Microsoft MS Copilot Privacy Statement

Implications

• Complies with GDPR and EU Data Boundary for security and privacy.
• Integrates with Microsoft 365 apps like Word and PowerPoint.
• Does not use prompts, responses, or data to train foundation LLMs.
• Organizational data may leave the Microsoft 365 service boundary under certain plugin circumstances.
• Web content plugin may send search queries to Bing, which has different data-handling practices.
• Abuse monitoring occurs in real-time without standing access to customer data.
• User interactions with Copilot are stored but encrypted and not used for LLM training.
• Admins can manage and delete Copilot interaction history.
• EU user data stays within the EU Data Boundary.
• Data residency commitments are upheld as per Microsoft Product Terms.
• Microsoft Copilot features may be disabled if connected experiences are turned off.
• Microsoft does not claim ownership of content created by Copilot.
• Microsoft will defend customers against copyright infringement lawsuits related to Copilot output.
• Committed to responsible AI with ethical principles and transparency.

Things to watch out for

• Be cautious about the data that may leave Microsoft 365 boundaries when using plugins or web content enhancement.
• Review the privacy statements and terms of use for any third-party plugins or services integrated with Copilot.
• Understand that Copilot's AI-generated content may not always be 100% factual and should be reviewed before use.

Data Collection

• User prompts and Copilot responses (interaction history)
• Search queries sent to Bing when using the web content plugin
• Content and context from Microsoft Graph (e.g., documents, emails, chats)

FAQs

How does Microsoft Copilot for Microsoft 365 handle my proprietary organizational data?

It accesses content through Microsoft Graph and only surfaces data to which users have permissions, without using the data to train foundational LLMs.

What happens to the data about my interactions with Microsoft Copilot for Microsoft 365?

Interaction data is stored, encrypted, and can be managed or deleted by admins, but is not used to train LLMs.

Does Microsoft claim ownership over the content created by Copilot?

No, Microsoft does not claim ownership of the content created by Copilot, but cannot guarantee copyright protection against similar outputs generated for other users.