Power BI and EU's Data Protection Directive

[jseek]

Hello!

One of my clients is very concerned about where data is stored on Power BI.  In accordance with EU's Data Protection Directive, they are concerned that the data that is loaded into the PBI file and then uploaded to Power BI may leave the EU.  The server that the data is from is held in the UK, but once the model goes into Power BI, we are unsure of where that data is stored.

Has anyone worked through this and does anyone know how to request where the data model should be stored?

[Seth_C_Bauer]

@jseek This page and the White paper you can download explains how and where data is stored. This should answer many of your questions. I can't speak directly to the directive, but if you use Direct Query to a database or model the data is not pulled into Azure. - this is explained in the white paper.

edit - added link

[jseek]

@Seth_C_Bauer Thanks for that.  The white paper does have it, posting it here for ease:

Tenant Creation

A tenant is a dedicated instance of the Azure AD service that an organization receives and owns when it signs up for a Microsoft cloud service such as Azure, Microsoft Intune, Power BI, or Office 365. Each Azure AD tenant is distinct and separate from other Azure AD tenants.

A tenant houses the users in a company and the information about them - their passwords, user profile data, permissions, and so on. It also contains groups, applications, and other information pertaining to an organization and its security. For more information, see What is an Azure AD tenant.

In Power BI, a tenant is created in the datacenter deemed closest, at the time when the Power BI service is initially provisioned. The Power BI tenant does not move from that datacenter location today, but the Power BI development team is working on a scenario to allow tenant administrators to move their subscription and data from one region to another.

For example, if the IT manager for Contoso Inc. decided she wanted a Power BI subscription for all employees of Contoso, and she initiated the creation of that subscription from Seattle, Washington (in the western United States), Power BI would create the Contoso Power BI tenant in the West US datacenter (the closest datacenter to Seattle). No matter where other employees reside – whether in Europe, Asia, Florida, or Australia – every employee would connect to the Power BI service cluster housed in the West US datacenter, because that is where the cluster resides.

For another example, if the IT manager happened to be on a business trip in Asia when she initially signed Contoso up for a Power BI subscription, the tenant would be created in the nearest datacenter (in this case, Southeast Asia). After that, all subsequent connections by Contoso employees to their Power BI service would go to Southeast Asia. Once created, you cannot move tenants from one datacenter to another.

Datacenters and Locales

Power BI is offered in certain regions, based on where Power BI clusters are deployed in regional datacenters. Microsoft plans to expand its Power BI infrastructure into additional datacenters.

The following links provide additional information about Azure datacenters.

• Azure Regions – information about Azure’s global presence and locations
• Azure Services, by region – a complete listing of Azure services (both infrastructure services and platform services) available from Microsoft in each region.

Currently, the Power BI service is available in the following regions, serviced by the following datacenters:

• West US
• North Central US
• South Central US
• East US 2
• West Europe
• North Europe
• Southeast Asia
• Brazil

Note: Although Power BI tenants remain in the datacenter in which they were created, it currently is not possible to guarantee that data processing initiated in one region will stay in that region.

[Anonymous]

@jseek: Did you cut/paste the following sentence from the security whitepaper or was it your own comment?:

Note: Although Power BI tenants remain in the datacenter in which they were created, it currently is not possible to guarantee that data processing initiated in one region will stay in that region.

In the current security whitepapaper (June 14, 2016) i can't find this sentence. If it would be there that would be important to the initial questions 😉

My customer asked if it is guaranteed that data always stay in ONE datacenter (the DC where the tenant was created an which is displayed in powerbi.com) and not gets (temporary) replicated to other datacenters.

[jseek]

Copied from the white paper. You might want to look up the white paper @Seth_C_Bauer posted, in case there is any update to this.

However, look at the wording. The tenant itself would stay in the region, but processing may not. I wonder if that's because users might access it from other regions and their data center closer would deliver the information while the data still stays in the region.