Microsoft Copilot in business: a GDPR and privacy check

Copilot is the AI assistant that many teams never consciously introduced. It is built into Windows, the Edge browser, Outlook and Teams, and in many Microsoft 365 plans the chat comes at no extra cost. Since summer 2026, things have become even more confusing: Microsoft has renamed its business products, and they now have almost the same name as the personal Copilot.

For data protection, though, the difference is huge. Whether a data processing agreement (DPA) applies, whether Microsoft trains on your inputs and where the data is processed all depend on the account and a handful of settings. Here is the overview, as of October 2026.

Key points at a glance

• The account is what matters: With a Microsoft 365 work account, your team uses Copilot with a DPA and without training on your data. With a personal Microsoft account, it is the consumer Copilot, without a DPA.
• New names: Microsoft 365 Copilot became Microsoft Copilot, and Microsoft 365 Copilot Chat became Microsoft Copilot Chat.
• Three exceptions to the EU Data Boundary: web search via Bing, Anthropic models in Word, Excel and PowerPoint, and processing outside Europe during peak loads. In newly created Microsoft 365 tenants, the last two are switched on by default, and web search is on everywhere as long as nobody turns it off.
• Permissions are the biggest practical risk: The licensed Copilot finds everything a person is allowed to see, including folders that were shared by mistake.
• No approval from the authorities: The Hessian data protection authority considers Microsoft 365 usable under certain conditions. No German supervisory authority has assessed Copilot itself so far.
• Your obligations: document the contract, update your record of processing activities, train your team, set rules. If Copilot accesses company data, also check whether you need a data protection impact assessment (DPIA) and whether the works council has to be involved.

Which Copilot is which?

Microsoft uses the name Copilot for three products with very different terms. Since August 2026, the business product has been called Microsoft Copilot, just like the personal version. The only way to tell them apart now is the sign-in: if you sign in with your work account, you get what Microsoft calls enterprise data protection. If you use a personal Microsoft account, you end up with the consumer Copilot, even on a company laptop.

Copilot Chat is included at no extra cost in many Microsoft 365 business plans. It only sees what you give it: pasted text, uploaded files and the file you currently have open. In Outlook, it can also access emails, calendars, meetings, chats and parts of OneDrive and SharePoint.

The licensed Microsoft Copilot uses the Microsoft 365 interfaces to access everything the signed-in person has at least read access to. For small businesses, it is available as the “Microsoft 365 Copilot Business” add-on for up to 300 users, at a list price of €18.20 per user per month, or €15.60 as a special offer until the end of 2026, in each case billed annually and excl. VAT.

Copilot Pro, the personal subscription with Copilot in Word and Excel, is no longer sold by Microsoft; support ended on 1 August 2026. If you have been using it for work, you should switch to a business plan.

Where your data is processed

For customers in the EU, Microsoft Copilot and Copilot Chat fall under what Microsoft calls the EU Data Boundary: data is meant to be stored and processed within the EU and EFTA. There are three exceptions to this that you should know about.

• Web search via Bing: If Copilot needs up-to-date information, it sends a search query to Bing. According to Microsoft, this query consists of a few words derived from your prompt, without the name of the user or the organisation. Neither the DPA nor the EU Data Boundary applies to these search queries; Microsoft is the controller for them in its own right. Web search stays on as long as nobody turns it off.
• Anthropic models: In Word, Excel and PowerPoint, Copilot can use Claude models from Anthropic. Anthropic then acts as a subprocessor under Microsoft’s contract, but the processing takes place outside the EU Data Boundary. In EU tenants created after 25 March 2026, this is switched on by default.
• Flex routing: During peak loads, processing can take place in the US, Canada or Australia. This too is switched on by default in tenants created after 25 March 2026. According to Microsoft, organisations with older tenants should check the setting themselves.

Since 24 July 2026, Copilot has also been using models that OpenAI operates as a subprocessor. These stay within the EU Data Boundary. Processing specifically in Germany, which Microsoft had announced in November 2025, is now off the table: for EU countries, processing is to take place at European level.

Settings you should check

Most of these points are handled by whoever manages your Microsoft 365, in the Microsoft 365 admin center:

• Lock out personal accounts: Ask your team to sign in with their work account only. Technically, you can block personal Microsoft accounts on company devices using Tenant Restrictions v2.
• Web search: The “Allow web search in Copilot” policy turns off web search for everyone or for specific groups. If you work with sensitive data, you should disable it or at least block it for those groups.
• Flex routing: In the Copilot settings, set “Flex routing during peak load periods” to “Do not allow”. Processing then stays in the EU even during peak loads.
• Anthropic models: Check the “Copilot in Microsoft 365 apps with Anthropic models” and “AI providers operating as Microsoft subprocessors” switches and make a deliberate decision.
• Agents: Only enable the agents you really need. Third-party agents are subject to their providers’ own privacy terms.
• Teams meetings: By default, Copilot in meetings requires a saved transcript. The alternative “Only during the meeting” works without a saved transcript. Either way, let participants know.
• Clean up permissions: Before you hand out Copilot licences, review the sharing settings in SharePoint, OneDrive and Teams. Copilot will instantly find folders that are accidentally shared with everyone in the company, such as payroll lists or personnel files.

What can go into a prompt?

With a work account and a DPA, personal data may also go into Copilot, as long as this is necessary for the purpose and the use is documented in your record of processing activities. Neither customer data nor trade secrets belong in the personal Copilot. One thing specific to Copilot is web search: if it is on, keywords from your prompt can be sent to Bing, outside the contract. So for sensitive content, the rule is: turn web search off or restrict Copilot to work data.

Special case: professional secrecy

Law firms, tax advisory firms, medical practices and other professionals bound by professional secrecy are also subject to Section 203 of the German Criminal Code (StGB). If you give service providers access to client or patient data, you must bind them to confidentiality; a DPA alone is not enough for this. For Germany, Microsoft offers a separate agreement for professionals bound by secrecy, the “Professional Secrecy Amendment”, available through Microsoft partners. It applies to the Online Services, but Copilot is not explicitly mentioned in it. Bing web search is outside the contract in any case. For professionals bound by secrecy, this means: sign the agreement, turn off web search, and only put client or patient data into Copilot after your own assessment. Anonymising it first is the safest option.

Deleted doesn’t always mean deleted

Microsoft stores prompts and responses from Copilot Chat and the licensed Copilot in the user’s mailbox, so that they can be found for audits and legal requests. If someone closes the chat window, the messages are retained in most cases. Users can delete their history via their Microsoft account, and admins can set retention policies. According to Microsoft, even if deletion is set to one day, it can take up to 16 days for the data to be gone for good. So decide how long Copilot histories are kept, and include this in your deletion policy.

What do the data protection authorities say?

• German Data Protection Conference (DSK, 2022): The German supervisory authorities found that, on the basis of Microsoft’s contract at the time, companies cannot demonstrate that they operate Microsoft 365 in compliance with data protection law. No new resolution on Microsoft 365 or Copilot has been issued since.
• Hesse (November 2025): After negotiations with Microsoft, the Hessian Commissioner for Data Protection (HBDI) considers that Microsoft 365 can be used in compliance with data protection law. The review covered the contract, expressly without a technical examination of individual services. Copilot was not part of the review.
• Federal Commissioner (May 2026): The activity report of the Federal Commissioner for Data Protection (BfDI) states that, on the basis of the current contract, the review “still cannot be conclusively carried out”.
• Hamburg (March 2026): For the Hamburg public administration, the supervisory authority considers the use of Microsoft 365 for non-sensitive data to be justifiable.

The bottom line: Microsoft 365 is no longer in a legal vacuum, but it is not approved across the board either. There is no assessment of Copilot by any authority. It is up to you to be able to justify and document that your use complies with data protection law.

What are your obligations?

• Document the contract: For business plans, the data processing agreement (Microsoft DPA) is automatically part of the contract. File the current version with your records.
• Update your record of processing activities: Copilot is a processing activity in its own right, with its purpose, data categories and the subprocessors involved.
• Check whether you need a DPIA: If the licensed Copilot accesses emails, chats and documents across the whole company, employee data is affected on a large scale. A DPIA is then the obvious step.
• Involve the works council: Copilot logs who asked what. This makes it capable of monitoring behaviour or performance, and as a rule it is subject to co-determination under Section 87(1) no. 6 of the Works Constitution Act (BetrVG).
• Train your team: Since the amendment of 27 July 2026, Article 4 of the EU AI Act requires you to take measures to support your team’s AI literacy. You do not have to guarantee a particular level, but you do need to be able to prove the training.
• Labelling only in special cases: You do not have to label normal work done with Copilot. It is different for realistic AI images and for texts on matters of public interest that have not undergone editorial review. If you build your own customer-facing chatbot with Copilot Studio, you may count as a provider yourself. You will find the details in our article on AI labelling requirements.
• Set rules: An AI policy sets out which account your team may use Copilot with, for which purposes and with which data.

Latest developments as of October 2026

A lot changed with Copilot in summer 2026. Microsoft renamed its products and introduced a new address for the business app (copilot.cloud.microsoft). Since 24 July 2026, OpenAI models, with OpenAI as a subprocessor, have been switched on by default. In newly created EU tenants, Anthropic models and flex routing are also enabled out of the box, both outside the EU Data Boundary. If you have been using Microsoft 365 for some time, you should therefore go through the settings now rather than relying on how things stood in 2025.

How to set up Copilot properly with Klaus

Copilot is rarely the only AI tool in a team, and that is exactly why it pays to look at the bigger picture. In the free onboarding chat, Klaus adds Copilot to your AI inventory as a profile, with its purpose, type of use and data categories, and classifies it: allowed, allowed with conditions, or prohibited. The conditions from this article, such as work account instead of personal account or no client data while web search is active, go into your AI policy as a PDF.

In the assessment project, you work through the technical and organisational points as prioritised tasks, and in the training your team learns the rules using your own tools as examples, Copilot included.

Conclusion

Copilot can be used properly in a business if three things are right: the work account instead of a personal account, deliberately chosen settings for web search, Anthropic models and flex routing, and cleaned-up permissions before the licensed Copilot is let loose on your data. There is no official approval for Copilot. But with documented settings, a record of processing activities and clear rules for your team, you have good arguments if anyone asks.