Dynamics 365 and GDPR: UK GDPR and EU GDPR by Design

Roles: who is controller and who is processor

Your organisation is the controller for the personal data in its Dynamics 365 tenant: employees, customers, suppliers and contacts. Microsoft acts as a processor under its data-processing terms. Software Dynamics acts as a processor when our staff access your tenant on your instructions, and we sign a data-processing agreement for that.

Decisions about purpose, lawful basis and retention stay with you. Our job is to make those decisions enforceable in the system.

What the design has to deliver

GDPR principles translate into specific design decisions for an ERP.

Data inventory: where personal data sits across customers, vendors, employees, projects and attachments

Lawful basis and purpose recorded against each category, owned by a named person

Data minimisation: fields, imports and integrations carry only what the process needs

Role-based access and segregation of duties, reviewed on a schedule

Audit logging for access to sensitive records

Retention schedules applied with blocking, archiving or anonymisation

Processes for access, rectification, erasure, restriction and portability requests

A breach process with named owners and a clock that starts when the incident is known

What Dynamics 365 provides

Microsoft publishes security, privacy and compliance documentation for the Dynamics 365 and Azure services, including data-protection terms and data-residency commitments. Within the product, the relevant tools include security roles, field-level security, auditing, data export, data-loss-prevention policies for connectors, and Microsoft Purview for governance. We confirm which tools apply to your licences and configuration in discovery.

Before go-live

Data-protection work is part of the test plan, not a separate project.

Data protection impact assessment completed where processing is likely to be high risk, for example large-scale employee monitoring or special-category data

Non-production environments loaded with masked or synthetic data

Processor and sub-processor list agreed and recorded

International transfer terms agreed where our teams or tools access data from outside the UK and EU

A named contact for data-subject requests

What we do not claim

We do not certify your compliance, we are not a law firm, and we do not hold a regulator's approval for any product. We give you a design and evidence that your data-protection adviser or DPO can review.

How an engagement runs

It starts with a 45-minute consultation, then a discovery and fit-gap workshop on your own processes. You receive a written fit-gap and a phased plan before a programme is agreed. Four phases follow, each with something you can use and review.

Discover

Process workshops, data audit, and a fit-gap against the standard product.

Design

Solution blueprint, integration map, and the extensions we will actually need.

Deploy

Configuration, migration rehearsal, role-based training, UAT and phased cutover.

Support

Hypercare, managed services, client portal, scheduled optimisation reviews.

What drives the cost: users, legal entities and currencies, integrations, data migration and the gaps found against standard. See how pricing works or run the three-minute readiness score.

Frequently asked questions

Is Dynamics 365 GDPR compliant?

Compliance depends on how an organisation configures and uses a system. Dynamics 365 provides security, audit and governance tools, and the implementation applies them to your processes and your obligations under UK GDPR and EU GDPR.

What is the difference between UK GDPR and EU GDPR?

After Brexit the UK has its own version of the regulation, together with the Data Protection Act 2018, enforced by the Information Commissioner's Office. EU GDPR is enforced by the data-protection authority of each member state. The principles are closely aligned, and groups operating in both need to meet both.

Do you sign a data processing agreement?

Yes. When our staff access personal data in your tenant, we act as a processor and sign a data-processing agreement with you, including a list of sub-processors and the transfer terms.

Can you handle erasure requests in an ERP?

Yes, within the limits of retention duties for tax and accounting records. See our page on erasure and retention in ERP.

Do we need a DPIA for an ERP project?

Not always. It depends on the processing. We include a DPIA trigger list in discovery so the decision is recorded.

Statutory rates, filing rules, mandate dates and data-protection requirements are set by the relevant authorities and change; we confirm the current position with you and your advisers before configuration. General information, not tax, legal or data-protection advice, and not a statement that any product or service is certified or approved by a regulator.

Last reviewed 2026-10-16

Dynamics 365 and GDPR: designing for UK GDPR and EU GDPR.