AI at work
Microsoft Copilot and the GDPR: what to check before you switch it on
Microsoft's documentation answers most of the GDPR question for you: your prompts and files are not used to train its models, and EU traffic stays in the EU. The risk it points back at you is permissions: Copilot shows each person everything they are already allowed to open.
By Oscar CobbeCurrent as at 3 minute read3 sources
A note on the name
Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, and Microsoft 365 Copilot Chat to Microsoft Copilot Chat. Its documentation says some licences and settings will carry the old names for a while, and that the change makes no difference to security, compliance or privacy.
What Microsoft says it does with your data
From its documentation for organisations, as read on 29 October 2026:
- 1Prompts, responses and the data Copilot reads through Microsoft Graph are not used to train the foundation models, including those Copilot uses.
- 2Copilot only shows a user organisational data they already have at least view permission to.
- 3Prompts and responses are stored as Copilot activity history, under the same contractual commitments as your other Microsoft 365 content, encrypted and not used for training. Admins can find it with Content search and set retention for it in Microsoft Purview.
- 4Microsoft says Copilot is covered by its existing commitments to commercial customers, including the GDPR and the EU Data Boundary.
Where the data goes
For EU users, Microsoft says Copilot traffic stays within the EU Data Boundary, and for EU customers Copilot is an EU Data Boundary service. It names one exception: models provided by Anthropic as a sub-processor are currently outside the EU Data Boundary. Admins decide whether those third-party models are used.
Web search is the other route out of your tenant. When it is on, Copilot turns terms from the user's prompt into a search query and sends it to Bing. An admin can switch web search off. Whether to leave it on is a judgement about what your staff type into prompts.
The risk that is yours: oversharing
Because Copilot can find anything a person is allowed to open, a SharePoint site shared with everyone, or a folder of payroll files with loose permissions, becomes something any member of staff can ask about in plain words. Microsoft's own advice is to use the permission models in Microsoft 365 so that the right people have access to the right content.
Before switching Copilot on, check who can open what: the sites and folders shared with the whole organisation, the guest accounts from outside it, and the files with the most sensitive personal data in them. Two-step sign-in on every account matters more once one account can query everything it can reach; two-step sign-in on Microsoft 365 separates allowed from enforced.
Responses can be wrong
Microsoft's documentation says generative AI responses are not guaranteed to be factual and that users should review them before sending them on. That review is a person's job, and your AI use policy should say whose.
What the law asks of you
Under the GDPR, Copilot is a use of personal data by your business with Microsoft as processor, so it belongs in your record of processing with Microsoft's agreement behind it; what a data processing agreement must contain is the checklist. Under the EU AI Act, a business that uses an AI system in its work is a deployer, and one duty already applies to every deployer, AI literacy for the staff who use it: Article 4 explains what that means in practice.
A written AI use policy is where the rest goes: what staff may put into Copilot, who checks what it produces, and what happens when it is wrong.
Sources
Free, and no account needed
Which AI Act duties reach you?
Goes through the whole AI Act and lists only the duties that apply to how you use AI, Copilot included, each with its article and the date it starts.
Run the free checkSign-in and the basics, before Copilot
Protect requires two-step sign-in on every account, sets SPF and DMARC, tests a backup restore, and writes the privacy notice, cookie consent and incident plan, with the evidence kept on your compliance record. From €2,950 up to 10 staff, fixed before we start.
ProtectWho wrote this
Oscar Cobbe · Founder, FourWinds Digital
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.
More about how we work →Read next
- EU AI ActYour staff use ChatGPT. What the law asks, and a policy to adopt
- EU AI ActAI literacy: a real duty, and nothing you have to buy
- Cyber securityTwo-step sign-in on every mailbox: turning it on, and proving it
Written on 29 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.