Microsoft Loop and Planner and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No, for Microsoft Copilot: prompts, responses and data it reads through Microsoft Graph are not used to train foundation language models. The page speaks about Copilot, not about the app by name.

Vendor's wording: “Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”

Source: learn.microsoft.comMicrosoft Copilot privacy, data useChecked on 19 October 2026

Doesn't train on your data.

No, for Microsoft Copilot: prompts, responses and data it reads through Microsoft Graph are not used to train foundation language models. The page speaks about Copilot, not about the app by name.

Vendor's wording: “Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”

Source: learn.microsoft.comMicrosoft Copilot privacy, data useChecked on 19 October 2026

In the Microsoft 365 data geography of the user or group (their preferred data location), in SharePoint, OneDrive or SharePoint Embedded containers.

Vendor's wording: “Content is created in the geo matching the user's or group's preferred data location.”

Source: learn.microsoft.comLoop compliance summary, Data lifecycle (Multi-Geo)Checked on 19 October 2026

EU hosting available.

Yes. The Loop compliance summary lists EU Data Boundary compliance as supported and Multi-Geo as supported for Loop workspaces, so content can be created in an EU geography.

Vendor's wording: “EUDB: Compliance is supported. See What is the EU Data Boundary?”

Source: learn.microsoft.comLoop compliance summary, At a glance and Data lifecycleChecked on 19 October 2026

In Microsoft's Azure location for the tenant's country; the data location table gives Europe for EU countries such as Germany, France, Ireland and Austria. Premium plan data sits in Dataverse and attachments in the group's SharePoint location.

Vendor's wording: “Premium plan data is stored in Dataverse. Assigned tasks are also stored in the same Azure location as basic plans, and attachments are stored in the SharePoint location for the group.”

Source: learn.microsoft.comPlanner section and static data location tableChecked on 19 October 2026

EU hosting available.

Yes. Microsoft 365 customer data can be kept in the EU: the EU Data Boundary commits to store and process customer data for Microsoft 365 within the EU, and the tenant's geography sets where content sits.

Vendor's wording: “The EU Data Boundary is a geographically defined boundary within which Microsoft has committed to store and process Customer Data and personal data”

Source: learn.microsoft.comWhat is the EU Data Boundary?Checked on 19 October 2026

DPA in the terms.

Yes. The Microsoft Products and Services Data Protection Addendum is an addendum to the Product Terms and sets the data processing and security terms for subscribed products.

Vendor's wording: “the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site”

Source: microsoft.comMicrosoft Products and Services DPA, introductionChecked on 19 October 2026

DPA in the terms.

Yes. The Microsoft Products and Services Data Protection Addendum is an addendum to the Product Terms and sets the data processing and security terms for subscribed products.

Vendor's wording: “the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site”

Source: microsoft.comMicrosoft Products and Services DPA, introductionChecked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

If a paid subscription ends, Microsoft keeps customer data in a limited-function account for 90 days so it can be extracted, then disables the account and deletes the data. Admins can delete data during the subscription; Copilot chat history can be given retention policies in Purview.

Vendor's wording: “If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data.”

Source: learn.microsoft.comMicrosoft 365 data retention, deletion and destructionChecked on 19 October 2026

If a paid subscription ends, Microsoft keeps customer data in a limited-function account for 90 days so it can be extracted, then disables the account and deletes the data. Admins can delete data during the subscription; Copilot chat history can be given retention policies in Purview.

Vendor's wording: “If a paid subscription ends or is terminated, Microsoft retains customer data stored in Microsoft 365 in a limited-function account for 90 days to enable the subscriber to extract the data.”

Source: learn.microsoft.comMicrosoft 365 data retention, deletion and destructionChecked on 19 October 2026

4 named with Planner in scope: ISO/IEC 27001, ISO/IEC 27018, ISO/IEC 27701 and SOC 2 Type 2. ISO 42001 and C5 pages do not list Planner.

Vendor's wording: “Office Pro Plus, Office Services Infrastructure, OneDrive, Planner, Power Apps, Power BI, Project Online”

Source: learn.microsoft.comISO/IEC 27001 in-scope servicesChecked on 19 October 2026