Is Copilot GDPR compliant?

Compliance depends on how you use it. A Microsoft 365 business plan with enterprise data protection is the safer route for personal data than the free consumer app.

Does Microsoft Copilot share my data?

Microsoft uses conversation data in the ways described in its privacy statement, including for ads on personal accounts unless you turn personalised ads off.

Home › Answers › Data, privacy and GDPR

Are Microsoft Copilot chats private?

Last checked: 17 October 2026 · The AI Till, UK

Short answer

Depends which Copilot you use. With a personal Microsoft account, Microsoft keeps your conversation history for 18 months and may use chats to train its AI models unless you opt out. Microsoft 365 Copilot signed in with a work or school account comes with enterprise data protection, and Microsoft says prompts and responses aren't used to train its foundation models.

Personal Copilot (free app, copilot.com)

Microsoft's privacy controls page says you can:

Opt out of model training: Profile, then Privacy, then switch off "Training on conversation activity" and "Training on voice conversations".
Turn off personalisation and memory, or ask Copilot to forget specific things.
Turn off personalised ads in your Microsoft ad settings.
Delete conversation history; otherwise it's kept for 18 months.

Opting out of training doesn't stop Microsoft using conversations for other product improvements, advertising, safety, security and compliance, as set out in its privacy statement. Microsoft notes the page applies to the older Copilot app; the updated app released on 18 August 2026 has its own privacy article.

Microsoft 365 Copilot at work

If you sign in with a work account (Entra ID), Microsoft's enterprise data protection applies. Microsoft says prompts, responses and data from Microsoft Graph aren't used to train foundation models. This is the route to use for customer data.

What a small business should do

Use Copilot through your Microsoft 365 business account for anything involving customers or staff, and keep personal accounts for general questions. Write it down in an AI policy.

Sources

Checked 17 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.

More on data, privacy and gdpr

All data, privacy and gdpr answers · All answers · Guides · AI tools directory

Get one useful AI tool in your inbox each weekday

Free, plain English, five minutes to read. Unsubscribe any time.

See our privacy notice.