Is Microsoft Copilot GDPR-Compliant? Examples, Costs and How to Start

“Is Microsoft Copilot GDPR-compliant?” is what the data protection officer asks the morning after the Copilot icon shows up in Outlook, Teams and Edge for everyone in the company. Half the team has already tried it, some with their work account, some with a personal one. This article answers the question plainly, as of October 2026: which Copilot is which, what Microsoft commits to, where the gaps are, what it costs and what a compliant setup needs. Many companies can use Copilot compliantly with the right setup. This is not legal advice - confirm the details with your own data protection officer.

Is Microsoft Copilot GDPR-compliant?

Microsoft Copilot is not GDPR-compliant or non-compliant on its own: used with a work account under Microsoft’s Data Protection Addendum, with web search and permissions under control and your own documentation in place, it can be used in a GDPR-compliant way. Microsoft states that Copilot meets its GDPR and EU Data Boundary commitments to Microsoft 365 business customers and does not train foundation models on prompts and responses². What remains is your part: the right account, the right settings and the paperwork.

The European way inside Outlook and Teams: Superkind

If your team lives in Outlook and Teams, you can add an AI employee without leaving Microsoft 365. Superkind is the AI employee for your team: you write to Superkind in Outlook or any email, Microsoft Teams, Slack or the Superkind web app like you would to a colleague, and it does the task in your programs through 1,500+ integrations such as SharePoint, Excel, HubSpot and DATEV. Superkind is hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act and never trains models on your data. It works with AI models from OpenAI, Anthropic, Mistral and Google, all processed in Europe, and the data processing agreement comes through the Trust Center. The difference to Copilot is the job: Copilot helps each person write and summarise, Superkind takes over whole tasks.

1. 1

   You write the task

   In Outlook, Teams, Slack or the web app, in plain words: “Answer Ms Berger’s question about her order and log the call in HubSpot.”

2. 2

   Superkind does it in your systems

   It reads the email, looks up the customer in HubSpot, uses your company knowledge (delivery times, tone, past cases) and follows your rules, such as “Credit notes over EUR 200 need sign-off from the team lead”.

3. 3

   Superkind asks before anything goes out

   You get the draft reply and the CRM entry with Approve or Reject. Nothing is sent or changed without your OK, and a colleague can approve in Teams or Slack.

4. 4

   Next time it runs as a routine

   What you explain once keeps running, for example “Every order question - draft the reply, log it, ask me”. Every task adds to your Company Brain.

How Copilot and the GDPR fit together

The GDPR does not ban Copilot. Six parts decide whether your use is compliant.

1. The account and the contract - with a work account (Entra ID), Copilot and Copilot Chat are covered by the Microsoft Products and Services Data Protection Addendum (DPA) and the Product Terms, with Microsoft acting as processor under Art. 28 GDPR. Microsoft calls this enterprise data protection. The consumer Copilot with a personal Microsoft account is not covered¹⁴.
2. No training on your data - prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. On the consumer Copilot, Microsoft may use conversations for training unless the user opts out²⁴.
3. Where the data is processed - for EU customers, Copilot is an EU Data Boundary service: EU traffic to the language model stays within the boundary. Anthropic models, which admins can switch on in Copilot, are currently excluded from the EU Data Boundary¹².
4. Web search via Bing - when web search is on, Copilot sends short search queries to Bing without user and tenant identifiers. For these Microsoft is an independent controller; the DPA and the EU Data Boundary do not apply. Admins can turn web search off with the “Allow web search in Copilot” policy³.
5. Permissions and oversharing - Copilot only surfaces data a user has at least view permission for. That also means every overshared SharePoint site or Teams channel becomes easier to find, which is why Microsoft points to your SharePoint permission models².
6. Your own paperwork - a lawful basis under Art. 6 (and Art. 9 for health or other special categories), an entry in your record of processing (Art. 30) and a data protection impact assessment (Art. 35) where the use is likely to be high risk. Under the EU AI Act, Art. 4 requires AI literacy for staff since February 2025, and Art. 50 adds transparency duties from 2 August 2026, such as labelling AI-generated text published to inform the public unless a person reviewed it⁹¹⁰.

The three Copilots and the GDPR compared

As of October 2026. Where each version stands on the points that decide GDPR fit, with Superkind for comparison, based on the vendors’ own statements¹²³⁴. Not a compliance sign-off.

In short: the consumer Copilot is the wrong place for customer or employee data; with a work account you get the contract and the EU Data Boundary, and the open points are web search, optional models and permissions. For a side-by-side with OpenAI’s offer, see Copilot vs ChatGPT Enterprise, and for the ChatGPT side of this question, Is ChatGPT GDPR-compliant?

Examples: Copilot and the GDPR in practice

Five realistic situations and what each needs to stay compliant.

1. Superkind handles customer requests in Outlook and Teams

Daniel forwards a customer email in Outlook to Superkind. Superkind looks up the order, drafts the reply, logs the call note in HubSpot and asks Daniel for approval before anything goes out. The data is processed in Europe, with no training on it and the DPA through the Trust Center. It connects through 1,500+ integrations such as SharePoint, Excel, DATEV and Zendesk. See email inbox triage for how this runs day to day.

2. Copilot Chat for drafting, with a work account

The team uses the free Copilot Chat to draft job ads. Signed in with Entra ID, prompts and responses fall under the DPA¹. The open point is web search: names of customers or employees in a prompt can end up in a Bing query outside the DPA. Turn web search off or set a clear rule.

3. The paid Copilot finds the salary list

An assistant asks Copilot to “summarise everything about the bonus round” and gets a spreadsheet from a SharePoint site opened to the whole company years ago. Copilot only shows what the user may see², but the old oversharing is now one question away. Review HR, finance and management sites before the rollout.

4. A colleague uses Copilot with a personal account

Someone pastes a customer complaint into Copilot while signed in with a private Microsoft account. That chat is not covered by your DPA, and Microsoft may use it for training unless the user opted out⁴. Make the rule explicit: company data only with the work account.

5. HR summaries with health data

An HR lead wants Copilot to summarise sick notes and return-to-work talks. Health data is a special category under Art. 9 GDPR; here a DPIA under Art. 35 is likely due⁹. For how to run one, see DPIA for AI agents.

What a compliant Copilot setup needs (and what it costs)

Short, but none of it happens by itself.

• Work accounts only - company data only with the Entra ID work account, where the DPA applies¹.
• A decision on web search - leave it on with a rule, or turn it off with the “Allow web search in Copilot” policy³.
• A decision on optional models - keep Anthropic models off, or enable them for named groups and record that they sit outside the EU Data Boundary¹.
• Clean permissions - review SharePoint and Teams sites with broad access, use sensitivity labels, and start with a pilot group².
• Record of processing and DPIA - add Copilot to your record (Art. 30) and run a DPIA (Art. 35) where the risk is high⁹.
• AI literacy and transparency - train staff and set rules under Art. 4 EU AI Act; from 2 August 2026, Art. 50 adds transparency duties for some AI-generated content¹⁰.

What Copilot costs

As of October 2026. Microsoft list prices for Germany, per user per month, excl. VAT, on top of a Microsoft 365 licence.

On top of the licences, Microsoft bills some advanced experiences such as agents by usage through Copilot Credits⁵. The Microsoft 365 suites themselves got more expensive on 1 July 2026: in Microsoft’s USD list, Business Basic went from $6 to $7, Business Standard from $12.50 to $14 and Microsoft 365 E3 from $36 to $39 per user per month, from the next renewal for existing customers; standalone Copilot SKUs were not part of that change⁷. Ten Copilot Business seats on an annual plan come to EUR 182 per month before VAT at list price.

Data protection and EU hosting

For a customer email in Outlook, a contact in HubSpot or a file in SharePoint, the personal data Superkind works with is processed in Europe from the first task, with approval before anything leaves the team.

What Superkind costs

As of October 2026. Prices excl. VAT, for the whole company with unlimited users.

• Free - EUR 0 with a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and connection.
• Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
• Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, a DPA and help with the security review, payment by invoice.
• What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.

How to start

Start with one real task and get Copilot in order in the same week. Three steps:

From the first task to your own app

With Superkind, the data stays in Europe from the first task to the app you build later. Four stages, on the customer-request example from above:

1. 1

   Ready in minutes

   Sign up for free, forward the first customer email in Outlook and watch Superkind draft the reply and log it in HubSpot.

2. 2

   Tasks become routines

   What you explain once keeps running as a routine, for example every order question answered and logged. Before anything goes out, Superkind asks for approval.

3. 3

   Learns from day one

   Every task makes Superkind smarter. Customers, prices and processes end up in your Company Brain, and that knowledge is never lost.

4. 4

   Your own app, without starting over

   When it gets more complex, you build custom solutions, apps and integrations on top of what Superkind already knows, for example your own customer service app: your Super App. Built yourself or together with us. It all belongs to you.

Conclusion

Microsoft Copilot can be used in a GDPR-compliant way: with work accounts it runs under Microsoft’s DPA, without training on your data and inside the EU Data Boundary for EU customers, and a German authority now considers compliant Microsoft 365 operation possible. The work is in the details: Bing web search and optional Anthropic models sit outside the boundary, Copilot sees every overshared file, and the paperwork stays with you. For an AI employee that does whole tasks in Outlook and Teams, hosted in Europe with approval before anything goes out, Superkind connects to SharePoint, Excel, HubSpot, DATEV and 1,500+ integrations from EUR 50 per month for unlimited users (as of October 2026). Check your tenant settings this week, then send Superkind one real task and compare.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, the AI employee teams write to in Outlook, Teams and Slack. Henri helps companies, from small teams to the Mittelstand, hand their routine work to AI - without new tools, consultants or an in-house AI team.