Microsoft Copilot GDPR and SOC 2 compliance: the enterprise guide

Microsoft Copilot for Microsoft 365 is GDPR compliant by design. Microsoft has invested more compliance infrastructure around Copilot than any other AI provider, largely because their enterprise customer base demanded it before adoption. But "GDPR compliant by design" does not mean compliant by default on your side. There are settings you need to configure, documentation you need to collect, and internal controls you need to wire up.

Here is what the documentation actually covers, what your auditor will look for, and how Microsoft's Copilot stack fits into your SOC 2 and GDPR program.

The Microsoft Copilot product family: know which one you have

"Microsoft Copilot" covers multiple products with different compliance postures.

Microsoft Copilot (free/Bing): Consumer product. No DPA. Processes queries through Microsoft's consumer services terms. Not appropriate for any work-related use involving company or customer data.

Microsoft Copilot for Microsoft 365 (M365): Enterprise AI assistant integrated into Word, Excel, Outlook, Teams, PowerPoint, and SharePoint. This is what enterprise customers are buying. Full compliance stack: DPA, SOC 2, ISO 27001, EU Data Boundary option. Data stays within your Microsoft 365 tenant boundary.

Microsoft Copilot Studio: Tool for building custom AI agents and copilots on top of Azure AI. Covered under Azure compliance documentation.

GitHub Copilot: Separate product covered in the GitHub Copilot compliance guide.

Azure OpenAI Service: Azure-hosted OpenAI models. Covered under Azure compliance documentation. Your data does not go to OpenAI directly; it goes to Microsoft's Azure instance.

This guide focuses on Copilot for M365, which is what most companies are deploying or evaluating.

Microsoft's compliance documentation for Copilot

Microsoft maintains the most comprehensive compliance documentation of any AI provider. For Copilot for M365:

SOC 2 Type II: Covered under Microsoft's existing M365 SOC 2 reports. Available through the Microsoft Service Trust Portal (servicetrust.microsoft.com). The report covers Microsoft 365 and associated services including Copilot.

ISO 27001: Microsoft holds ISO 27001 certification for its cloud services including M365.

ISO 27018: Covers protection of personal data in public cloud environments. Relevant for GDPR purposes.

GDPR compliance: Microsoft publishes a Data Processing Addendum that covers all M365 services including Copilot. The DPA includes SCCs for EU-to-US transfers and an EU Data Boundary option for customers who need EU-only processing.

EU Data Boundary: Microsoft offers an EU Data Boundary option for M365 that keeps all data at rest and in transit within the EU. If your company operates under strict data residency requirements, this is the configuration to request.

What Microsoft Copilot does with your data

The compliance-relevant behavior of Copilot for M365:

Your data stays in your tenant. Copilot processes queries within your Microsoft 365 tenant. Your content (emails, documents, Teams messages) is not used to train foundational models. Microsoft's policy is explicit: M365 customer data is not used to train Copilot or any other AI model.

Large language model processing. Copilot uses GPT-4 class models hosted by Microsoft. Prompts and responses are processed in Microsoft's infrastructure, not sent to OpenAI directly. The data handling is covered by the Microsoft DPA.

Residency. Data is processed in Microsoft's regional data centers according to your tenant's data location settings. EU customers on EU Data Boundary have explicit EU processing.

Retention. Copilot interaction data (prompts, responses) is retained in accordance with your M365 compliance policies. This means it is subject to the same retention and eDiscovery policies as other M365 content.

The settings that determine your compliance posture

Compliance with Copilot for M365 depends significantly on configuration. Your M365 admin needs to verify these settings:

Connected experiences. M365 has a concept of "connected experiences" that can send content to Microsoft for cloud processing. For compliance, verify that optional connected experiences are set to your policy preference in the Microsoft 365 admin center.

Semantic Index. Copilot builds a semantic index of your M365 content to ground its responses. This is processed within your tenant. Ensure that the semantic index respects your existing sensitivity labels and access controls. Copilot should not surface content to a user that they could not access directly.

Sensitivity labels. If you use Microsoft Purview sensitivity labels on documents and emails, Copilot respects those labels. A document marked Confidential should not be surfaced to a user without Confidential access. Verify your label policies are configured and enforced before rolling out Copilot widely.

Audit logging. Enable Microsoft 365 audit logging for Copilot interactions. Copilot activity is logged in the Microsoft 365 Unified Audit Log, which you can export to your SIEM. For SOC 2 evidence, you need to demonstrate that Copilot access is logged and reviewable.

Data loss prevention (DLP). Your existing M365 DLP policies apply to Copilot. If a DLP policy prevents a user from emailing credit card numbers, the same policy prevents Copilot from including those numbers in a generated response. Verify DLP is configured before deployment.

SOC 2 vendor assessment: what to document

For CC9.1, your Microsoft vendor entry should cover Copilot specifically:

Data processed: M365 content (emails, documents, Teams messages, SharePoint files) processed by Copilot to generate responses. Includes prompts entered by users.

Risk tier: Critical (handles potentially sensitive company and customer data across all M365 communication and documents).

DPA: Microsoft Online Services Data Protection Addendum, available at microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA. If you already have a DPA for M365, Copilot is included.

Compliance reports: M365 SOC 2 Type II from Service Trust Portal, ISO 27001 certificate, ISO 27018 certificate.

Training: Explicitly prohibited by Microsoft policy. Document this in your vendor notes.

Residency: Document your tenant's data location and whether EU Data Boundary is enabled.

GDPR: the key questions answered

Do you need a new DPA for Copilot? If you already have a signed Microsoft DPA covering M365, Copilot is included. No separate DPA is needed.

Does Copilot create new data flows outside the EU? If your tenant is in the EU and EU Data Boundary is enabled, processing stays in the EU. If EU Data Boundary is not enabled, some processing may occur in the US under the SCCs in the Microsoft DPA.

Is Copilot using our data to train models? No. Microsoft's policy explicitly excludes customer data from model training.

What about data subject access requests? Copilot interaction data is M365 data and is subject to your existing DSR processes. Microsoft provides tooling in Purview to search and export this data.

Quick compliance checklist

Getting Microsoft Copilot audit-ready comes down to mapping its data flows to your SOC 2 and GDPR controls, confirming the DPA and sub-processors, and keeping that evidence current as the service changes. If you would rather a security leader owned that work than track it in a spreadsheet, book a call.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.