Microsoft Copilot
Microsoft
Assessment labels are editorial guidance, not GDPR certifications. Validate the exact plan, lawful basis, DPA, subprocessors, retention, residency and feature settings. EU storage and no-training terms alone do not establish GDPR compliance. ¹ No training applies under the reviewed plan’s terms.
Pricing / Contract Route
Official pricing varies by market, base licence, bundle and contract
Enterprise Features
Microsoft DPA and Product Terms, EU Data Boundary where eligible, Purview, tenant controls for routing, models, search and agents
Last Updated
September 10, 2026
Version: 10 September 2026 - prepared by WAIMAKERS B.V.
1 Purpose
Microsoft now names the product Microsoft Copilot. This page keeps the existing Microsoft 365 Copilot URL for continuity.
Microsoft Copilot can support a GDPR-compliant deployment under Microsoft's commercial terms. This is a conditional assessment, not a product-wide certification. The customer must govern permissions, lawful use, retention, enabled models, web grounding, agents and international processing.
2 Comparison of deployment options (EU focus)
| Deployment | Training on customer data? | EU Data Boundary | Admin attention | Practical assessment |
|---|---|---|---|---|
| Commercial Microsoft Copilot, standard configuration | ✅ Microsoft states that prompts, responses and Microsoft Graph data are not used to train the foundation models used by the service. | ✅ Microsoft Copilot and Copilot Chat are EU Data Boundary services for eligible EU/EFTA tenants, subject to documented exclusions. | Confirm tenant geo, licences, Product Terms, DPA, Purview settings and permissions. | Can support a compliant deployment after tenant and use-case review. |
| Flex routing enabled | ✅ The same commercial no-training commitment applies. | ⚠️ Eligible inference may route to the US, Canada or Australia during peak demand. Limited pseudonymised operational data may also be stored outside the boundary. | Check the live setting and Message Center. It is on by default for eligible tenants created after 25 March 2026. | Requires an explicit international-processing decision. |
| Anthropic models enabled in Word, Excel or PowerPoint | ✅ Anthropic acts as Microsoft's subprocessor under Microsoft's Product Terms and DPA. | ❌ Anthropic processing occurs outside the EU Data Boundary. | Check both the app setting and global subprocessor setting. The app setting is on by default for EU/EFTA/UK tenants created after 25 March 2026. | Assess this as a separate processing route. |
| Bing web grounding, agents or connectors | ⚠️ Depends on the external service and feature. | ⚠️ Bing queries are outside the Microsoft 365 service boundary and EU Data Boundary. Third-party services have their own locations. | Inventory and assess each enabled route. | Do not inherit the core Copilot conclusion automatically. |
Public Copilot prices and eligible base licences change by market and contract. Verify Microsoft's current pricing page and the tenant's order form before purchase.
3 Is Microsoft Copilot GDPR compliant?
No product setting can certify the customer's deployment. Microsoft's contracts and controls can support GDPR compliance when the organisation configures and uses the service appropriately.
What Microsoft commits to
- ✅ No foundation-model training: prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models used by Microsoft Copilot.
- ✅ Commercial DPA: organisational use is covered by the Microsoft Products and Services Data Protection Addendum and Product Terms, with Microsoft acting as processor for covered Customer Data.
- ✅ Permission inheritance: Copilot honours existing Microsoft 365 access permissions.
- ✅ Audit and retention controls: Copilot interaction data can be audited, discovered and retained through Microsoft Purview, subject to licence and configuration.
- ⚠️ Existing oversharing remains visible: permission inheritance can surface information that was already over-shared to the user.
4 EU Data Boundary details and limits
The EU Data Boundary is not a promise that every Copilot-related operation stays in the EU.
- ⚠️ Flex routing: eligible tenants can allow LLM inference in the US, Canada or Australia. Admins can disable it; existing tenants must check their actual default in Message Center.
- ⚠️ Anthropic models: supported Word, Excel and PowerPoint experiences process outside the EU Data Boundary when this route is enabled.
- ⚠️ Web search: generated Bing queries follow separate data-handling terms. The query is normally a short generated search string rather than the whole prompt, but still needs separate assessment.
- ⚠️ Agents, connectors and previews: these can introduce different processors, permissions, terms and locations.
- ⚠️ Multi-Geo: customers that purchased or used Microsoft 365 Multi-Geo are outside the Microsoft 365 EU Data Boundary scope. Multi-Geo is not required for EUDB coverage.
5 Retention and security controls
There is no universal Copilot retention period. Prompts and responses are logged for auditing and eDiscovery. Retention and deletion follow the Microsoft 365 and Purview policies and legal holds configured for the tenant.
Depending on the underlying licences, controls can include:
- ✅ sensitivity labels and data loss prevention;
- ✅ audit, eDiscovery and retention policies;
- ✅ Conditional Access and identity controls;
- ✅ encryption and Microsoft 365 permission controls.
These controls support governance. They do not by themselves certify that a use case complies with the GDPR.
6 EU deployment checklist
- Confirm the exact tenant geo, licences, Product Terms and DPA.
- Inspect and document Flex routing, Anthropic-subprocessor and web-search settings.
- Audit SharePoint, OneDrive, Teams and Exchange permissions before broad activation.
- Configure Purview retention, eDiscovery, audit, sensitivity labels and DLP where licensed.
- Inventory agents, connectors and plugins and assess each external data flow.
- Set a lawful purpose, approved-data rules and human verification for consequential outputs.
- Complete a DPIA and transfer assessment where the use and data categories require them.
7 Primary sources
- Data, privacy and security for Microsoft 365 Copilot
- Enterprise data protection
- Copilot data protection and auditing
- Flex routing for EU and EFTA
- Anthropic models in Microsoft 365 apps
- Microsoft licensing privacy FAQ
- Microsoft Products and Services DPA
8 Disclaimer
This overview is an informational procurement aid, not legal advice or a certification of a tenant. Verify the live tenant settings, current contract and actual data flows before production use. The customer remains responsible for its GDPR obligations.
Prepared and issued by WAIMAKERS B.V. - 10 September 2026.