Microsoft 365 Copilot

Applies to prompts, responses, and data accessed through Microsoft Graph under enterprise data protection, which covers Microsoft 365 Copilot and Microsoft 365 Copilot Chat for signed-in work accounts.

“Consistent with our other Copilot offers, the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models .”

Copilot interactions are stored in the user's mailbox and governed by the organisation's retention and audit settings, under the same contractual terms as Exchange and SharePoint data.

“With EDP, prompts and responses are protected by the same contractual terms and commitments widely trusted by our customers for their emails in Exchange and their files in SharePoint. / Copilot respects your identity model and permissions , inherits your sensitivity labels , applies your retention policies, supports audit of interactions, and follows your administrative settings.”

Web search queries are outside the EU Data Boundary, and Anthropic models offered inside Copilot are excluded from it and from in-country processing commitments.

“Our commitments to privacy include support for the General Data Protection Regulation (GDPR) , the EU Data Boundary [3] , ISO/IEC 27018 , and our Data Protection Addendum . / [3] The EU Data Boundary doesn't apply to web search queries. / In addition, Anthropic models are currently excluded from the EU Data Boundary and when applicable, in-country processing commitments.”

“Our commitments to privacy include support for the General Data Protection Regulation (GDPR) , the EU Data Boundary [3] , ISO/IEC 27018 , and our Data Protection Addendum .”