Is Copilot GDPR compliant? What happens to your firm’s data in Microsoft Copilot

In short: With a work account and the right licence, Copilot can be used in line with UK GDPR, but not simply by switching it on. You need tidy permissions, a data protection impact assessment (DPIA) and settings you have checked. Client, patient or customer data does not belong in Copilot signed in with a personal Microsoft account.

Microsoft commits that prompts, responses and organisational data are not used to train the underlying models, and that its Data Protection Addendum covers Copilot for business customers. Those commitments have exceptions that many firms are not aware of. And the biggest practical risk is often not Microsoft at all, but your own sharing settings.

A note on names: according to Microsoft, Microsoft 365 Copilot is now called “Microsoft Copilot” and Microsoft 365 Copilot Chat is now “Microsoft Copilot Chat”. The consumer app is also called Copilot. What matters is not the name but the account you are signed in with.

They look alike, but legally they are different services. The table follows Microsoft’s own documentation.

On the personal app: the details on training and the 18-month history come from Microsoft’s help pages for the app version before 18 August 2026; for the new version Microsoft refers to updated privacy controls. According to Microsoft, some conversations can also be reviewed automatically and by people, for example when a breach of the Code of Conduct is suspected, and there is no opt-out from that review.

Copilot for organisations connects a language model to your Microsoft 365 data. Through Microsoft Graph it reads email, documents, chats, calendars and meetings, and combines them with what the person is working on.

• Stored: every prompt and response, including citations, as the Copilot activity history. Admins can search it with Content search and Microsoft Purview and set retention policies.
• Not used for training: according to Microsoft, no foundation model is trained on prompts, responses or Graph data. Optional feedback may be used to improve Copilot.
• Where it is processed: Copilot follows the data residency commitments in Microsoft’s Product Terms and DPA. The EU Data Boundary covers EU and EFTA customers, not the UK. In November 2025 Microsoft announced in-country processing of Copilot interactions for the UK by the end of 2025; check with Microsoft whether it applies to your tenant.
• Anthropic models: Microsoft offers Claude models inside Copilot. They are excluded from the EU Data Boundary and, for UK customers, switched off by default. Whoever turns them on should know where that data goes.
• Web search: if allowed, Copilot turns your prompt into a search query and sends it to Bing, under separate rules described by Microsoft.

Microsoft puts it plainly: Copilot only surfaces organisational data to which the person has at least view permission. That sounds reassuring, but it is exactly the risk. Over the years most organisations collect sharing they no longer track: SharePoint sites open to everyone in the company, old sharing links, folders with inherited permissions.

That mess used to do little harm because nobody stumbled across the folder with the salary review. With Copilot one everyday question is enough, and it summarises whatever it finds. Under UK GDPR that touches data minimisation and security (Article 5).

Before you roll it out:

1. find and remove broad sharing on SharePoint, OneDrive and Teams,
2. protect sensitive areas such as HR, the board, health or client matters, for example with sensitivity labels,
3. give Copilot to a small pilot group first and check what they can find,
4. record the result in your DPIA.

Protective features can fail too: in early 2026 a bug let Copilot Chat summarise emails labelled confidential despite the policy meant to block it (see below).

The points below are documented and dated. Some concern Microsoft 365 as a whole, some Copilot itself. Regulators’ views have changed over time, and an honest picture includes that.

1. 8 March 2024
   EDPS: the European Commission’s use of Microsoft 365 infringed data protection law

   The European Data Protection Supervisor found infringements of Regulation (EU) 2018/1725 on purpose limitation, international transfers and unauthorised disclosures, and ordered data flows to certain third countries to be suspended. On 11 July 2025 it concluded that the infringements had been remedied and closed the case.

2. December 2024
   Netherlands: DPIA on Microsoft 365 Copilot finds four high risks

   SLM Rijk, which negotiates software contracts for the Dutch government, and SURF, the Dutch education IT cooperative, published a data protection impact assessment. Their advice: do not use Copilot for now, mainly because of a lack of transparency.

3. June 2025
   EchoLeak: a zero-click flaw in Microsoft 365 Copilot

   Researchers at Aim Security showed how a crafted email could make Copilot leak data from the user’s access scope without any click (CVE-2025-32711, CVSS 9.3). Microsoft had fixed it on the server side; customers did not need to act, and reports found no evidence of exploitation.

4. 17 September 2025
   Netherlands: Copilot moves from red to amber

   After changes by Microsoft, the four high risks were downgraded to medium. Use is possible with care and conditions: an AI policy, defined use cases, careful permissions and your own DPIA.

5. January to February 2026
   Copilot summarised emails labelled confidential

   Because of a code issue, Copilot Chat processed emails in Sent Items and Drafts even though sensitivity labels should have blocked it (Microsoft reference CW1226324). Reports started on 21 January; Microsoft began rolling out a fix in early February.

6. 27 May 2026
   SURF: Copilot remains amber ongoing

   Two medium risks remain: a filter that cannot be switched off and whose thresholds Microsoft does not disclose, and pseudonymised usage data kept for up to 18 months. SURF still advises caution and a risk check for each use case.

We are not aware of a fine against a UK organisation for using Copilot as of September 2026. The ICO itself uses Microsoft 365 Copilot and says in its privacy notice that the data stays in its UK tenants, is not used to train foundation models, that prompts and responses are deleted after 7 days and that a person always checks the output. That is a useful benchmark for the controls a careful organisation puts in place.

• Contract: Microsoft’s Product Terms and DPA are your processor contract under Article 28 UK GDPR. They only cover work accounts.
• DPIA: the ICO says that in the vast majority of cases the use of AI involves processing likely to result in a high risk, which triggers the legal requirement for a DPIA. If you decide one is not needed, document why.
• Admin settings: decide on Anthropic models, web search and agents deliberately rather than leaving the defaults.
• Permissions: clean up sharing before Copilot indexes it.
• Staff: the activity history can be seen by admins. Tell staff what is logged and why.
• Confidentiality: solicitors, accountants and medical practices have professional duties of confidentiality on top of UK GDPR.
• EU clients: if you serve customers in the EU, the EU AI Act’s AI literacy duty may matter too. See our guide to the EU AI Act.

How the same questions play out with another provider is covered in Is ChatGPT GDPR compliant?.

Check Anthropic models (admins)

1. In the Microsoft 365 admin center, go to Copilot › Settings and open AI providers operating as Microsoft subprocessors.
2. Check whether Anthropic is enabled and for whom. For UK tenants it is off by default, according to Microsoft.

Set retention (admins)

In Microsoft Purview, create a retention policy for Copilot interactions that matches your purpose, rather than keeping everything indefinitely.

Delete your history (staff)

You can delete your own Copilot activity history with prompts and responses in the My Account portal (myaccount.microsoft.com). Your organisation’s retention policies may take precedence.

Switch off training (personal Copilot app)

In the older app version: profile icon › Settings › Privacy › Training on conversation activity. Menus vary by version. For business data this only limits the damage; it is not a solution.

Copilot is strong at searching and connecting information across Microsoft 365. Much of everyday writing does not need that access: replying to an email, tidying up a dictation, taking meeting minutes, reading an invoice. A language model that sees only the text you are working on is enough.

SpeechToWork does exactly that on your own Windows PC. Speech recognition and the language model run locally, and nothing goes to a cloud. For this work the questions in this guide simply do not arise: no processor for your content, no international transfer, no training, no activity history on someone else’s server, no sharing settings for a tool to trawl, and no terms that change overnight.

To be fair about the limits: the local model is smaller than the big cloud models, it does not search your whole mailbox, it runs on Windows only and needs a reasonably recent computer. Many offices combine both: Copilot where it fits after a proper assessment, and local AI for anything confidential. More on GDPR-compliant AI and local AI.

• Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot (updated 9 July 2026)
• Microsoft Learn: Anthropic models in Microsoft Online Services (updated 18 September 2026)
• Microsoft Learn: Flex routing (EU and EFTA) (updated 29 September 2026)
• Microsoft Support: Microsoft Copilot privacy controls
• Microsoft Support: Privacy FAQ for Microsoft Copilot
• Microsoft: In-country data processing for Microsoft 365 Copilot in 15 countries, 4 November 2025
• ICO: What are the accountability and governance implications of AI?
• ICO: When do we need to do a DPIA?
• ICO privacy notice: Microsoft 365 Copilot
• EDPS: Closure of enforcement proceedings in the Commission’s use of Microsoft 365, 11 July 2025
• iBestuur: Stoplicht op oranje na herzien privacyonderzoek Copilot, 17 September 2025
• SURF: Privacy risks Microsoft 365 Copilot remain ‘orange’ despite improvements, 27 May 2026
• The Hacker News: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data, 12 June 2025
• BleepingComputer: Microsoft says bug causes Copilot to summarize confidential emails, 18 February 2026

Last reviewed: September 2026. This guide is not legal advice. Providers change plans, settings and terms often; check the linked original sources before you decide.