Microsoft Copilot and UK GDPR
Is Microsoft Copilot safe for client data? A guide for UK firms
Copilot signed in with a work account can be used for client work, with the right safeguards in place. Copilot on a personal Microsoft account shouldn't be: it's a consumer product with no contract with your firm.
By Paulo De Sousa, Co-founder of SimpleKPILast checked
Microsoft Copilot plans at a glance
The same AI tool can be safe or risky, depending on the plan someone is signed in to.
| Plan | Contract with your firm | Trains on what's typed | For client data? |
|---|---|---|---|
| Personal Microsoft account | Consumer terms. No data processing agreement with your firm. | Microsoft uses Copilot conversations for AI training unless the user opts out of training on their conversation activity. The UK isn't among the countries it excludes. | No personal data |
| Signed in with a work account | Enterprise data protection under Microsoft's data protection addendum. | Prompts aren't used to train the underlying models. | Yes, with safeguards |
From Microsoft: enterprise data protection, checked 21 October 2026. Check your own plan with the AI plan checker.
Work account or personal account: the difference that matters
Microsoft Copilot looks much the same whichever account you sign in with. What happens to your data doesn't.
Signed in with a work account (a Microsoft Entra ID account, the one your firm manages), Microsoft Copilot and Copilot Chat are covered by enterprise data protection. Microsoft's data protection addendum applies, and prompts aren't used to train the underlying models.
Signed in with a personal Microsoft account, it's the consumer Copilot app, even if someone is using it for work. Consumer terms apply, there's no data processing agreement with your firm, and Microsoft uses Copilot conversations for AI training unless the user opts out of training on their conversation activity. The UK isn't among the countries Microsoft excludes from that.
So the question to ask isn't "do we use Copilot?" but "which account is everyone signed in with?".
Copilot Chat, Microsoft 365 Copilot and web searches
Enterprise data protection covers both Microsoft Copilot and Copilot Chat when people sign in with their work account. If your firm also pays for Microsoft 365 Copilot inside Word, Excel and Outlook, check Microsoft's terms for what data it can reach.
One detail worth knowing: when Copilot searches the web to answer a question, those web search queries are handled under Microsoft's services agreement, not the data protection addendum. Bear that in mind before asking a question that would put a client's details into a web search.
What UK GDPR expects if you use Microsoft Copilot
- Use a business plan that comes with a data processing agreement (the contract that covers your clients' data).
- List Microsoft Copilot in your records of processing and your privacy notice.
- Do a risk assessment (a DPIA) before you rely on it for client work.
- Check the safeguards if data goes outside the UK.
- Tell your team the rules: which plan to use, and what must never go in.
Before you write your records of processing, check where Microsoft stores your data and whether a UK or EU region is offered on your plan, because it decides which transfer safeguards you need.
What the ICO expects when your team uses AI
Settings to change today
Sign in with your work account
Make sure everyone uses Copilot signed in with their work (Microsoft Entra ID) account, not a personal Microsoft account, for anything to do with clients. That's what brings in enterprise data protection.
Training on your conversation activity
On a personal Microsoft account, Microsoft uses Copilot conversations for AI training unless the user opts out of training on their conversation activity. If anyone uses a personal account at all, ask them to opt out. It doesn't add a contract, so personal accounts still aren't the place for client details.
How Saiela helps
- Approve the business plan your firm pays for.
- Warn people on personal accounts, or block them.
- Swap client details out of prompts before anything is sent.
- See which tools and accounts your team uses, as counts, never content.
Questions
What firms ask about Microsoft Copilot and client data.
Does Copilot train on my data?
With a work account, no: prompts aren't used to train the underlying models. With a personal Microsoft account, Microsoft uses Copilot conversations for AI training unless the user opts out of training on their conversation activity, and the UK isn't excluded.
Is Copilot with a work account safe for client data?
It's the right way to use Copilot for client work: enterprise data protection and Microsoft's data protection addendum apply. You still need the other safeguards UK GDPR expects, such as a risk assessment (a DPIA) and an AI policy. Remember that web search queries are handled under Microsoft's services agreement instead.
Is Copilot Chat covered by enterprise data protection?
Yes, when people sign in with their work (Microsoft Entra ID) account. Signed in with a personal Microsoft account, it's the consumer app instead.
Can I use Copilot with my personal Microsoft account for work?
For general questions with no personal data, yes. For anything with client details, no: it's a consumer product with no data processing agreement with your firm, and conversations may be used for training unless you opt out.
Do I need a DPIA to use Copilot?
Usually. The Information Commission (ICO) says that in the vast majority of cases, using AI involves processing likely to result in a high risk, which calls for a risk assessment (a DPIA). Do it before you rely on Copilot for client work.
Sources
- Microsoft: enterprise data protection
- Information Commission (ICO): guidance on AI and data protection
Last checked 21 October 2026. Providers change their plans often. General information, not legal advice.
Paulo De Sousa
Co-founder of SimpleKPI
Paulo has worked in software development and SaaS for over 20 years and leads the engineering behind SimpleKPI and Saiela. He writes about how AI tools handle your data and how Saiela keeps it out of them.
Use Microsoft Copilot without the client data risk.
Approve the right plan, block personal accounts and keep client details out of every prompt. Try it free for 7 days.