AI and privacy
Copilot shows what employees can already open, including overshared files. What Microsoft documents, what the DPIAs say and what to arrange first.
Copilot sees what the employee may see themselves. Microsoft writes that Copilot only shows organisational data for which the user has at least read permissions. That is a clear boundary, but only as good as your permissions. If a folder of personnel files is open to the whole organisation, Copilot can draw on it for anyone asking a question.
That statement appears in Microsoft's documentation on Copilot data, privacy and security, which we consulted on 13 October 2026. It also states that the product is now called Microsoft Copilot and that the old name Microsoft 365 Copilot will remain in licences and screens for a while. This article uses the name most organisations know.
This article explores one specific question: what happens to documents in your own environment when you enable Copilot. Our page on AI chatbots and the GDPR covers the broader question of what is permitted with personal data in a chatbot.
Copilot is not a standalone chatbot into which you drag a file. It is a layer across your entire Microsoft 365 environment. According to Microsoft, it combines three things: language models, content in Microsoft Graph (emails, chats, documents, calendars and meetings), and the apps you work in.
When an employee asks a question, Copilot searches everything that account can access. Microsoft explains that the search index follows the user's access boundary, so only content the current user may open is used. No new permission is added. What changes is the effort: information that once required a targeted search through folders now appears in a summary.
The boundary also includes what you share with people outside your organisation, for example through shared Teams channels. Connecting external sources through connectors or agents extends the reach further. Microsoft recommends reading agents' developers' terms and privacy statements, because these determine what happens to your data.
Oversharing means information is accessible to more people than necessary. It is rarely a deliberate choice. It develops through convenience and over time.
Microsoft itself lists these patterns in its guide to establishing a secure foundation for Copilot: sites with an overly broad audience, organisation-wide links, broken inheritance and inactive or ownerless sites.
The GDPR requires you to protect personal data and restrict access to people who need it for their work. A personnel file the whole organisation can open was therefore already a problem before Copilot existed. Copilot makes it visible. If a colleague reads data through a summary that they should not have seen, this may be a data breach requiring assessment and potentially notification. Our article on a data breach through an AI chatbot explains how to make that assessment.
A fictitious example. At a firm with forty employees, an old sharing link makes the “HR 2023” folder accessible to everyone. A new colleague asks Copilot about “the arrangements for leave”. The answer also contains a passage from a sickness absence file. Nobody hacked anything. The link did what it had been doing for three years.
The following is what Microsoft writes in its own documentation, as at October 2026. These pages change regularly. Check them before deciding, and compare the documentation with the contractual documents: Microsoft's product terms and data processing addendum. Our article on the data processing agreement with an AI provider explains what to look for in such an agreement.
Microsoft writes that prompts, answers and data retrieved through Microsoft Graph are not used to train the underlying language models, including models Copilot itself uses. Microsoft may use feedback users give voluntarily to improve the product; according to the same page, it does not use it to train those models. Administrators can disable feedback.
According to Microsoft, Copilot is a service within the EU Data Boundary for EU customers: EU traffic stays within that boundary. Since this year, there is a qualification. Microsoft introduced flex routing: during peak demand, the model may process the request outside the EU Data Boundary. According to that page, this may be in the United States, Canada or Australia. Stored data stays within the boundary, apart from a limited amount of pseudonymised data.
Flex routing is enabled by default for environments created after 25 March 2026. If you already had an environment, Microsoft asks you to check the setting in the admin centre. You can disable it; the model's processing then remains within the EU Data Boundary, even during busy periods.
Copilot can also use Anthropic models, with Anthropic acting as Microsoft's sub-processor. According to Microsoft's page about these models, they currently fall outside the EU Data Boundary and are disabled by default for EU and UK customers. An administrator enabling them therefore chooses processing outside that boundary. Certain models “with retention” are also subject to Anthropic's own terms rather than Microsoft's.
Microsoft stores the user's question and Copilot's answer, with references to the sources used. Users can delete their own history. Administrators use a Copilot retention policy to set how long interactions remain and when they are deleted. The data is stored in a hidden folder in the user's mailbox and can be found in a legal investigation. That page does not specify a fixed default period. Determine the period yourself and include it in your retention periods overview and register.
If web search is enabled, Copilot turns the question into a search query and sends it to Bing. Words from the question may appear in that query. SURF recommends that educational institutions block this access. Assess whether your own organisation needs it.
In the Netherlands, two organisations commissioned thorough investigations into Copilot: SLM Rijk, which negotiates with major suppliers on behalf of central government, and SURF, the IT cooperative for education and research. Privacy Company carried out both investigations. They address those sectors' licences and settings, but the findings are useful for every organisation.
The first DPIA appeared in December 2024 and identified high risks. SURF advised against use at the time. Following changes by Microsoft, an update appeared in September 2025: according to Privacy Company, the four high risks had been reduced, leaving two medium and nine low risks.
On 27 May 2026, SURF published the second update. The outcome: two risks remain medium (“orange”).
Flex routing was added as a tenth, low risk. SURF verified that the “EU only” setting remained in place for existing Dutch educational customers.
SURF's advice: remain cautious, choose suitable applications and weigh the risks for each one. Anyone accepting the two medium risks is strongly advised to adopt a responsible AI use policy. Because Microsoft has said it will take no further steps, SURF says no follow-up investigation is planned.
The Dutch central government publishes the DPIA and first and second updates on its strategic supplier management page. We could not open the documents themselves on 13 October 2026. We therefore do not paraphrase the advice to government organisations. If you work in or for government, read the second update and accompanying advice on that page.
Two things to remember. Someone else's DPIA does not replace yours: your data, settings and applications differ. And the investigations concern the business licence with recommended settings, rather than the free version.
| Question | What Copilot does | What you arrange yourself |
|---|---|---|
| Which documents can an answer use? | Everything for which the user has at least read permissions | Tidy up permissions, revoke sharing links, assign owners |
| Does Copilot account for confidential documents? | Follows sensitivity labels' encryption and usage rights | Introduce and apply labels; policy excluding labelled content |
| Is our data used for training? | According to Microsoft, not for the underlying language models | Record in your register; review contractual documents |
| Where is the question processed? | Within the EU Data Boundary, unless flex routing or another provider's model is enabled | Check flex routing and sub-processors in the admin centre |
| How long do questions and answers remain? | Stored with the user until deleted | Configure and document a retention policy |
| Is the answer correct? | No guarantee; Microsoft asks users to check the answer | Train employees; no decisions about people based on a summary |
| Can the use be justified? | Logs interactions for checks and investigations | DPIA, AI policy, arrangements with the works council where appropriate |
As at October 2026, based on Microsoft's documentation. Check the current text before choosing.
A sequence that works, including for a small organisation without its own security team.
None of these steps automatically resolves an organisation's GDPR obligations. This is work you do yourself and must be able to demonstrate. If you are unsure about your DPIA's outcome, put it to your data protection officer or a lawyer.
PrivaSearch does not replace Copilot or solve the permissions problem in your Microsoft 365 environment. It does something different: it makes a defined set of documents searchable, after their personal data has been replaced with pseudonyms and a colleague has checked this.
You connect a SharePoint library read-only. Nothing changes in your source systems. Within PrivaSearch, project membership determines who sees what; administrators do not get automatic access. SharePoint remains authoritative on top of that: with every request, PrivaSearch checks live whether the user may still view the document in SharePoint. This happens for searches, viewing, downloads and through the AI assistant connection. If permissions have been revoked, the document also becomes unavailable in PrivaSearch. The page How PrivaSearch works explains the steps.
The difference therefore lies in what happens after permission checking, which Copilot also performs. An AI assistant searching through PrivaSearch receives only released, pseudonymised passages with a source reference, never the original file. That connection works with Claude, ChatGPT Business and Mistral Vibe. Pseudonymised data remains personal data for your organisation: this is a risk-reducing measure, not an exemption from the GDPR.
You still have work to do here too. Automatic detection sometimes misses things, which is why human review is mandatory. And anything you type yourself into a connected assistant goes directly to that assistant's provider. To see how this works in your situation, book a demo.
No. According to Microsoft, Copilot only shows data for which the user has at least read permissions, and the search index follows that boundary. The problem lies on the other side: many employees can open more than they realise, through old sharing links and broad groups. Copilot does find those documents. Check who can access what first.
Microsoft writes in its documentation that prompts, answers and data retrieved through Microsoft Graph are not used to train the underlying language models. This is the position as at October 2026. Compare the commitment with the product terms and data processing addendum applicable to your contract, and record when you did so.
According to Microsoft, Copilot falls within the EU Data Boundary for EU customers. There are exceptions. With flex routing, the model may process outside that boundary during peak demand, and Anthropic models currently fall outside it. Both are settings an administrator can check and disable. Review them before rolling Copilot out widely.
No product can do that for you. The DPIA Privacy Company carried out for SURF still identifies two medium risks after the May 2026 update, and SURF advises caution and an individual assessment for each application. Whether your use can be justified depends on your permissions, settings, data and your own DPIA.
In many cases, yes. Copilot processes data about employees and people in your documents on a large scale, using new technology. These characteristics readily trigger a DPIA requirement. The SLM Rijk and SURF investigations are a good starting point, but do not replace your own assessment. Have your data protection officer review the outcome.
Copilot works across your whole Microsoft 365 environment, with the user's permissions and original documents. PrivaSearch works per project on documents you deliberately added, after personal data has been replaced with pseudonyms and a colleague has approved this. A connected AI assistant receives only those passages. They are different tools for different questions.
For each Claude plan: what happens to your input, how long it is kept, whether an agreement is in place and where your data is stored. October 2026.
What you need to arrange for each type of data before using an AI chatbot: from names and email addresses to health, criminal records and BSNs.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →