Microsoft 365 Copilot data terms by plan: AI training, data location and DPA

Doesn't train on your data.

No. Prompts, responses and Microsoft Graph data are not used to train foundation models; optional feedback may improve Copilot but not train foundation models

Source: learn.microsoft.comImportant box and feedback note (ms.date 9 Jul 2026, updated 8 Oct 2026)Checked on 16 October 2026

EU tenants: inside the EU Data Boundary at rest. Exceptions: flex routing (on by default for eligible tenants created after 25 Mar 2026) can send inference to the US, Canada or Australia at peak load; Anthropic models excluded from the boundary

Source: learn.microsoft.comNotes and FAQ (ms.date 29 Sep 2026)Second source: learn.microsoft.comChecked on 16 October 2026

Data in the EU by default.

Included for EU tenants (EU Data Boundary), except models provided by Anthropic as a sub-processor, which are excluded from the EU Data Boundary. In-country commitments via Advanced Data Residency or Multi-Geo add-ons (Multi-Geo tenants fall outside the EU Data Boundary)

Source: learn.microsoft.comSection 'Microsoft Copilot and the EU Data Boundary'Second source: learn.microsoft.comChecked on 18 October 2026

DPA in the terms.

Yes. Covered by the Microsoft Products and Services DPA and Product Terms, with Microsoft as processor (applies through the licence terms)

Source: learn.microsoft.comOpening section (ms.date 29 May 2026)Second source: microsoft.comChecked on 16 October 2026

Published.

Public as a downloadable document (Microsoft Online Services Subprocessor List) via Trust Center/Service Trust Portal; change notices via Service Trust Portal 'My Library'

Source: microsoft.comParagraph on the subprocessor listSecond source: go.microsoft.comChecked on 16 October 2026

On the list.

Active (EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 16 October 2026

Prompts and responses are stored with the organisation's other Microsoft 365 content; admins set retention policies in Microsoft Purview, and users can delete their Copilot activity history in My Account

Source: learn.microsoft.comSection 'Data stored about user interactions with Microsoft Copilot'Checked on 17 October 2026

Microsoft names GDPR, ISO 27001, HIPAA and ISO 42001 (AI management) for Copilot, plus a commitment to ISO/IEC 27018; audit reports sit in the Service Trust Portal

Source: learn.microsoft.comParagraph 'Microsoft Copilot provides broad compliance offerings and certifications…'Checked on 17 October 2026

Yes. Copilot is licensed per user; admins choose which agents are allowed, whether Anthropic or OpenAI models are used, and can turn off optional connected experiences (this can remove web search)

Source: learn.microsoft.comSections on agents (Integrated apps), third-party models and connected experiencesChecked on 17 October 2026

€18.20 / user / mo.

EUR 18.20 per user/month list, promotional EUR 15.60, annual subscription, excl. VAT; add-on to a Microsoft 365 Business plan (up to 300 users)

Source: microsoft.comCard 'Microsoft 365 Copilot Business'Checked on 16 October 2026