CopilotAn analyst at a mid-sized firm types a simple question into Microsoft 365 Copilot: "What's the latest on the leadership reorg?" Copilot helpfully summarises a draft plan, complete with names, proposed redundancies and severance figures.
The analyst was never meant to see that document. But two years ago, someone saved it to a SharePoint site that had been shared with "everyone except external users", and nobody ever looked at the permission again. Technically, the analyst always had access. They just never knew the file existed until Copilot found it in answer to a question in plain English.
Nothing was hacked. No permission was broken. Copilot did exactly what Microsoft designed it to do: it inherited the user's access and made it searchable. And that is the whole privacy story of Copilot at work.
Is Microsoft 365 Copilot safe for business data?
As a service, yes, and Microsoft's commitments here are genuinely strong. Microsoft 365 Copilot does not use your prompts, responses or Microsoft Graph data to train its foundation models. Processing stays within the Microsoft 365 service boundary, and Copilot only ever returns data the user asking already has permission to open.
That last guarantee is also the catch. Copilot inherits each person's access exactly. So if your organisation has years of accumulated oversharing (broad sharing links, broken permission inheritance, sites opened to "everyone", files dropped in the wrong place), Copilot does not create new exposure, but it removes the obscurity that was quietly protecting you. What once meant knowing a file existed and hunting for it now takes one well-phrased question. That is the main difference from ChatGPT and Claude, which see what someone pastes or connects; our comparison of ChatGPT, Claude and Copilot puts the three side by side.
The risk in Copilot is not the AI. It is your permissions, suddenly laid bare.
How Copilot handles your data
There is not one Copilot. There are three, with very different protections.
| Free Copilot (consumer) | Copilot Chat (work) | Microsoft 365 Copilot (add-on) | |
|---|---|---|---|
| Sign-in | Personal / none | Work account | Work account |
| Enterprise data protection | No | Yes | Yes |
| Trains foundation models on your data | Older app: possible, unless you opt out. Updated app and web: no | No | No |
| Access to your email, files and Teams | No | Limited: in Outlook, email, calendar and some files; elsewhere, what you add yourself | Full, via Microsoft Graph |
| The "inherits your access" risk | No | Limited | Yes |
Free consumer Copilot (copilot.microsoft.com, no work sign-in) draws its answers from the public web and has no enterprise data protection. It is not for work data: this is the version the US House of Representatives blocked for staff. Training is no longer the main reason. Microsoft released an updated Copilot app on 18 August 2026, and for that app and for Copilot on the web it states that prompts, responses and file contents are not used to train foundation models (Microsoft, Copilot for individuals: your activity history, checked 21 October 2026). The older app can still use conversations for training unless you opt out (Microsoft, Privacy FAQ for Microsoft Copilot, checked 21 October 2026). What does not change: on a personal account, Microsoft's consumer terms apply, not your organisation's agreement with Microsoft.
Microsoft 365 Copilot Chat, used while signed in with a work account, runs under enterprise data protection. Outside Outlook it works with the web and with whatever you paste, upload or add with "/". Inside Outlook it reaches further, even without a paid licence: your email, calendar, meetings and chats, plus files within set limits. Those are your own OneDrive and other OneDrive files you can access, files from SharePoint sites you visit often, files shared directly with you, and files you have viewed, edited or created (Microsoft Learn, Microsoft Copilot Chat Privacy and Protections, checked 25 October 2026). Full work data through the semantic index is reserved for the paid licence. What else Copilot Chat can do without one is in our article on Copilot Chat without a licence.
Microsoft 365 Copilot (the paid add-on) is the one with full Microsoft Graph access (email, files, calendar, Teams, SharePoint), and that is where the oversharing problem lives.
Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, the same name as the consumer app, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat (Microsoft Learn, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, checked 21 October 2026). So the name on the screen tells you little. The account tells you more: a personal Microsoft account, or a work or school account.
On data residency, Microsoft 365 Copilot is an EU Data Boundary service. But at peak demand "flex routing" can move LLM processing to the US, Canada or Australia, and it is on by default for newer tenants. Requests routed to Anthropic models, and Bing web searches, also fall outside the EU Data Boundary. Stored data stays in the EU; processing may not, unless you step in.
The biggest privacy risks in Copilot
1. Oversharing made searchable
This is the main risk. A payroll file on an overshared site, a board pack in an open Teams channel, an HR letter in a misconfigured library: all already accessible to more people than intended, all now one question away. Copilot does not widen access; it makes excessive access that already exists usable.
2. Stale and inherited permissions
People change roles, projects end, contractors leave, and their access often lingers. Copilot draws on whatever each user can still reach today, including rights that should have been removed months ago.
3. The "which Copilot" mistake
An employee who uses free consumer Copilot for a work task, signed in with a personal account, gets none of the enterprise protections. The same prompt in Copilot Chat, signed in with a work account, would be covered. Most users cannot tell which one they are using.
4. Prompt injection reaching governed data
In 2025, researchers demonstrated "EchoLeak" (CVE-2025-32711), a zero-click flaw in which a crafted email could make Copilot retrieve internal data and send it out. Microsoft patched it on the server side before any known abuse, but it proved that prompt injection can reach enterprise Copilot, precisely because Copilot can reach everything the victim can.
5. Hallucinated personal data
Copilot can make confident but inaccurate statements about real, identifiable people. Under the GDPR, inaccurate personal data is a data quality problem in itself, and a Dutch sector-wide DPIA flagged exactly this as a residual risk.
6. Processing leaving the EU at peak times
With flex routing on by default for newer tenants, Copilot's LLM processing can temporarily leave the EU Data Boundary. For organisations with strict EU residency requirements, that is a decision to make deliberately, not one to inherit.
What is at stake for the organisation
Under the GDPR, showing personal data to someone who should not have it (salaries, health information, a disciplinary file) can be a personal data breach, even if no attacker was involved and no permission was technically broken. If there is a risk to people's rights and freedoms, the organisation must notify its data protection regulator within 72 hours.
Fines can reach €20 million or 4% of global annual turnover, whichever is higher, and the liability rests with the organisation as controller. Beyond the regulator, internal oversharing brought to light by Copilot (an employee reading colleagues' salaries or a reorganisation plan) does immediate damage to trust and working relationships that is hard to contain.
The uncomfortable part is that a flawless contract with Microsoft is no defence when the exposure came from your own permissions, made searchable.
Copilot in the news: the documented incidents
March 2024: US House of Representatives blocks Copilot
The Office of the Chief Administrative Officer declared the commercial version of Microsoft Copilot "unauthorized for House use", citing the risk of House data leaking to cloud services that had not been approved, and said it would evaluate the government edition later. It was aimed at the consumer version, not enterprise M365 Copilot, but it set the tone for caution in organisations. Source: Axios, March 2024.
December 2024 to 2025: SURF Copilot DPIA (Netherlands)
SURF, the IT cooperative for Dutch education and research, published a Data Protection Impact Assessment of Microsoft 365 Copilot in December 2024. It found four high privacy risks and advised institutions not to use Copilot for the time being. After Microsoft made changes, an update in September 2025 downgraded the risks to "amber", leaving two residual concerns: inaccurate personal data generated about real people and an 18-month retention period for pseudonymised metadata. Source: SURF, 2024-2025.
June 2025: EchoLeak (CVE-2025-32711)
Aim Labs disclosed a zero-click prompt injection flaw in Microsoft 365 Copilot, rated critical (CVSS 9.3), that could exfiltrate internal data without any user interaction. Microsoft fixed it on the server side in May 2025 and reported no evidence of exploitation in the wild. Source: BleepingComputer / The Hacker News, June 2025.
What links these incidents is not a single failure. It is a tool whose strength, reaching everything a user can access, is also its biggest privacy risk.
What you can set in Copilot and Microsoft 365
1. Find and fix oversharing with SharePoint Advanced Management Use Data Access Governance and permission state reports to find broken inheritance, "everyone" links and overshared sites, then fix them. This is the real fix, and it is included with Microsoft 365 Copilot.
2. Apply Microsoft Purview sensitivity labels Copilot respects labels that apply encryption: it returns content only if the user has the right to extract it. Everything depends on how much is labelled: an overshared file without a label is still fair game.
3. Configure Purview DLP for Copilot A DLP policy for the Microsoft 365 Copilot location can keep content with a sensitivity label out of Copilot interactions.
4. Use Restricted SharePoint Search, but only temporarily Restricted SharePoint Search (RSS) can limit what Copilot finds to an allow list of up to 100 sites while you clean up. Microsoft is clear that it is not a security boundary, does not change permissions and is a short-term stopgap.
5. Turn off flex routing if you need strict EU processing In the Microsoft 365 admin center, go to Copilot > Settings > flex routing and choose "Do not allow flex routing". That keeps LLM processing inside the EU Data Boundary.
6. Scope or remove Copilot licences Switch Copilot off per user by removing the licence or through Integrated Apps, to limit the blast radius during a phased rollout.
Steps checked in June 2026. Microsoft often reorganises the Copilot admin settings, so menu labels change.
What no admin control catches
Settings govern what Microsoft does with your data and how widely Copilot searches. They do not fix the permissions underneath, and they do not decide what an employee types into the prompt.
No toggle unshares the folder that was opened to "everyone" three years ago. No data residency setting removes the client account number someone pasted into a Copilot prompt with "summarise this". The two weaknesses Copilot amplifies, overshared content and overfilled prompts, both come down to human decisions that no settings screen can reach.
That is the gap: between the access an organisation has accumulated and the content a person is about to type.
The last moment you can still choose
BeeSensible checks text fields in the browser for personal data as you type, including the Copilot prompt box. The text goes to BeeSensible's detection service in the EU, where it is analysed in memory and discarded after detection; none of it is stored. When sensitive details appear in a prompt, BeeSensible highlights them in the text, so the user can see exactly what they are about to share and mask it with a placeholder or remove it before sending.
