Microsoft Copilot and GDPR / AI Act: what your business needs to know

Overview and data processed

Copilot refers to a family of AI assistants from Microsoft, built notably on OpenAI models via Azure. It is important to distinguish Microsoft 365 Copilot (integrated into Word, Excel, Outlook, Teams, for businesses) from the free consumer Copilot. Only the M365 version offers the enterprise contractual framework.

Microsoft 365 Copilot processes the content of your prompts, your M365 documents and data (Graph), generated responses and technical data. Microsoft states that, for M365 Copilot, this data remains within the boundary of your tenant and is not used to train the large foundation models. Consumer Copilot, on the other hand, may use interactions to improve services.

Risks for your business

The main risk shifts: less the transfer of data to a third party (well controlled in M365) than internal over-exposure. Copilot returns information according to existing access rights: poorly configured permissions can expose HR, salary or confidential data to an employee. The risk of confusion between Copilot pro / free Copilot is also real.

Main GDPR risks:

• Residual transfers outside the EU: despite the EU Data Boundary, Microsoft remains subject to the CLOUD Act.
• Access governance: Copilot amplifies permission issues (principle of least privilege).
• Minimisation and purpose: new uses of existing data to be qualified.
• Consumer version used by mistake for professional data.

GDPR obligations

1. Rely on the Microsoft DPA and verify activation of the EU Data Boundary.
2. Audit and correct access rights before deployment (data governance).
3. Record the use in the record of processing activities and conduct a DPIA if high risk.
4. Inform data subjects and prohibit the use of consumer Copilot for professional data.
5. Involve the DPO in configuration.

AI Act obligations and cyber risks

The underlying models are GPAI (provider obligations applicable since 2 August 2025). As a deployer, you must ensure transparency (Article 50), human oversight and AI literacy. Use integrated into HR decisions/evaluations may fall under high risk (Annex III).

Cyber risks: internal exposure via overly broad permissions (over-sharing); prompt injection via compromised documents/emails ingested by Copilot; shadow AI with the consumer version. NIS 2 entities must integrate these vectors.

Best practices and checklist

Deploy only Microsoft 365 Copilot (never the consumer version for professional use). Activate the EU Data Boundary and leverage the Microsoft DPA. Conduct an 'access governance' project (least privilege) before activation. AI charter, training, AI lead, documentation in the record of processing activities.

• ☐ Microsoft 365 Copilot version (not consumer)
• ☐ Microsoft DPA in force; EU Data Boundary activated
• ☐ Access rights audit completed
• ☐ Use recorded in the record of processing activities; DPIA if high risk
• ☐ Transparency Art. 50; teams trained; DPO involved

Sanctions, conclusion and recommendations

Sanctions (cumulative): GDPR up to €20M or 4% of global turnover; AI Act up to €35M or 7% (prohibited practices) / €15M or 3% (other infringements). Microsoft's contractual framework does not exempt the company from its responsibility: a leak due to poorly managed permissions remains attributable to the controller.

Recommendation: Microsoft 365 Copilot is a good compliance choice if — and only if — you first address access governance and ban the consumer version for professional data. Get support for the DPIA and configuration. Compare with ChatGPT, Gemini and Mistral.