​​Microsoft Copilot

"The Bing search service operates separately from Microsoft 365 and has different data-handling practices from those used for prompts and responses. These data-handling practices are covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement. This means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations."

Web search queries derived from user prompts are sent to Bing, which operates under a separate privacy framework where Microsoft acts as an independent data controller rather than a data processor, meaning weaker enterprise protections apply to this data.

"Before sending the response back to the user, both the prompt and response are logged and stored in Exchange for auditing/eDiscovery (Microsoft 365 tenant). With enterprise data protection, prompts and responses in Copilot Chat are logged. The same retention policies used for Microsoft 365 Copilot can be used for Copilot Chat."

All prompts and responses are logged and stored in Exchange by default, with retention governed by whatever policies the tenant admin sets — there is no stated maximum retention period, and without active policy configuration, data may be retained indefinitely.

"Copilot Chat in Outlook can access user data to provide relevant responses. The accessible user data includes their emails, calendar, meetings, chats, and files limited to the following boundaries: Files in a user's OneDrive and other OneDrive files they have access to... Suggested prompts containing files are shown to the user based on interaction signals (such as if the file was accessed, modified, or shared with or by the user)."

Copilot Chat aggregates data across multiple Microsoft services — emails, calendar, meetings, chats, OneDrive files, and SharePoint — and uses interaction signals about file access and modification patterns, effectively building a cross-service activity profile.

"When using Copilot Chat in Edge if the 'Allow access to any webpage or PDF' setting is enabled by the user or admin and an intranet page is open in the browser. In this scenario, Copilot Chat can use the content of this page to help answer questions. Additional terms from uploaded files or content actively viewed in Edge may also be sent to the Bing search service to ground responses."

Copilot Chat can read content from any webpage or PDF the user has open in Edge, and terms extracted from that content may be sent to Bing's search service — this extends data access beyond the Copilot Chat interface itself into general browsing activity.