Business Central Security and UK GDPR: What UK Directors Need to Know
Your ERP system holds some of your most sensitive information: financial data, customer and supplier details, prices, payroll-related data and bank details. A breach or a long outage can stop the business, and invoice and payment fraud is a daily threat for UK companies. With UK GDPR updated by the Data (Use and Access) Act 2025 and new cyber security legislation going through Parliament, ERP security is now a board-level topic. Here is how Business Central supports you, and what remains your responsibility.
Key takeaways for leaders
- Security in the cloud is a shared responsibility: Microsoft secures the platform, and you control users, permissions and processes.
- Business Central online for UK customers can run in Microsoft’s UK data centres.
- Sign-in uses Microsoft Entra ID, so you can enforce multi-factor authentication and Conditional Access, which are key Cyber Essentials controls.
- Granular permission sets, security groups, change logs and new audit APIs support least-privilege access and internal control.
- The Cyber Security and Resilience Bill will raise expectations on suppliers, including IT and managed service providers, so ask your partners how they protect your systems.
What Microsoft Takes Care Of
- Infrastructure security: physically secured Azure data centres, network protection and continuous monitoring.
- Data residency: Business Central online environments run in the Azure geography you choose. For UK businesses, that means data can stay in the UK.
- Encryption of data at rest and in transit.
- Updates and patching of the platform and application, without projects on your side.
- Backups and point-in-time restore of environments.
- Certifications: Microsoft’s cloud services are covered by widely recognised standards such as ISO/IEC 27001 and SOC reports.
What Remains Your Responsibility
- Identity: enforce multi-factor authentication and Conditional Access policies in Microsoft Entra ID.
- Least-privilege access: give users only the permission sets they need, using security groups to manage access at scale.
- Joiners, movers and leavers: remove access promptly when people change roles or leave.
- Payment fraud controls: use approval workflows and change logs for supplier bank details. Changing a supplier’s bank account is a classic target for invoice fraud.
- Sensitive data: classify personal data fields and use data masking or concealed fields where appropriate.
- Integrations and AI agents: each integration and agent should have its own identity and limited permissions.
UK GDPR in Practice
Business Central includes tools for data classification, finding and exporting personal data for subject access requests, and handling retention policies. Microsoft acts as a data processor under its data protection terms. Your company remains the controller, so record Business Central in your records of processing, define retention periods and make sure only authorised people can access personal data.
The Data (Use and Access) Act 2025 amended UK GDPR, and most of its data protection changes came into force in early 2026. For most organisations that already comply with UK GDPR, the changes are an update rather than an overhaul. Check the ICO’s guidance and update your privacy notices and complaint procedures.
The UK Cyber Agenda: Why It Matters for Your ERP
The Cyber Security and Resilience Bill, introduced to Parliament in November 2025, updates the UK’s NIS Regulations. It extends the regime to more organisations, including medium and large managed service providers, and strengthens incident reporting. Even if your company is not directly in scope, your customers, insurers and suppliers will expect stronger controls.
For most UK SMEs, Cyber Essentials is the practical baseline. It is required for many government contracts and is increasingly requested by large customers and insurers. Your ERP is one of your most critical systems, so it should be at the centre of your approach: MFA, documented access policies, tested backup and recovery, partner security and incident procedures.
New Controls in Recent Releases
Recent Business Central releases have strengthened governance. Version 27 introduced concealed fields and UI support for masking sensitive data (preview). Version 28 added APIs for analysing permissions and approval workflows, designed for auditors and IT staff. With AI agents, Business Central gives each agent its own permissions and makes its work visible, so that new automation doesn’t create new blind spots.
Frequently Asked Questions
Can Business Central data be stored in the UK?
Yes. Business Central online runs in Microsoft Azure data centres, and UK customers can have their environments in Microsoft’s UK data centres.
Is Business Central UK GDPR compliant?
Business Central provides tools for data classification, subject access requests and retention, and Microsoft acts as a data processor under its data protection terms. Compliance also depends on how your company configures and uses the system.
Does Business Central help with Cyber Essentials?
Business Central online uses Microsoft Entra ID, so you can enforce multi-factor authentication and Conditional Access, and its permission system supports least-privilege access. Cyber Essentials covers your wider IT estate as well, including devices, firewalls and patching.
Business Central online gives you enterprise-grade security foundations. Combined with the right configuration and governance, it is a strong basis for UK GDPR compliance and cyber resilience.
Would you like a security and permissions review of your Business Central environment? Contact us or book a call with one of our experts.
Related reading
