Is Microsoft 365 Copilot GDPR compliant?

Yes

Microsoft · Productivity

Yes. Microsoft offers a Data Processing Agreement (DPA) for Microsoft 365 Copilot, the baseline GDPR control when a vendor processes personal data on your behalf.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Data Processing Agreement: Confirmed; Microsoft publishes a DPA. A DPA is necessary but does not replace your own lawful-basis, DPIA and transfer assessment.
EU data residency: Confirmed; Microsoft documents an EU data-residency option; confirm it is enabled for the account and workload in scope.
Default data training: No by default; Microsoft 365 Copilot is a paid commercial add-on; with enterprise data protection, prompts/responses are not used to train foundation models.
Business-tier training: No by default; Prompts, responses, and Microsoft Graph data accessed by Microsoft 365 Copilot are not used to train the foundation LLMs.

Practical risk: Copilot inherits the user's existing permissions, so over-shared SharePoint/OneDrive content becomes far easier for employees to surface. That is an oversharing and governance risk rather than a training one.

How to make a decision

Check the precise account tier, written contract and intended data before approving Microsoft 365 Copilot. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Microsoft 365 Copilot

Is Microsoft 365 Copilot HIPAA compliant?Is Microsoft 365 Copilot SOC 2 compliant?Is Microsoft 365 Copilot ISO 27001 certified?Does Microsoft 365 Copilot train on your data?

See the full Microsoft 365 Copilot risk profile, with every data-handling fact and its source, or browse all rated AI tools.