Microsoft Copilot and the GDPR: what applies, where the limits are and what to do before rollout

What is the difference between Microsoft 365 Copilot, Copilot Chat and consumer Copilot?

Three different products run under the Copilot name, and their contractual position differs. Microsoft 365 Copilot works inside Word, Outlook, Teams and other apps and also draws on your organisation’s data. Copilot Chat with enterprise data protection is the chat for employees, working with the context the user brings. Consumer Copilot is the version for private individuals. The two Microsoft pages we checked describe the business variants, not consumer Copilot.^[1][2]

For the two business variants Microsoft writes that use by organisations is covered by the Microsoft Products and Services Data Protection Addendum and the Product Terms, with Microsoft acting as processor. It says prompts and responses are protected by the same contractual commitments as email in Exchange and files in SharePoint.^[2] What contract, training and data location apply to consumer Copilot is not described in the pages we checked, and we did not open a separate Microsoft page on it. Do not assume that the Data Protection Addendum covers it; check Microsoft’s consumer terms yourself.

The last row is this page’s own assessment, not a statement by Microsoft, and not a finding that any use is lawful. The German supervisory authorities recommend that employers provide work accounts so that staff do not have to use private accounts for work.^[3] For how Copilot differs from ChatGPT, Claude and Gemini, see the privacy comparison of the four assistants. This guide covers the EU GDPR; UK teams should check the UK GDPR and the ICO’s position separately.

Where does the data go, and how much of that can you control?

Microsoft says that for users in the EU, traffic stays within the EU Data Boundary, while worldwide traffic may be processed in the EU and in other countries or regions by the language models. Calls to the models are routed to the nearest data centre in the region but can reach other regions when demand is high.^[1]

Microsoft names two exceptions explicitly:

• Models from Anthropic: models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.^[1] Microsoft says administrators can decide whether to use third-party models such as those from Anthropic and OpenAI, and that additional terms can apply.^[1] Check in your tenant whether these models are switched on.
• Web search queries: the EU Data Boundary does not apply to them.^[2] For Copilot Chat with enterprise data protection, Microsoft says queries go to the Bing service, which operates separately from Microsoft 365. The Microsoft Services Agreement and Privacy Statement apply, and Microsoft acts as an independent controller. Microsoft says queries are cut down from the prompt to a few words, sent without user or tenant identifiers, not shared with advertisers and not used to train the foundation models.^[2]

The list of exceptions can change; the Microsoft pages we read show an update in November 2026. Read the EU Data Boundary section of the linked page on the day you decide.

What this means for you: as a customer you cannot observe which data centre handled a given prompt. What you have is Microsoft’s documentation and the DPA, and the documentation itself describes the exceptions above, including routing to other regions when demand is high.^[1] Microsoft also acts as processor, and processors may engage further processors under conditions, so there is a chain behind the product name.^[7] None of this shows that the commitments are not kept. It shows that they rest on what Microsoft writes and not on anything you can check, and what has been sent cannot be recalled. The control you hold yourself is what goes into the prompt: leave out what the task does not need, and replace identifying details. The general argument is set out in where your data goes when you use an AI assistant.

Why is oversharing the real risk?

Because Copilot does not replace your permissions, it mirrors them. Microsoft writes that Copilot only surfaces organisational data the individual user has at least view permission for. It therefore matters to use the permission models of Microsoft 365 services such as SharePoint correctly, so that the right people and groups have access to the right content. That includes permissions you give people outside your organisation through collaboration features such as shared channels in Teams.^[1]

This is a security statement, not a promise that nothing inappropriate will appear. Copilot is a very fast way to search. A salary list that someone shared with “everyone in the company” years ago was hard to find; now it is one question away. The mistake is in the sharing, and Copilot makes it visible.

What Microsoft names as safeguards

• Identity boundary: the semantic index respects the identity-based access boundary, so only content the current person may access is included.^[1]
• Confidentiality labels: where content is encrypted by Microsoft Purview Information Protection, for example through sensitivity labels or restricted permissions, Copilot respects the usage rights granted to the person.^[1] Microsoft also says Copilot inherits your sensitivity labels, applies retention policies and supports audit logging of interactions.^[2]
• History and retention: prompt and response are stored as Copilot activity history. Administrators can view it through content search or Microsoft Purview and set retention policies for it; users can delete their own history.^[1]

What you can configure depends on your licence: Microsoft says the specific controls and policies vary with the underlying plan.^[2] Check this for your plan before you rely on a particular feature.

How do you tidy up permissions before rollout?

Start with the content where an overly wide view does the most damage, and work outwards. The steps below are derived from Microsoft’s statement that Copilot only shows what the person may read. Detailed instructions for SharePoint and Purview are on Microsoft Learn; they are not reproduced here because the interface changes often.

1. Take stock. Which sites, teams and storage locations hold personnel files, applications, salaries, contracts, client data or health information? Owner: IT with the business units.
2. Find wide sharing. Look for sharing with “everyone”, with large groups and with external people, including in shared channels.^[1] Owner: IT.
3. Narrow it. Pull sharing back to the groups that really need the content. Owner: content owners.
4. Label sensitive content. Apply sensitivity labels where your plan provides them, because Copilot respects the usage rights attached to them.^[1] Owner: IT and data protection.
5. Choose a pilot group. Start with a small group whose access you know, and ask them to try deliberately to find things they should not see. Owner: IT.
6. Set retention and logging. Decide how long the activity history is kept.^[1] Owner: IT and data protection.

What about employee representatives and a DPIA?

Both belong before the start. Employee involvement differs by country, so check the rules where your staff work. In Germany, for example, two provisions apply. Under § 90(1) no. 3 of the Works Constitution Act (BetrVG), the employer must inform the works council about planned work procedures and workflows, including the use of artificial intelligence.^[6] Under § 87(1) no. 6 BetrVG the works council has a right of co-determination on the introduction and use of technical systems intended to monitor the behaviour or performance of employees.^[5] Because Copilot stores activity history and administrators can view it,^[1] the question of whether co-determination is triggered has to be taken seriously. This page does not answer it conclusively: it is a case-by-case question where case law and commentary must be considered. The German supervisory authorities recommend considering a works agreement.^[3]

On the DPIA: Article 35 GDPR requires an assessment before processing that is likely to result in a high risk, in particular when using new technologies.^[4] The German supervisory authorities write that one is often required for AI use.^[3] With Copilot there is an added point: access to everything a person can read can also reach special categories of personal data where permissions are too wide. A documented threshold check before the start, agreed with your data protection officer, is therefore sensible. More on the method in DPIA for AI tools.

Which obligations stay with you, even with the DPA?

The Data Protection Addendum is the contract Microsoft points to for its role as processor. Article 28 GDPR sets requirements for such a contract, among other things that the processor acts only on documented instructions.^[7] It does not replace:

• A legal basis for every processing step with personal data that Copilot performs.^[3]
• Information for data subjects about the processing (Article 14 GDPR where the data were not collected directly from the person).^[8]
• Records of processing activities with purposes, recipients and time limits (Article 30 GDPR).^[9]
• Checking the results: Microsoft itself writes that results are not necessarily factually correct and that users should check them before sharing.^[1]
• Professional secrecy where it applies. In Germany, for example, lawyers and tax advisers are bound by criminal-law secrecy rules (§ 203 of the Criminal Code) that go beyond the GDPR.^[10]

That Microsoft processes your data only on your instructions is a contractual commitment. That staff do not enter the wrong data and do check results is your organisation’s job. Put both into your AI acceptable use policy. For staff who bypass the approved tool, see shadow AI.

What should be done before the rollout?

For the wider picture, see use AI at work without leaking data, and for the same contract questions on another assistant, is ChatGPT GDPR compliant?. This text is general information, not legal advice. Microsoft’s statements change; read the linked pages on the day you decide.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.