Official documentation checked October 14, 2026.
Using organizational Microsoft Copilot does not automatically make a processing activity GDPR-compliant. Microsoft provides contractual commitments and technical controls, but your organization must assess its purpose, personal data, users, and configuration. There is no single “GDPR compliant” or “EU Data Boundary” switch that completes that assessment.
This is an operational review guide, not legal advice. Have your data protection officer or qualified adviser approve the actual use case before processing high-risk personal data.
Assess the use case before choosing controls
Write down the task, affected people, data categories, source systems, intended recipients, and retention needs. “Summarizing approved policy documents” and “evaluating employee performance from messages” are materially different activities; a common product name is not a sufficient assessment.
The European Data Protection Board’s DPIA guidance requires a prior assessment where processing is likely to create high risk. Microsoft also provides information for controllers preparing an assessment. A template can support your work; it cannot decide the lawfulness of your particular activity.
Record the approved purpose, applicable legal basis, necessary data, human review, and unresolved risks. Do not treat “not used for foundation-model training” as an answer to every question about automated decisions, transparency, or data minimization.
Review the actual data flows and contractual scope
Start with the Product Terms and Data Protection Addendum applicable to the organizational service. Microsoft’s enterprise data protection explanation distinguishes protected prompts and responses from web queries, which have separate handling and are not within the EU Data Boundary commitment.
Inspect the exact model and any agent or connector. Microsoft’s Anthropic documentation identifies model-specific terms, retained-data offerings, and residency exceptions. Do not infer coverage solely from the tenant’s displayed data location.
Have the responsible adviser review any relevant international transfers and safeguards. Moving a tenant or selecting a country is not a substitute for that assessment. Maintain a list of approved features and external services so a later rollout does not silently expand the assessed scope.
Separate interaction content, audit records, and rights requests
Copilot interaction content can be retained. Ordinary audit-event metadata is not the same as an export of every prompt, response, attachment, source file, and memory. Microsoft documents Copilot audit events and a separate eDiscovery search workflow.
For an authorized request, agree its scope with the privacy team, identify relevant users and workloads, and use the documented Copilot item-class conditions and appropriate locations. Test the search against known sample records. A subject-line search for “Copilot” alone is not a dependable collection method.
Review results for relevance and other people’s information before disclosure. The EDPB rights guide explains response timing, including the usual one-month period and conditions for extension. Do not equate exporting a mailbox with completing the legal response.
Do not remove holds or run purge operations merely to answer an access request. Deletion requires a separate authorized decision, with applicable retention and preservation obligations considered.
Test controls and record the approval decision
Have the administrator verify underlying permissions, the selected sensitivity protection and DLP policies, web-search controls, and the applicable interaction retention policy. A label’s name alone does not establish encryption or a Copilot processing restriction.
- Use synthetic or nonsensitive pilot material to test allowed and disallowed users.
- Check that the expected audit and retained-content evidence is available to authorized reviewers.
- Document coverage gaps, license dependencies, and any excluded features.
- Obtain the responsible owner’s decision and set a review trigger for new models, data sources, or purposes.
The result should be a documented, scoped decision—not a claim that enabling a few administrative settings guarantees GDPR compliance.