Data

Microsoft 365 and the GDPR: AI training, data location and DPA

Personal with Copilot: Doesn't train on your data. No EU hosting · no DPA.

Vendor: MicrosoftAssistantsChecked on How we check

Verdict

Is Microsoft 365 GDPR compliant?

Free

Free

Doesn't train on your data

No EU hosting · no DPA

Price: Free

Personal with Copilot

Personal

Doesn't train on your data

No EU hosting · no DPA

Price: €99 / yr

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Plans

Which Microsoft 365 plan stops the AI training?

None of the 2 plans we checked trains on your data.

Training

Does Microsoft 365 train on your data?

Trains on your data by default? · Free

Checked

Doesn't train on your data.

No (new app since 18 Aug 2026): prompts, responses and file contents in the Microsoft Copilot app are not used to train foundation models; optional feedback is not used for that either

Source: support.microsoft.comBox 'Important' at the top of the articleSecond source: support.microsoft.comChecked on

Trains on your data by default? · Personal with Copilot

Checked

Doesn't train on your data.

No. Prompts, responses and file contents when using Copilot in Microsoft 365 apps are not used to train foundation models; connected-experience data is not used to train LLMs

Source: support.microsoft.comSection 'Your data and Copilot', box 'Important'Checked on

Location

Where does Microsoft 365 store your data?

Where data is stored by default · Free

Checked

Not fixed: personal data may be stored and processed in the user's region, the United States or any country where Microsoft or its providers operate

Source: microsoft.comSection 'Storage and processing of personal data'Checked on

EU hosting on this plan · Free

Checked

No EU hosting.

No. The EU Data Boundary and Advanced Data Residency are commercial Microsoft 365 commitments, not offered for personal accounts

Source: learn.microsoft.comEU Data Boundary section (commercial Microsoft 365 Copilot)Second source: microsoft.comChecked on

Where data is stored by default · Personal with Copilot

Checked

Not fixed: personal data may be stored and processed in the user's region, the United States or any country where Microsoft or its providers operate

Source: microsoft.comSection 'Storage and processing of personal data'Checked on

EU hosting on this plan · Personal with Copilot

Checked

No EU hosting.

No. The EU Data Boundary and Advanced Data Residency are commercial Microsoft 365 commitments, not offered for personal accounts

Source: learn.microsoft.comEU Data Boundary section (commercial Microsoft 365 Copilot)Second source: microsoft.comChecked on

Contract

Does Microsoft 365 sign a data processing agreement?

Data processing agreement (DPA) · Free

Checked

No DPA.

No. With a personal Microsoft account, Copilot is covered by the Microsoft Services Agreement and Microsoft is the controller; the Products and Services DPA is for commercial customers

Source: support.microsoft.comOpening section ('covered by the Microsoft Services Agreement')Second source: microsoft.comChecked on

Data processing agreement (DPA) · Personal with Copilot

Checked

No DPA.

No. With a personal Microsoft account, Copilot is covered by the Microsoft Services Agreement and Microsoft is the controller; the Products and Services DPA is for commercial customers

Source: support.microsoft.comOpening section ('covered by the Microsoft Services Agreement')Second source: microsoft.comChecked on

Processors

Who else handles Microsoft 365 data?

Sub-processors (companies that handle the data for them) · Free

Checked

Published.

No list for personal accounts. Microsoft's Online Services subprocessor list covers commercial services; the privacy statement mentions affiliates and service providers in general

Source: microsoft.comSubprocessor list reference (commercial Online Services)Second source: microsoft.comChecked on

EU–US Data Privacy Framework · Free

Checked

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation' (checked 16 Oct 2026)Checked on

Sub-processors (companies that handle the data for them) · Personal with Copilot

Checked

Published.

No list for personal accounts. Microsoft's Online Services subprocessor list covers commercial services; the privacy statement mentions affiliates and service providers in general

Source: microsoft.comSubprocessor list reference (commercial Online Services)Second source: microsoft.comChecked on

EU–US Data Privacy Framework · Personal with Copilot

Checked

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation' (checked 16 Oct 2026)Checked on

Security

Which certifications and admin controls does Microsoft 365 have?

Admin controls for AI · Free

Checked

Not offered: a personal account has no admin; the user manages memory, web search and personalisation

Source: support.microsoft.comOpening list of controlsChecked on

Admin controls for AI · Personal with Copilot

Checked

Not offered: a personal subscription has no admin; each user switches Copilot off through the connected-experience privacy settings

Source: support.microsoft.comSection 'Your privacy settings and Copilot'Checked on

Price

What does Microsoft 365 cost?

Price, as shown in Germany · Free

Checked

Free.

EUR 0

Source: microsoft.comPlan cards contrast paid Copilot with 'der kostenlosen Version' (the free version)Checked on

Price, as shown in Germany · Personal with Copilot

Checked

€99 / yr.

EUR 99 per year, or EUR 10 per month

Source: microsoft.comCard 'Microsoft 365 Single' (sold as Personal outside Germany)Checked on

The vendor doesn't say: retention, certifications.

Alternatives

Microsoft 365 alternatives that don't train on your data

Other assistants tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • Langdock

    Business · €29.00 / user / mo

    Says it doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • Microsoft 365 Copilot

    Business add-on · €18.20 / user / mo

    Doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • nele.ai

    usage-based credit subscription · See details

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Proton Lumo

    Professional · €11.99 / user / mo

    Says it doesn't train on your dataData in the EU (vendor says) · DPA on request

    ✓✓✓✓✓

  • Gemini in Google Workspace

    Business Standard · €13.60 / user / mo

    Doesn't train on your dataLimited EU hosting · DPA in the terms

    ✓–✓✓✓

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices