Microsoft Copilot Chat in Microsoft Edge and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Prompts, responses and Microsoft Graph data in Copilot Chat are not used to train foundation models.

Vendor's wording: “the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models.”

Source: learn.microsoft.comEnterprise data protection for prompts and responsesChecked on 19 October 2026

For EU users, EU traffic stays in the EU Data Boundary; worldwide traffic can be sent to the EU and other countries for model processing.

Vendor's wording: “EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.”

Source: learn.microsoft.comMicrosoft Copilot and the EU Data BoundaryChecked on 19 October 2026

EU hosting available.

Yes for EU customers: Copilot is an EU Data Boundary service. Exceptions: models provided by Anthropic as a subprocessor and web search queries are outside it.

Vendor's wording: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.”

Source: learn.microsoft.comMicrosoft Copilot and the EU Data BoundaryChecked on 19 October 2026

DPA in the terms.

Yes. Copilot Chat for organisations is covered by the Microsoft Products and Services Data Protection Addendum and Product Terms, with Microsoft as data processor.

Vendor's wording: “is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor.”

Source: learn.microsoft.comWhat is enterprise data protectionChecked on 19 October 2026

Published.

Yes: the Microsoft Online Services Subprocessor List (downloadable via the Trust Center). Microsoft names Anthropic and OpenAI as model subprocessors in Copilot. Entries not counted (document download).

Vendor's wording: “The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services.”

Source: microsoft.comList of subprocessorsChecked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

Prompts and responses are stored with the organisation's other Microsoft 365 data; admins set retention in Microsoft Purview, and users can delete their own Copilot activity history in the My Account portal.

Vendor's wording: “Your users can delete their Copilot activity history, which includes their prompts and the responses Copilot returns, by going to the My Account portal.”

Source: learn.microsoft.comDeleting the history of user interactionsChecked on 19 October 2026

ISO 27001 and ISO 42001 are named for Copilot (2 certifications); the page also lists GDPR and HIPAA as compliance offerings and cites an ISO/IEC 27018 privacy commitment.

Vendor's wording: “Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.”

Source: learn.microsoft.comComplianceChecked on 19 October 2026

Yes. Admins can allow or block Copilot Chat from using page content in Edge with the EdgeEntraCopilotPageContext policy, restrict or block access for users or groups, and unpin Copilot Chat.

Vendor's wording: “To allow or block Copilot Chat from using browsing context, use the EdgeEntraCopilotPageContext policy.”

Source: learn.microsoft.comManage Copilot Chat in Microsoft Edge; Restrict access to Microsoft Copilot ChatChecked on 19 October 2026

See details.

No separate price: Copilot Chat (Basic) is included with eligible Microsoft 365 licenses. The licence price itself could not be read (Microsoft pricing pages blocked).

Vendor's wording: “Copilot Chat (Basic) is the standalone baseline experience included with eligible Microsoft 365 licenses.”

Source: learn.microsoft.comOverview of Microsoft Copilot ChatChecked on 19 October 2026