restricted transfer.
So the right question for a supplier is not "do you have UK residency?" but "where is our data stored, where is it processed, and who can access it from where?"
The tracker: UK residency by vendor and plan
Status key: UK = storage at rest in the UK available · Partial = UK storage for some data or by request · No = no UK option.
| Vendor and plan | UK status | What is offered | Training on your data by default? | Source (checked) |
|---|---|---|---|---|
| ChatGPT Free, Go, Plus, Pro | No | Processed in the US and elsewhere; OpenAI OpCo, LLC is controller for UK users | Yes, opt-out available | OpenAI Codex guide, ChatGPT pricing UK (18-29 Oct 2026) |
| ChatGPT Business | No | US by default; Business is not listed for residency | No | ChatGPT agents guide (16 Oct 2026) |
| ChatGPT Enterprise, Edu; OpenAI API | UK (eligible new customers) | Storage at rest in the UK or Europe; processing in Europe for Enterprise, Edu and Healthcare | No | ChatGPT agents guide (16 Oct 2026); OpenAI, UK data residency (1 Nov 2026) |
| Claude Free, Pro, Max | No | US servers; Anthropic Ireland, Limited is controller for UK users | Yes, opt-out available | Claude Code guide (17 Oct 2026) |
| Claude Team, Enterprise; Anthropic API | No | US; API offers US-only or global processing, no UK option | No | Claude Code guide (17 Oct 2026); Anthropic, data residency (1 Nov 2026) |
| Microsoft 365 Copilot | Partial | Stored at rest in the UK for UK tenants; queries may be processed in the US, EU or elsewhere until UK in-country processing arrives (expected end of 2026) | No | AI agents and UK GDPR (23 Oct 2026); Microsoft, in-country processing (editor's note 3 Apr 2026, read 1 Nov 2026) |
| Copilot Cowork | UK (UK tenants) | Microsoft commits to store prompts and responses in the UK for tenants whose default location is the UK | No | Microsoft Copilot agents UK (26 Oct 2026) |
| Copilot Studio | Partial | Data for UK environments stored in UK South and UK West, with exceptions; generative AI may run in the EU Data Boundary; Bing in the US | No | Copilot Studio UK (29 Oct 2026) |
| Copilot consumer app | No | Microsoft trains on app conversations unless you opt out; the UK is not on its excluded list | Yes, opt-out | Microsoft, Privacy FAQ for Copilot (1 Nov 2026) |
| Gemini app (personal Google account) | No | Google LLC, in the US, is controller for UK users; data may be processed abroad | Yes while "Keep activity" is on | Google Antigravity guide (18 Oct 2026); Is ChatGPT private? (26 Oct 2026) |
| Gemini Enterprise | Partial (allowlist) | UK region (europe-west2) by allowlist; some models (e.g. Gemini 3.8 Flash) available there, others (Gemini 4 Argon, Claude) not | No | Google Cloud, Gemini Enterprise locations (1 Nov 2026) |
| Google business developer tools (e.g. Antigravity) | No | Business accounts can choose US or EU processing; no UK option | Check telemetry settings | Google Antigravity guide (18 Oct 2026) |
Each row summarises the vendor's own documentation as read on the date shown, either directly or via the linked AI Agents UK guide, which links the primary source. Download the full table: CSV.
Does the plan tier matter? Yes, more than the brand
The pattern across all four vendors is the same: residency, processing agreements and "no training by default" arrive together, on business plans. If client or staff data is involved, the plan you pick matters more than whose model you like.
- Sole trader, no client personal data: a personal plan with training switched off is a reasonable choice, but your data is in the US.
- Small team handling client data: ChatGPT Business, Claude Team or Microsoft 365 Copilot give you a data processing agreement and no training by default. Only Copilot adds UK storage at rest.
- You need UK storage in writing: today that means Microsoft 365 Copilot (UK tenant), ChatGPT Enterprise (new customers), or Gemini Enterprise by allowlist. All are sales-led.
- You need nothing to leave the building: run a model on your own hardware. Our private AI guide explains how.
If your data leaves the UK: transfers in plain English
Most AI services process at least some data in the US, which UK GDPR calls a restricted transfer. That is allowed if it is covered, in one of two ways:
- The UK-US "data bridge": the US company is certified to the UK Extension of the EU-US Data Privacy Framework. Check the vendor on the official DPF list.
- A contract: usually the EU standard contractual clauses with the UK Addendum, or the UK's own International Data Transfer Agreement (IDTA), plus a short transfer risk assessment.
Since 5 February 2026, under the Data (Use and Access) Act 2025, the test for contract-based transfers is that protection after the transfer must not be "materially lower" than in the UK, judged by you acting "reasonably and proportionately". The full explanation is in AI agents and UK GDPR; the ICO's latest publications are in our ICO AI guidance tracker.
Five questions to ask any AI vendor about residency
- Where is our data stored at rest, and can you name the region? ("UK South" is an answer; "Europe" is not the UK.)
- Where is it processed when the model runs, including web search and third-party models?
- Which staff or sub-processors can access it, and from which countries?
- Is residency in the contract or the data processing agreement, or only on a web page?
- Does it apply to existing customers, or only new workspaces? (OpenAI's UK option is for eligible new customers.)
The full supplier checklist, with good and bad answers, is in Questions to ask before you buy an AI agent.
Frequently asked questions
Does ChatGPT store data in the UK?
Only on eligible new ChatGPT Enterprise, Edu and API accounts, which can store data at rest in the UK. Free, Go, Plus, Pro and Business are processed in the US and elsewhere.
Is Microsoft Copilot data stored in the UK?
For Microsoft 365 Copilot on a UK tenant, yes, at rest. Processing of prompts can still happen in the US, EU or elsewhere until Microsoft's UK in-country processing arrives, now expected by the end of 2026.
Does Claude offer UK data residency?
No. Anthropic's API offers US-only or global processing, and consumer and Team data is stored in the US.
Is EU data residency good enough for UK GDPR?
It can be lawful, because the UK recognises the EU as adequate, but it is not UK residency. If a contract or client demands UK storage, an EU region won't satisfy it.
Do I need UK residency to comply with UK GDPR?
No. UK GDPR does not require UK storage. It requires that any transfer abroad is covered and that you can explain it. Residency is a contractual or client preference, not a legal default.
Sources
Each row's primary source (vendor documentation, privacy policy or data processing addendum) is linked in that row, either directly or from the AI Agents UK guide named there. Law: UK GDPR, Article 46 and the Data (Use and Access) Act 2025, read on legislation.gov.uk.
Changelog
- 5 November 2026: Tracker published with 12 rows. Sources read 16 October to 1 November 2026.
- Next check: by 30 November 2026, and when Microsoft confirms UK in-country processing for Copilot.
This page explains UK law and regulator guidance in plain English, checked against legislation.gov.uk, gov.uk and ico.org.uk on 1 November 2026. It is general information, not legal advice, and the law may have changed since. For a decision that affects people's rights, money or jobs, speak to a qualified data protection professional or solicitor. Spotted something out of date? Tell me.
