GitHub Copilot and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. GitHub does not use Copilot Business or Enterprise data to train AI models; its Data Protection Agreement prohibits it without customer authorisation

Source: copilot.github.trust.pageFAQ 'Does GitHub use Copilot Business or Enterprise data to train AI models?'Second source: github.comChecked on 17 October 2026

United States or any country where GitHub or its sub-processors operate; Copilot sends inputs to GitHub's Azure tenant or another model provider

Source: github.comSection 'Data Transfers and Location'Second source: copilot.github.trust.pageChecked on 17 October 2026

DPA in the terms.

Yes. Copilot Business data is covered by the GitHub Data Protection Agreement

Source: copilot.github.trust.pageFAQ on training ('covered by GitHub's Data Protection Agreement')Second source: github.comChecked on 17 October 2026

25 listed.

Public. 25 third-party entries, nearly all processing in the US; AI inference by Microsoft Azure, OpenAI, Anthropic, Google Cloud, AWS, xAI, Fireworks and Cerebras; plus GitHub subsidiaries

Source: github.comTable 'Third Party Subprocessors'Checked on 17 October 2026

On the list.

Active (GitHub; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'GitHub'Checked on 17 October 2026

Copilot Business is covered by GitHub's SOC 2 Type 2 report and ISO 27001 certificate; a separate SOC 2 Type 1 exists for Copilot Business; ISO/IEC 42001 is being extended across Copilot

Source: copilot.github.trust.pageFAQ 'What third party testing and certifications does GitHub Copilot have?'Checked on 17 October 2026

Yes. Admins manage seats and Copilot policies (for example code review for members without a licence), usage limits and whether paid usage is allowed; the Business plan lists access control, budget control and governance

Source: github.comFAQs on policy management and admin controlsSecond source: github.comChecked on 17 October 2026