Blog · Published · Updated
Copilot and GDPR: what Microsoft 365 Copilot does with company data
Short answer
Microsoft 365 Copilot can be used in line with the GDPR. Microsoft processes prompts and responses as a processor under the Data Protection Addendum, does not train foundation models on them, and for EU customers Copilot is covered by the EU Data Boundary. Three places need checking: Bing web search, Anthropic models and oversharing of files in SharePoint.
- net for implementation for a team of up to 10 people, paid once
- from €1,150
- from start to work of the entire team
- 2 weeks
- after this time, we measure the effect on the same tasks
- 30 days
- conversation with an engineer and a written plan within 2 business days
- €0
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Syntalith · 3 min read
Statistics
Copilot and company data: statistics 2026
0.8 h
a month per person is all you need to save for a $30 Microsoft 365 Copilot licence to pay back, at €34.90 an hour. Scenario.
48.8%
According to Eurostat (2025), 48.8% of EU enterprises that considered AI and did not use it named concerns about data protection and privacy.
52.5%
According to Eurostat (2025), 52.5% of EU enterprises that considered AI and did not use it named a lack of clarity about the legal consequences.
49%
According to the European Commission (2026), 49% of EU SMEs and mid-caps name legal uncertainty as a barrier to AI.
Source: European Commission, Flash Eurobarometer 578 (2026) ↗
84%
According to the European Commission (2025), 84% of Europeans think AI requires careful management to protect privacy and ensure transparency in the workplace.
Source: European Commission, Special Eurobarometer 554 (2025) ↗
Figures checked: 22 October 2026
Copilot Chat or Microsoft 365 Copilot
Microsoft sells two products with similar names, with access to different company data. The facts below come from Microsoft documentation checked on 15 October 2026. This is not legal advice.
Copilot Chat
no extra charge
With a qualifying Microsoft 365 subscription. Uses the web and files the user uploads.
Microsoft 365 Copilot
$30
Per user a month on an annual subscription. Also uses the email, files and chats the user has access to.
What Microsoft states about data
Using Copilot in an organisation is covered by the Data Protection Addendum and the Product Terms, under which Microsoft acts as a processor. Prompts, responses and data from Microsoft Graph do not train foundation models (enterprise data protection). For EU customers, Copilot is covered by the EU Data Boundary. Prompts and responses go into an activity history, which the administrator can search and audit in Microsoft Purview.
Three places to check for Copilot and GDPR
- 01Bing web searchA few words from the prompt go to Bing outside the EU Data Boundary. A DLP rule can block sensitive data in web search.
- 02Anthropic modelsExcluded from the EU Data Boundary. The general setting is off by default in the EU, but Word, Excel and PowerPoint have a separate setting, on by default in new EU organisations.
- 03File permissionsCopilot will find any file someone shared with the whole organisation or through a link for anyone.
Microsoft recommends removing oversharing before the rollout (preparing your data). Access reports in SharePoint, excluding sensitive sites from Copilot search (Restricted Content Discovery), sensitivity labels and DLP rules all help.
What the GDPR still requires of the company
Microsoft answers for its part as a processor. The company, as controller:
- Sets the purpose and the legal basis for personal data in Copilot
- Tells employees that prompts and responses are stored and may be reviewed
- Assesses whether a data protection impact assessment is needed (Article 35 GDPR), for example when employees are evaluated
- Adds Copilot to the record of processing activities and sets how long the history is kept
- Trains the team, because Article 4 of the AI Act requires measures that support AI literacy
In Poland, the data protection authority (UODO) published lists of questions to ask before rolling out an AI tool on 6 August 2026, with a separate set for small and medium-sized companies (UODO). According to Eurostat (2025), 52.5% of EU enterprises that considered AI and did not use it named a lack of clarity about the legal consequences.
When a Microsoft 365 Copilot licence pays back
- Licences
- 20 × $30 = $600 (€535) a month
- An hour of work
- €34.90
- Break-even for the team
- 15.3 h a month
Per person
0.8 h a month
Price from Microsoft's US price list of 15 October 2026, on an annual subscription, before tax. Converted at the ECB rate of 1.1205 USD per euro on 22 October 2026. €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat.
The licence pays back if each user saves under one hour a month. That is a low threshold, but only with permissions in order: without that, Copilot will sooner show documents an employee should not see.
Copilot, ChatGPT or Claude
With every tool you ask the same things: who processes the data, where, whether they train models on it and what the employee sees. ChatGPT Business has no option to store data in Europe, and the direct Claude API processes requests in the US or globally. The details are in the articles ChatGPT and company data and is Claude GDPR compliant. An AI audit for the AI Act and the GDPR costs from €700 net at Syntalith and ends with a register of AI tools, a list of settings to change and a training plan for the team. Permissions, settings and training are covered by the Copilot rollout from €1,150 net.
„I already use AI.”
Your people too. Just no rules.
From our conversations with companies
5 na 10 employees paste sensitive data into private AI accounts: contracts, invoices, customer data.
In ESET survey (2026)
1 na 10 admits this in the survey.
Customer data pasted into a private AI account without an data processing agreement is a violation of the GDPR.
Don't worry, we won't tell anyone :)
What do we see in companies that "already use"
- Only ChatGPT or Claude accounts, without plugins, skills, integrations and MCP servers with company tools.
- Company programs are not connected to AI. People still click through systems and Excel, and enter chat data manually.
- Lack of company standards: everyone writes instructions in their own way, no one shares what works.
- No rules for personal data, GDPR and company secrets.
- No limits and no visibility: no one knows who uses AI, how much and for what.
62% Polish employees use AI at work · 27% companies have written rules for working with AI.
Source: ESET and DAGMA, Cyberportrait of Polish business 2026 (March 2026, 1,026 people) ↗
ChatGPT or Claude space review
Accounts, permissions, rules for working with data and 5 tasks set for the team. 1 day.
€450 net
Company accounts, rules of working with data and team training in 2 weeks, from €1,150 net.View implementation for the team →
„Is my data safe?”
Yes. You choose where they go: from your company account to the model on your server.
00Employee's private account
Customer and company data ends up in an account that the company cannot see or control. There is no data processing agreement, so it is a violation of the GDPR. When an employee leaves, the chat history goes with them.
01ChatGPT or Claude corporate account
The provider does not use your data to train models. A copy of the queries remains in his logs for up to 30 days.
02API with zero retention (ZDR)
The provider processes the request and does not save anything. It requires his consent, we prepare the application together.
03Processing in the EU
Queries are counted and stored in Europe: OpenAI in the EU region, Claude via clouds with the EU region.
04Model at your place
The open model runs on your server or in your cloud in the EU. The data does not go outside the company.
What we do with every implementation
- Confidentiality agreement and data processing agreement before we receive any data.
- You choose the cases for the prototype and we anonymize them upon request.
- The data stays in the EU and we delete it after the test.
- Corporate accounts with an administrator on your side.
When data cannot leave the company
The open model runs on your server or in your cloud in the EU. To choose from:
- White-tailed eagle
- Polish model, SpeakLeash and ACK Cyfronet AGH
- PLLUM
- Polish model, HIVE consortium commissioned by the Ministry of Digitization
- Qwen
- Alibaba
- GLM
- Zhipu AI
- DeepSeek
- DeepSeek
We select a model for the task and check it on your cases. We run it, tune it and maintain it.
Source: Bielik and PLLuM, ACK Cyfronet AGH ↗ · PLLuM, Ministry of Digitization ↗
Do you have a lot of your own data? We will fine-tune the small model.
- 1 Your examples
- 2 tuning
- 3 test on new cases
- 4 model at your place
When you have thousands of similar emails, documents or reports, we teach a small open model based on your examples. It works for you, responds quickly and costs less to maintain than a large model. We measure quality on issues that the model has not seen while learning.
Przemysław and Piotr did it in large programming and consulting companies. Artem did it before and does it today at Syntalith. It's about models on your own infrastructure, tuning and quality measurement.
You choose the protection level during the interview. We sign the data processing agreement before we see any data.Schedule a free analysis →
Price
Three packages. You know the price right away.
Team of up to 10 people
from €1,150
net, paid once · 2 weeks
Company, from 11 to 40 people
from €2,300
net, paid once · 3–4 weeks
Organization, over 40 people
from €4,600
net, paid once · 6–8 weeks
- The same packages once you have licenses. To start, an inspection of the space in 1 day is enough: €450 net.
- You buy ChatGPT Business licenses directly from OpenAI, without our margin: USD 20 per person per month for an annual payment or USD 25 for a monthly payment for 2 people.
From conversation to measurement
01 · 30 min
Free process review€0
An engineer picks 3 to 5 of your team's tasks with you. Written plan within 2 working days.
02 · 2 weeks
Rolloutfrom €1,150
Accounts and roles, rules for working with data, training on your team's tasks. You buy licences directly from the provider.
03 · after 30 days
Measurementincluded
We compare task times before and after. We name in writing the tasks worth handing to a system.
or call+48 888 78 48 78WhatsAppMon–Fri 9:00–17:00 CET
Worked example · Scenario
How we count the payback: a team in Copilot or ChatGPT
We run the same count for your licences in the free analysis.
€4,534
a month for finding agreements and handing over cases in a team of 10
Payback: 1 mo.
3 hours a week per person for finding agreements and handing over cases is our assumption. A 30% cut sits within the range of controlled studies (MIT: 40%, Harvard and BCG: 25%). €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat, for companies with 10 or more employees. Licence: ChatGPT Business or Claude Team at 20 USD per person a month on annual billing, about €17.85 at the ECB rate of 1.1205 USD per euro on 22 October 2026. Rollout: from €1,150 for up to 10 people, from €2,300 for 11 to 40 people.
See the full calculation →Questions
Is Microsoft 365 Copilot GDPR compliant?
It can be used in line with the GDPR. Microsoft acts as a processor under the DPA, does not train foundation models on prompts and responses, and for the EU Copilot is covered by the EU Data Boundary. The company, as controller, still sets the purpose, the legal basis and the rules.
Does Copilot send data to Bing?
When it searches the web, it sends Bing a few words generated from the prompt, without a user or organisation identifier. The EU Data Boundary does not cover these queries. A DLP rule in Microsoft Purview can block sensitive data in web search.
What about Anthropic models in Copilot?
Microsoft offers them as its subprocessor. They are excluded from the EU Data Boundary, so the general setting is off by default in the EU. Word, Excel and PowerPoint have a separate setting, on by default in EU organisations created after 25 March 2026.
How much does Microsoft 365 Copilot cost?
In Microsoft's US price list of 15 October 2026, the licence for large organisations costs $30 per user a month on an annual subscription. Copilot Chat comes at no extra charge with a qualifying Microsoft 365 subscription.
