Microsoft Copilot and the GDPR: Checks Before Switch-On

Microsoft Copilot, called Microsoft 365 Copilot until Microsoft renamed it, can read everything each user is already allowed to open, and Microsoft covers it with the same data processing terms as Exchange and SharePoint. Three settings decide whether its processing stays inside the EU: flex routing, which is on by default for EU tenants created after 25 March 2026; Anthropic models; and web search through Bing, which falls outside the processing terms altogether. This page sets out those settings as Microsoft documented them on 12 October 2026, what German and Dutch regulators have found, and the checks to run before switch-on.

Microsoft sells Copilot as part of the Microsoft 365 contract many European companies already have. That makes the GDPR question narrower than it looks: the contract is the same, but Copilot reads more, and three settings change where it processes.

This page covers those settings as Microsoft's documentation described them on 12 October 2026, then what the German data protection conference, the Hessian commissioner and the Dutch education body SURF found.

This is not legal advice. Every claim carries its source and date in the notes. Microsoft changes names and defaults often, so check the dates against your tenant.

Is Microsoft Copilot GDPR compliant?

Microsoft covers Microsoft Copilot and Copilot Chat with its Products and Services Data Protection Addendum and Product Terms, "with Microsoft acting as a data processor".[²] Microsoft's privacy page, dated 9 July 2026, adds that "prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs".[¹] That is the same contractual footing as email in Exchange and files in SharePoint.

Three things sit outside that footing, and each is a setting rather than a contract clause:

• Flex routing, which lets processing leave the EU at peak load and is on by default for eligible tenants created after 25 March 2026.[⁴]
• Anthropic models, which "are currently excluded from the EU Data Boundary".[³]
• Web search through Bing, where "Microsoft acts as an independent data controller".[²]

The regulators' picture is mixed. Germany's data protection conference found in 2022 that compliance with Microsoft 365 could not be demonstrated on the contract then in force. Hesse's commissioner concluded in November 2025 that compliant operation is possible, but assessed the contract rather than Copilot.[⁶][⁷] The training position also matches our comparison of which AI providers train on business data.

What can Copilot see in your Microsoft 365?

Copilot sees exactly what each user can already open. Microsoft's documentation, dated 9 July 2026, states that Copilot "only surfaces organizational data to which individual users have at least view permissions", and asks customers to use "the permission models available in Microsoft 365 services, such as SharePoint".[¹]

That sounds reassuring and is the main risk. Most companies have files shared more widely than anyone intended: a folder shared with "everyone in the organisation", an old Teams channel, a OneDrive link sent to a whole department. Before Copilot, finding those files took effort. With Copilot, a plain-language question can surface them.

Microsoft's own list of protections makes the same point from the other side. Copilot honours sensitivity labels and encryption from Microsoft Purview, and respects permissions given to people outside the company through shared channels.[¹] A salary spreadsheet labelled and restricted stays restricted. One that sits in a broadly shared folder does not.

The same logic applies to any AI system connected to company data. Our guide to what an AI agent can see when you connect it shows how scopes in Gmail, Google Drive and Slack decide exposure in the same way.

Does Copilot keep your data inside the EU?

For EU tenants, Copilot is an EU Data Boundary service, and "EU traffic stays within the EU Data Boundary", according to Microsoft's documentation of 9 July 2026.[¹] Three settings make exceptions to that sentence, each with its own default.

Two details make the Anthropic row more than a footnote. On 3 April 2026, Microsoft added a setting for EU, EFTA and UK tenants to make Anthropic "the default model for Copilot in Microsoft 365 apps".[³] And some newer models are offered as "Anthropic models with Data Retention", where data "is stored by Anthropic and not subject to your Microsoft Customer Agreement", with inputs kept up to 30 days and up to two years where content is flagged.[³] Both are off until an admin switches them on.

Web search deserves a closer look than its row suggests. Microsoft's web search page of 18 August 2026 says Copilot sends Bing a short generated query, not the whole prompt or document, with user and tenant identifiers removed.[¹¹] The Product Terms add that these queries are not used for advertising or to train foundation models. They are still processed under Microsoft's controller terms, and the query can carry a name or a project term taken from an internal document.[¹¹]

On transfers to the United States, Microsoft Corporation was listed as an active participant in the EU–US Data Privacy Framework on 12 October 2026.[⁵] That gives transfers a legal basis. It does not answer whether you want prompts processed there at all.

Copilot Chat or Copilot: what changes for data protection?

Microsoft Copilot Chat comes with Microsoft 365 at no extra cost; the paid Microsoft Copilot licence adds access to company data through Microsoft Graph. Both are covered by the Data Protection Addendum when staff sign in with their work account, according to Microsoft's enterprise data protection page of 29 May 2026.[²] The difference is reach, not contract.

The real gap is the consumer Copilot. A user who opens Copilot with a personal Microsoft account, or without signing in, is outside the company's processing terms. SURF's DPIA lists access to "the consumer versions of Copilot" among five situations in which Microsoft processes data outside the processor instructions, and recommends "centrally blocking access to Copilot Chat and the free consumer Copilot" for education institutions.[⁸]

The same split exists with ChatGPT. Our page on which ChatGPT plan a business can use under the GDPR shows how a personal account turns the provider into a second controller of customer data.

What have European regulators found?

Three European regulators have published findings on Microsoft 365 or Copilot between November 2022 and May 2026. They reach different conclusions because they assessed different things.

The Hessian report is the one German readers will hear about most, so its scope matters. It runs to 137 pages and assessed the contract. The word "Copilot" does not appear in it.[⁷] It tells a company that Microsoft's terms can support compliant use. It does not assess what Copilot does with permissions, routing or web search.

SURF's two remaining medium risks are concrete. The first is "the processing of possibly inaccurate and incomplete personal data" in generated replies. The second is an 18-month retention period for pseudonymised service and telemetry data, which Microsoft did not shorten.[⁸] SURF's DPIA covers education licences in the Netherlands, but the product and the data flows are the same.

We found no decision of the German conference specific to Copilot in a search on 12 October 2026. That is a search result, not proof that none exists.

Do you need a DPIA before switching Copilot on?

A data protection impact assessment will often be needed for Copilot. Germany's data protection conference wrote on 6 May 2024 that a DPIA under Article 35 GDPR will "vielfach", often, be required for AI applications.[⁹] Copilot processes staff emails, chats, meeting content and documents, which brings it close to employee monitoring.

Several national lists name that processing directly. Our comparison of national DPIA lists shows that the Netherlands, Italy and Germany name employee monitoring among processing that requires an assessment.

SURF's DPIA gives a useful structure even for a company that is not a university. It separates what Microsoft controls (retention, routing, accuracy measures) from what the customer controls (permissions, settings, staff policy, blocking consumer access).[⁸] Hamburg's 2023 checklist adds one practical point: involve the works council where one exists.[¹⁰]

What should you check before switching Copilot on?

Five checks, in this order, address the risks Microsoft's documentation and the regulators named between 2024 and 2026. Permissions come first because no setting fixes a folder that is shared with everyone.

Our one-page checklist lists the same five checks with the admin paths and documentation dates: Download the Copilot switch-on checklist (PDF).

Where does Copilot stop and a custom agent start?

Copilot works inside Microsoft 365 with each user's permissions, as Microsoft's documentation of 9 July 2026 describes. It answers and drafts for one person at a time. It does not decide which of your other systems an AI may act in, who approves an action, or how one client's data is kept apart from another's. That boundary is our reading of the documented permission model, not a statement from Microsoft.

Three situations go beyond what a Copilot licence is built for:

• Work across systems outside Microsoft 365. A task that runs through a CRM, an accounting tool and email needs access designed per tool, not inherited from a user's mailbox.
• Actions with approval. When the AI should send, file or update something, the question is where the approval gate sits. Our guide to approval workflows in an AI agent system covers that design.
• Client separation and region. A custom agent can keep each client's data in a separate environment and run in the region you choose.

For a team that drafts, summarises and searches its own documents with permissions in order, Copilot is often the sensible choice. When the work spans systems and ends in actions, it is the starting point rather than the whole answer.

Frequently asked questions

Is Microsoft Copilot GDPR compliant? Microsoft covers Microsoft Copilot and Copilot Chat with its Data Protection Addendum and Product Terms, acting as processor, and does not use prompts, responses or Microsoft Graph data to train foundation models. Three exceptions sit outside the EU Data Boundary: flex routing at peak load, Anthropic models, and Bing web search, where Microsoft acts as an independent controller. Whether a company's use is compliant still depends on its own legal basis, permissions and DPIA.

Does Microsoft Copilot keep data in the EU? For EU tenants, Copilot is an EU Data Boundary service, but not entirely. Flex routing, on by default for eligible tenants created after 25 March 2026, lets prompts be processed in the United States, Canada or Australia at peak demand. Anthropic models are excluded from the boundary and off by default in the EU. Web search queries to Bing are not covered by the boundary.

What can Microsoft Copilot see in my company? Copilot only shows organisational data that the individual user has at least view permission for in Microsoft 365. It does not create new access, so any file shared too widely in SharePoint, OneDrive or Teams becomes easy to find through Copilot. Reviewing sharing permissions is the first step before switch-on.

Do I need a DPIA before introducing Copilot? Often, yes. Germany's data protection conference wrote in May 2024 that a data protection impact assessment will often be required for AI applications, and the Dutch education body SURF ran a full DPIA on Copilot, last updated in May 2026. Copilot processes staff emails, chats and documents, which brings employee monitoring questions that several national DPIA lists name.

Notes

1. Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot, page dated July 9, 2026, accessed October 12, 2026. Used for the renaming, permissions, training, interaction data, the EU Data Boundary and the Anthropic exclusion.
2. Microsoft Learn, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, page dated May 29, 2026, accessed October 12, 2026. Used for the DPA and processor role, and for web queries to Bing under Microsoft's controller terms outside the boundary.
3. Microsoft Learn, Anthropic models in Microsoft Online Services, page dated September 18, 2026, accessed October 12, 2026. Used for the EU default, the boundary exclusion, the April 3, 2026 setting and models with data retention.
4. Microsoft Learn, Flex routing (EU and EFTA), page dated September 29, 2026, accessed October 12, 2026. Used for the default for tenants created after March 25, 2026, the processing countries and the admin path.
5. US Department of Commerce, Data Privacy Framework List, searched October 12, 2026. Microsoft Corporation listed as active under the EU–US Data Privacy Framework, the Swiss–US framework and the UK Extension.
6. Datenschutzkonferenz, Festlegung and final report on Microsoft 365, November 24, 2022, accessed October 12, 2026.
7. Hessian Commissioner for Data Protection and Freedom of Information, Report on the use of Microsoft 365, November 15, 2025, version 1.0, sections C and E, accessed October 12, 2026.
8. SURF, DPIA Microsoft 365 Copilot for Education, second update, public version of May 27, 2026, prepared by Privacy Company, accessed October 12, 2026.
9. Datenschutzkonferenz, Orientierungshilfe Künstliche Intelligenz und Datenschutz, May 6, 2024, paragraphs 39 and 41, accessed October 12, 2026.
10. Hamburg Commissioner for Data Protection and Freedom of Information, Checklist for the use of LLM-based chatbots, November 13, 2023, item 2, accessed October 12, 2026.
11. Microsoft Learn, Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat, page dated August 18, 2026, accessed October 12, 2026. Used for the generated query, the controller terms, the policy and its default.