Outlook with Copilot and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models behind Copilot.

Vendor's wording: “Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.”

Source: learn.microsoft.comHow does Microsoft Copilot use your proprietary organizational data?Checked on 19 October 2026

EU customers: stored inside the EU Data Boundary. Outside the EU, queries can be processed in the US, EU or other regions. For EU tenants created after 25 March 2026, flex routing may send inference outside the EU at peak load.

Vendor's wording: “EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.”

Source: learn.microsoft.comMicrosoft Copilot and the EU Data BoundaryChecked on 19 October 2026

EU hosting available.

Yes: Copilot is an EU Data Boundary service for EU customers (no extra setting). Anthropic models, if the admin allows them, are excluded from the boundary. Advanced Data Residency and Multi-Geo add in-country commitments.

Vendor's wording: “For EU customers, Microsoft Copilot is an EU Data Boundary service.”

Source: learn.microsoft.comMicrosoft Copilot and the EU Data BoundaryChecked on 19 October 2026

DPA in the terms.

Yes. Data processing terms for Microsoft online services are set in the Microsoft Products and Services Data Protection Addendum, which accompanies the Product Terms when you subscribe.

Vendor's wording: “When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA).”

Source: microsoft.comMicrosoft Products and Services Data Protection Addendum (DPA)Checked on 19 October 2026

Behind sign-in.

Yes: the Microsoft Online Services Subprocessor List is published (downloadable via the Trust Center / Service Trust Portal); entries not countable as text. Anthropic and OpenAI are named as AI model subprocessors in Copilot.

Vendor's wording: “The Microsoft Online Services Subprocessor List identifies subprocessors authorized to subprocess customer or personal data in Microsoft Online Services.”

Source: microsoft.comList of subprocessorsChecked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Microsoft Corporation'Checked on 19 October 2026

Copilot prompts and responses are stored with the organisation's Microsoft 365 data; admins set retention in Microsoft Purview and users can delete their Copilot history. After a subscription ends, data is kept 90 days, then deleted.

Vendor's wording: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”

Source: learn.microsoft.comRetention and deleting historySecond source: learn.microsoft.comChecked on 19 October 2026

Copilot page names ISO 27001 and ISO 42001 certifications plus GDPR and HIPAA compliance (4 items, only 2 are certificates); it also cites ISO/IEC 27018. Audit reports are in the Service Trust Portal.

Vendor's wording: “Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.”

Source: learn.microsoft.comMeeting regulatory compliance requirementsChecked on 19 October 2026

Yes. Admins choose which agents are allowed and whether Anthropic or OpenAI models are used, and turning off connected experiences that analyze content removes Copilot features in Outlook, Word, Excel and OneNote.

Vendor's wording: “As an admin, you can decide whether to use these models to power your experiences”

Source: learn.microsoft.comThird-party models; privacy controls for connected experiencesChecked on 19 October 2026

See details.

20.36 EUR per user per month, billed annually (auto-renewing yearly subscription), excluding VAT. Includes Copilot in Outlook, Word, Excel, PowerPoint and Teams.

Vendor's wording: “Microsoft 365 Business Standard mit Copilot Leistungsstarke Apps auf allen Geräten – mit integriertem Copilot für mehr Kreativität, bessere Zusammenarbeit und höhere Effizienz 20,36 € Benutzer/Monat, jährliche Abrechnung”

Source: microsoft.comPreise für Microsoft Copilot / Business StandardChecked on 19 October 2026