Is Microsoft 365 Copilot GDPR Compliant? The Oversharing Problem, and the Two Toggles That Change the Answer

Microsoft 365 Copilot can be used in compliance with the GDPR, and Microsoft's own contractual and technical position is largely in order. There is one condition, which Microsoft states itself. Copilot surfaces whatever your users can already access, so where SharePoint permissions are broader than intended, Copilot makes that content easy to find.

Microsoft has renamed the product Microsoft Copilot and states that the change makes no difference to security, compliance or privacy for organisations. This guide uses the earlier name because it is still the more commonly searched.

This guide follows the structure of the ChatGPT API guide and the Claude API guide: what Microsoft handles, what you need to configure, and what you need to document. Quotations are from Microsoft Learn pages and a Microsoft Message Center notice, read on 5 September 2026 unless stated otherwise, with each page's own date given.

Get articles like this. Compliance Engineering, practical AI compliance for founders and Microsoft 365 administrators, by a CIPP/E certified practitioner.

Need this checked for your tenant? A £500 scoping review covers your Copilot settings, the subprocessor settings, sharing defaults, DPA position and DPIA, with a written report within one week.

Copilot Chat and the paid Copilot licence

Copilot Chat is, according to Microsoft's licensing page (dated 19 May 2026), "automatically included with an eligible Microsoft 365 subscription at no extra cost". The paid Copilot licence is an add-on, and the two differ in the data they can access.

Microsoft's enterprise data protection page (dated 29 May 2026) states the distinction: "Microsoft Copilot Chat uses the user's context to create relevant responses. Microsoft Copilot also uses Microsoft Graph data." Microsoft Graph data is your organisation's content, and the paid licence works across SharePoint, OneDrive, Exchange and Teams content, while Copilot Chat does not.

Both are covered by the same terms, as the same page states: "The use of Microsoft Copilot and Microsoft Copilot Chat, as used by organizations, is covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms, with Microsoft acting as a data processor."

The Article 28 processor contract is therefore in place for both from the outset, without a separate signature. The rest of this guide concerns the paid licence, because it is the product that accesses your organisation's files.

Why Copilot appears to see everything in SharePoint

The typical report is that a user asked Copilot about pay, a restructuring or a client, and it answered from a document the user was not meant to see.

Microsoft's privacy page (dated 9 July 2026) explains the mechanism:

"Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions. It's important that you're using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content within your organization."

The first sentence describes how Copilot works, and the second places responsibility for permissions on the customer.

Copilot applies permissions exactly as they are set. In a tenant that has grown over several years, permissions have often drifted without anyone noticing. Typical examples are a library shared with Everyone except external users years ago, a finance folder whose permission inheritance was broken by someone who has since left, or an HR site with no owner. That content was accessible before Copilot was introduced, but organisation-wide search rarely surfaced it, so the exposure went unnoticed.

Microsoft's own example on the Restricted SharePoint Search page (dated 6 July 2026) describes the problem through a marketing specialist who asks Copilot for budgeting information: "Contoso Electronics has a budgeting site with important business information. Most people don't know about this site, so the site owner hasn't set up proper permissions and hasn't followed correct data governance process." The site is open to a user who was not meant to see it, and Copilot answers from it.

Under the GDPR, this is a failure of security under Article 32 and of confidentiality under Article 5(1)(f). Both failures existed before the licence was purchased, although it is Copilot that makes them visible.

Restricted SharePoint Search is being retired

Microsoft's first response was an interim control called Restricted SharePoint Search. It allowed an administrator to maintain an allow list of up to 100 sites, so that Copilot would draw only on those sites and on content the user had already accessed.

Microsoft has consistently described the limits of this control. The same page states that "it's important to note that Restricted SharePoint Search isn't a security boundary and doesn't change any permissions on SharePoint sites". It adds: "Neither Copilot nor Restricted SharePoint Search prevents users from accessing content they own or previously accessed."

The page now states that the control is being retired: "Restricted SharePoint Search is retiring. Starting July 31, 2026, new enablement is blocked." Message Center notice MC1395311, published on 18 June 2026, sets out the remaining timetable: the feature is fully retired on 31 January 2027, with no extensions or exceptions, and the PowerShell cmdlets are removed on 28 February 2027.

The notice also warns: "If no action is taken, restricted content may become discoverable after RSS retirement."

An organisation that enabled Restricted SharePoint Search and has treated the oversharing problem as resolved therefore has until 31 January 2027 to address the underlying permissions.

Microsoft's recommended replacement

The replacement is Restricted Content Discovery. Microsoft's page (dated 27 July 2026) describes it as "a temporary governance control that gives organizations time to review and right-size access while continuing their Copilot deployment." It is applied site by site, in the SharePoint admin centre or through PowerShell, and it removes a site's content from organisation-wide search and from Copilot.

Microsoft's documentation also states that the control does not change permissions, that it depends on particular licences and that it can be slow to apply on large sites:

1. It does not change permissions: "Restricted Content Discovery doesn't change existing permissions. Users who already have access to content can continue to access that content directly."
2. It requires a Copilot licence and SharePoint Advanced Management, which Microsoft states is included with Copilot licences.
3. It can take time to apply on large sites: "For sites with more than 500,000 items, an update to Restricted Content Discovery could take more than a week to fully process and reflect in search and Copilot experiences."

Beyond the interim control, Microsoft's deployment blueprint (dated 6 May 2026) sets out three stages: remediate oversharing, set up guardrails and meet regulatory requirements. The detailed guidance (dated 17 April 2026) is the closest Microsoft publishes to a checklist, and its sequence is the right one:

• Run the SharePoint Advanced Management content management assessment and the Purview data risk assessment to identify sites "with oversized audiences, EEEU usage, broken inheritance, inappropriate sharing, and those that are inactive or ownerless". EEEU refers to Everyone except external users, the most common cause of oversharing.
• Apply Restricted Content Discovery to high-risk sites while they are reviewed.
• Run site access reviews so that owners remove excess users and company-wide sharing links, restore broken inheritance and confirm site ownership.
• Remove the interim control, then change tenant defaults so that new sites do not recreate the problem: restrict Anyone links and company-wide sharing groups, require sensitivity labels when sites are created, and apply Restricted Access Control to business-critical sites.

Microsoft's licensing page offers the Copilot add-on to Business Basic, Business Standard and Business Premium tenants. The remediation guidance, however, states that the capabilities it describes require "Microsoft 365 E3 or Microsoft 365 E5 (or Office 365 E3 or Office 365 E5)". A tenant on a Business plan may therefore buy the licence and then lack some of the tools the remediation guidance relies on. If you are on a Business plan, confirm the position with your reseller before purchase.

Two settings that change the legal position

The issues above concern access control within your tenant, whereas the following settings change where processing takes place and, in one case, who the processor is.

Anthropic models

Microsoft offers Anthropic's Claude models in Copilot, Researcher, Copilot Studio and the Microsoft 365 apps, with Anthropic engaged as a Microsoft subprocessor. Microsoft's page on this (updated 18 September 2026) states that the models are enabled by default "for most customers in commercial cloud (excluding EU/EFTA and UK)". For the EU, EFTA and the UK, the setting is available but "the default is set to No users", so an administrator must enable it. The setting is in the Microsoft 365 admin centre under Copilot, Settings, AI providers operating as Microsoft subprocessors.

Microsoft states the effect of enabling it:

"Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments."

For standard Anthropic models, Microsoft's Product Terms and DPA continue to apply, and Anthropic acts as a subprocessor under Microsoft's oversight. The Article 28 chain is therefore maintained, but a statement in your records that processing remains within the EU Data Boundary is no longer accurate once the setting is enabled.

Microsoft's page also describes "Fable-class models", such as Fable 5.0 and Fable 5.1, which may be offered on different or additional terms. For certain eligible organisations, Fable 5.1 is available with Anthropic as a subprocessor, Microsoft's Product Terms and DPA apply, and Anthropic does not retain customer content. Microsoft directs organisations to their account team to confirm eligibility.

Models that Microsoft labels "Anthropic models with Data Retention", for which Microsoft gives Claude Fable 5 and Claude Mythos 5 as examples, are subject to a different arrangement. For these models, the page states that data "is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA" and that "Anthropic acts as an independent processor". Use of the models "is subject to acceptance of Anthropic's Commercial Terms of Service and Anthropic's Data Protection Addendum." Anthropic "stores most inputs and outputs for up to 30 days before deleting them", may retain flagged content for up to two years, and may retain trust and safety classification scores for up to seven years.

Enabling these models therefore creates a new processor relationship, under a separate contract and with its own retention periods. The setting is off by default in all regions and requires a separate opt-in, even where standard Anthropic models are enabled. If it is enabled, it needs its own entry in your records of processing and a review of your DPIA, which is unlikely to have considered Anthropic.

The page also notes, for organisations in the EU, EFTA or the UK that enabled Anthropic models under the earlier arrangement: "you need to opt in again. The toggle is set to Off by default." A tenant that believes Claude is enabled may therefore find that it is not, and re-enabling it means accepting the current terms.

Web grounding

Copilot can send a search query to Bing to improve a response. The enterprise data protection page sets out the legal effect: "The Bing search service operates separately from Microsoft 365 and has different data-handling practices covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement. This means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations." A footnote on the same page adds that "The EU Data Boundary doesn't apply to web search queries."

Microsoft limits what is shared: the query is "generated from the prompt into a few words", sent "with user and tenant identifiers removed", is not shared with advertisers and is not used for training. Your documents remain in the tenant, and what is sent is a short query, as a controller-to-controller transfer outside the DPA, which your privacy notice may not currently describe. An administrator can disable web grounding.

What Microsoft provides

Microsoft's own commitments are extensive, and with the tenant configured as described above, Copilot can be used compliantly.

Prompts, responses and data accessed through Microsoft Graph "aren't used to train foundation LLMs", a commitment stated three times on the privacy page and reflected in the contract, so no opt-out is needed. Interactions are stored "in alignment with contractual commitments with your organization's other content in Microsoft 365", encrypted, searchable by administrators through Purview, deletable by users and subject to the retention policy you set. Microsoft has opted Copilot out of the Azure OpenAI abuse monitoring that involves human review of content. For EU customers, "Microsoft Copilot is an EU Data Boundary service", and Copilot was added to the data residency commitments in the Product Terms on 1 March 2024.

Microsoft Corporation is also certified under the EU-US Data Privacy Framework. When the official register was checked on 9 October 2026, its EU-US certification, UK Extension and Swiss-US certification were all shown as "Active", with the current period running to 31 August 2027. The register should be checked rather than assumed, because OpenAI and Anthropic have no entry under any status. Copilot is also covered by ISO 42001 and ISO 27001.

For organisations considering workplace monitoring, Microsoft states that it restricts "generative AI or models from being used" to make "inferences, judgments, or evaluations about an employee's performance, attitude, internal or emotional state, or personal characteristics." This does not resolve the UK law on monitoring staff with AI, but it removes one use that a DPIA would otherwise need to address.

What to document

A Copilot deployment is a processing activity and requires the same documentation as any other, including the following.

A DPIA. Copilot works across the whole tenant, including HR and finance content, for every licensed user, which is the kind of large-scale, systematic processing that Article 35 addresses. The DPIA should record the oversharing assessment, the remediation carried out, and which interim controls are in place and when they will be removed. If Anthropic models are enabled, the DPIA should address them specifically.

An entry in your records of processing. The processor is Microsoft, under the DPA. Where an administrator enables third-party models, OpenAI and Anthropic act as Microsoft subprocessors for those models, as Microsoft's documentation describes. The processing location is the EU Data Boundary, with the two exceptions described above. If Anthropic models with Data Retention are enabled, add a separate processor entry for Anthropic, with its own DPA and retention periods.

A retention policy for Copilot interactions, set in Purview, because by default they are retained with other Microsoft 365 content.

A dated record of the Restricted SharePoint Search position: whether it was enabled, whether it remains enabled, and the 31 January 2027 retirement date.

Initial checks

In the Microsoft 365 admin centre, go to Copilot, Settings, AI providers operating as Microsoft subprocessors. Note whether Anthropic is set to No users or to specific users, and whether the Data Retention setting is enabled.

Then ask your SharePoint administrator whether Restricted SharePoint Search is enabled, since the answer shows whether the January 2027 retirement affects you. Ask also how many sites are shared with Everyone except external users, which indicates the scale of the remediation required, because Copilot can answer from each of those sites until their permissions are corrected.

Record what you find and the date. If the sharing assessment has not been carried out, start there.

Want your Copilot tenant reviewed against its actual settings? A £500 scoping review covers your subprocessor settings, sharing defaults, interim controls, DPA position and DPIA, with each finding referenced to Microsoft's own documentation and a written report within one week.

Sources read on 5 September 2026: Microsoft Learn, "Data, Privacy, and Security for Microsoft Copilot" (dated 9 July 2026, re-read 16 October 2026 for the third-party model subprocessors); "Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat" (29 May 2026); "Restricted SharePoint Search" (6 July 2026, re-read 2 October 2026); "Restrict discovery of SharePoint sites and content" (27 July 2026); "Secure & Governed Data Foundation for Microsoft Copilot" (6 May 2026); "Configure a secure and governed foundation for Microsoft Copilot" (17 April 2026); "License Options for Microsoft Copilot" (19 May 2026); Microsoft 365 Message Center MC1395311 (18 June 2026). "Anthropic models in Microsoft Online Services" (updated 18 September 2026) was re-checked on 2 October 2026, and the Data Privacy Framework register on 9 October 2026. This page is general information, not legal advice.