Microsoft Copilot data privacy for business: which Copilot does what with your data

Three Copilots, three sets of rules

Microsoft has renamed its business Copilots: "Microsoft 365 Copilot" is now "Microsoft Copilot", and "Microsoft 365 Copilot Chat" is now "Microsoft Copilot Chat". The old names still appear in licences and menus. For data protection, three variants matter:

All of this now lives in one Copilot app (in the browser at copilot.cloud.microsoft). Users switch between personal and work accounts with an account switcher. According to Microsoft, data does not flow from one account to the other. The work account shows a "Work" label under the profile and a green data protection shield.

What happens to prompts in a work account

• No training: according to Microsoft, prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.
• Stored like email: prompts and responses are logged and stored in Exchange for audit and eDiscovery. Uploaded files are saved to the user's OneDrive. You set retention with Microsoft Purview.
• EU Data Boundary: for customers in the EU and EFTA – which includes Switzerland – Copilot traffic stays within the EU Data Boundary.
• Two exceptions: web searches via Bing are not covered by the DPA or the EU Data Boundary; Microsoft acts as an independent controller there. Only a few search terms are sent, without user or tenant identifiers. Anthropic models are also currently excluded from the EU Data Boundary. Admins can control both, for example web search with the "Allow web search in Copilot" policy.

Risk 1: the wrong account

Because personal and work accounts sit in the same app, one click is enough for a customer list to land in personal Copilot. No contract with your company applies there. Microsoft's Privacy Statement says it may use data to train its AI models. The privacy FAQ for personal Copilot counts uploaded files as training data too and describes an opt-out switch in the privacy settings. Entra ID accounts are excluded from this training.

Blocking the address does not help: Microsoft explicitly advises against blocking copilot.cloud.microsoft and recommends tenant restrictions instead (see below).

Risk 2: oversharing with Microsoft Copilot

Licensed Microsoft Copilot only shows what a user is allowed to see. The catch: many users are allowed to see too much. A payroll sheet in a SharePoint folder shared with "people in your organisation" used to be hard to find. With Copilot, one question is enough. Microsoft itself notes that SharePoint sets sharing to the most permissive option by default.

What helps:

• Review sharing: data access governance reports in SharePoint show sites with organisation-wide or "Anyone" links.
• Shield sensitive sites: Restricted Access Control limits a site to one group; Restricted Content Discovery keeps it out of Copilot and organisation-wide search. Both are part of SharePoint Advanced Management, which Microsoft says is included with the Copilot licence.
• Sensitivity labels: Copilot honours the encryption and usage rights set by sensitivity labels.

What small-business IT can do

1. Require the work account: staff should only use the account with the green shield for work. Put this in your AI policy.
2. Block personal accounts technically: tenant restrictions v2 in Microsoft Entra can block sign-in with personal Microsoft accounts on managed devices or the company network. This requires Entra ID P1 or P2.
3. Use Purview DLP where licensed: DLP policies for the "Microsoft 365 Copilot and Copilot Chat" location can block prompts containing sensitive information types (currently in preview), stop web search for them, or exclude files with certain labels. One limit Microsoft names: DLP does not scan the content of files uploaded directly into a prompt.
4. Decide on web search and extra models: set in the Copilot settings whether Bing web search and Anthropic models are allowed.
5. Train people: show briefly how to recognise the work account and what never goes into a chat. See the guide on AI literacy training.
6. Add a check in the browser: an extension checks input right at the text field – including where no Purview licence applies.

Legally, your company remains responsible: the Swiss FADP requires a contract for processing by Microsoft (Art. 9), the GDPR a data processing agreement (Art. 28). For sensitive data, a data protection impact assessment may be needed (Art. 22 FADP, Art. 35 GDPR). This guide is not legal advice.

Frequently asked questions