Is a DPIA legally required before rolling out Microsoft 365 Copilot?

Often, yes. Under the UK GDPR a DPIA is required where processing is likely to result in high risk, and the ICO's list includes innovative technology such as AI when combined with another factor, such as processing about employees at scale. Many organisations conclude that Copilot meets that bar. If you decide it does not, record your reasoning, because you must be able to justify the decision.

Does Microsoft use our Copilot prompts to train its AI models?

Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation language models behind Copilot. Prompts and responses are still stored, encrypted, as activity history in your tenant, and admins can search them with Content search or Microsoft Purview. That stored history is what your retention and subject access processes need to cover.

Where is Copilot data stored and processed for a UK organisation?

For tenants with a UK sign-up country, stored Copilot interaction content is covered by Microsoft's data residency commitments in its Product Terms. Model processing is different: Microsoft routes calls to the nearest data centres but can use other regions when demand is high, and the EU Data Boundary does not cover UK customers. Record both points in your DPIA.

Can employees request their Copilot prompts in a subject access request?

Yes. Prompts and responses linked to a named user are personal data, and admins can locate them with Microsoft Purview tools. Treat them like emails or chat messages: search, review for information about other people, and disclose what the requester is entitled to. Users can also delete their own Copilot activity history, although your retention policies may still keep a copy.

Do we need staff consent to use Copilot on their work data?

Usually not, and consent is rarely the right basis at work. Because of the power imbalance between employer and employee, it is hard to show consent was freely given. Most organisations rely on legitimate interests for productivity uses, supported by a legitimate interests assessment, clear transparency and an easy way to raise concerns. Special category data needs an additional Article 9 condition.

UK GDPR and Microsoft 365 Copilot: A 12-Point Pre-Rollout Checklist

Before you switch on Microsoft 365 Copilot in a UK organisation, settle four things: a data protection impact assessment (DPIA), a lawful basis for each use, an updated privacy notice for staff, and a clean-up of who can open what. Copilot can surface anything a user already has permission to view, and the UK GDPR duties stay with you as controller, not with Microsoft.

This article is general information, not legal advice. Check your decisions with your data protection officer or legal adviser.

At a glance

Name change: Microsoft now calls the product Microsoft Copilot (and Copilot Chat), although licences and some screens still say Microsoft 365 Copilot.
The core risk: Copilot only shows content a user can at least view, so old oversharing becomes easy to find.
Training: Microsoft states that prompts, responses and Microsoft Graph data are not used to train foundation models.
ICO guidance: the ICO's AI guidance and DPIA guidance are marked as under review after the Data (Use and Access) Act 2025, but they still apply.
2026 law changes: new automated decision-making rules from 5 February 2026, and a statutory complaints duty from 19 June 2026.
UK default to check: Anthropic models are off by default for UK tenants, but a related app setting can change what users get.

What changed in UK data protection law in 2026

The Data (Use and Access) Act 2025 (DUAA) amends the UK GDPR rather than replacing it. Most of its data protection changes, including the new automated decision-making articles and recognised legitimate interests, came into force on 5 February 2026 under the Commencement No. 6 Regulations.

Two changes matter directly for a Copilot rollout:

Automated decision-making (ADM). Section 80 of the DUAA replaced the old Article 22 with Articles 22A to 22D. Solely automated decisions with legal or similarly significant effects are allowed in more situations, but only with safeguards: information about the decision, a way to make representations, human intervention and a route to contest it. The ICO consulted on updated ADM guidance from March to May 2026, and that guidance is still marked as draft.
Complaints. From 19 June 2026, the ICO says all organisations must give people a clear way to raise a data protection complaint, acknowledge it within 30 days and tell the complainant the outcome. Staff who are unhappy about Copilot will use this route first.

The ICO's Guidance on AI and data protection carries a notice that it is under review because of the DUAA. Keep using it, and recheck it before you sign off your DPIA. Since 30 September 2026 the office of Information Commissioner has been abolished and its functions have passed to a new Information Commission, under the Commencement No. 9 Regulations. The regulator still operates as the ICO, now the Information Commission's Office, at ico.org.uk.

What Copilot does with personal data

Your DPIA needs facts, not marketing. These come from Microsoft's Data, Privacy, and Security for Microsoft Copilot page:

Question	Microsoft's answer
What can Copilot read?	Graph content the user can at least view
Are prompts stored?	Yes, with responses and citations, as activity history
Used to train models?	Not to train foundation models
Can admins find them?	Yes, through Content search and Purview
Where does the model run?	Nearest data centres, other regions at peak load

Two UK details deserve a line in your DPIA. First, the EU Data Boundary does not cover the UK. Microsoft says customers outside the EU may have their queries processed in the US, the EU or other regions. Stored interaction content falls under Microsoft's data residency commitments for tenants with a UK sign-up country, but processing can happen elsewhere, so record how international transfers are covered.

Second, Anthropic models. Microsoft's Anthropic models in Microsoft Online Services page says Anthropic is a Microsoft subprocessor, that its models are excluded from in-country processing commitments, and that UK tenants have them disabled by default. On 3 April 2026 Microsoft added a separate setting for EU, EFTA and UK tenants, Copilot in Microsoft 365 apps with Anthropic models. Check both settings in the Microsoft 365 admin center rather than assuming the default still holds.

The 12-point pre-rollout checklist

Work through these in order. The first five are governance and paperwork, the next five are tenant settings, and the last two keep you compliant after go-live.

Governance and documents

Name an owner and a pilot scope. One person owns the DPIA and the settings. Start with a pilot group, and keep HR, legal and occupational health teams out until their sites have been reviewed.
Complete a DPIA. The ICO's list of processing likely to need one includes innovative technology, including AI, when it is combined with another risk factor, and the ICO notes that employees can be vulnerable because of the power imbalance with their employer. If you conclude a DPIA is not mandatory, write down why. Microsoft's privacy page links to a Copilot risk assessment quickstart on its Service Trust Portal that can feed your assessment.
Set a lawful basis for each purpose. Drafting, summarising and searching work content usually rests on legitimate interests, backed by a legitimate interests assessment. Consent rarely works for staff because of that same imbalance of power. If Copilot could reach health, trade union or other special category data, you also need an Article 9 condition, or you keep that content out of scope.
Update your records and contracts. Add Copilot to your record of processing activities. Note Microsoft's role as processor under its Data Protection Addendum, list any optional subprocessors you enable, and record how processing outside the UK is covered.
Tell people. Update the staff privacy notice: what Copilot does, that prompts and responses are stored, who can search them, how long they are kept and how meeting summaries work. Pair it with a short acceptable use policy that says what must never go into a prompt.

Tenant settings

Fix oversharing before you license. Run the SharePoint data access governance reports, starting with the site permissions baseline, and look for "Everyone except external users" access and "Anyone" links. Microsoft's guidance on a secure and governed foundation for Copilot suggests Restricted Content Discovery as an interim control: it keeps a site out of Copilot and organisation-wide search without changing its permissions.
Label and block the sensitive material. Copilot honours the usage rights on content encrypted with sensitivity labels. A Microsoft Purview data loss prevention policy for the Copilot location can exclude labelled content from Copilot grounding.
Decide on meeting transcripts. In Teams, the default Copilot meeting policy is "On with saved transcript required". The "Only during the meeting" option uses temporary speech-to-text data that is not saved after the meeting (Manage Teams meeting transcription). Choose deliberately, and tell external attendees which you use.
Decide on models and web search. Record whether you enable Anthropic models, and whether Copilot may send generated search queries to Bing. Both change who processes the data and where.
Set retention for Copilot interactions. Use Purview retention policies so prompts and responses follow your retention schedule instead of living forever. Storage limitation applies to AI chat history like any other record.

After go-live

Make subject access and complaints work. Copilot activity history is personal data about the user, and it may mention other people. Add it to your subject access search steps, and make sure your complaints process covers AI use.
Keep a human in significant decisions. Microsoft says Copilot restricts inferences about an employee's performance, attitude or emotional state. Your policy should still forbid using Copilot output as the sole basis for decisions on hiring, pay, discipline or dismissal. If any process becomes solely automated with significant effects, the Article 22A to 22D safeguards apply.

Mistakes we see before go-live

A common mistake is licensing everyone in week one and planning to clean up permissions later. Copilot turns forgotten sharing links into answers, so the clean-up has to come first, even if it is partial and backed by Restricted Content Discovery.

Another is treating the DPIA as a one-off. Copilot changes often, with new agents, models and features arriving through the year. Put a review date in the DPIA, and trigger a review whenever you enable agents, connectors or a new model provider. Our guide to Copilot Studio agents explains why agents widen the data an assistant can reach.

The third is forgetting meetings. Transcripts capture people who are not your staff, such as clients and job candidates. Meeting invitations and your external privacy notice should say when Copilot and transcription are in use.

For the data readiness side in more depth, read Getting Your Data Ready for Copilot: Microsoft Purview Basics. For the wider regulatory picture, see How the UK Regulates AI in 2026.

How CertTulen Academy can help

If you administer Copilot, our Microsoft 365 Copilot and Agent Administration Fundamentals (AB-900) course covers the admin controls, licensing and agent settings behind this checklist. If you own labels, data loss prevention and retention, Information Security Administrator Associate (SC-401) goes deep on Microsoft Purview. Both are live, MCT-led and online, with hands-on labs. For a private cohort for your IT and data protection teams, contact us for a batch that suits your time zone.