Is Copilot Private? Confidential Information Rules for Lawyers

Is Copilot safe for confidential information? On a licensed work or school account, yes for most confidential information, with two gaps a lawyer should price in. Microsoft Copilot under enterprise data protection keeps prompts and responses inside the tenant, honors existing permissions and sensitivity labels, and does not use them to train foundation models. Consumer Copilot is not safe for confidential client information: it retains conversation activity for 18 months by default and uses it for model training unless the user opts out. The two gaps are web search grounding, which Microsoft runs outside the Data Protection Addendum, and retention, because every prompt is copied into a hidden folder in the user's Exchange mailbox where eDiscovery can still read it.

Microsoft publishes both sets of terms itself: the consumer defaults in its Copilot privacy FAQ and the tenant commitments in its enterprise data protection documentation. The two sets differ on training, retention and administrative visibility. The question now arrives on security questionnaires that in-house legal teams are asked to sign. This article covers which account type decides the answer, what enterprise data protection commits to, and where that protection stops. It then turns to the practical consequences: who can read a lawyer's prompts, why those prompts are discoverable records, the oversharing risk, the labeling failure Microsoft has documented and fixed, the privilege question, and how to configure Copilot for confidential legal work.

[cta-1]

Key takeaways

1. Microsoft Copilot on a licensed work or school account keeps prompts, responses and the Microsoft Graph data behind them inside the tenant, and Microsoft states that none of it trains foundation models.
2. Consumer Copilot on a free or personal account stores conversation activity for 18 months by default and uses it for model training unless the user turns that setting off.
3. Web search grounding sits outside the Data Protection Addendum, where Microsoft acts as an independent data controller. HIPAA coverage and the EU Data Boundary stop at that same line.
4. Every prompt is written to a hidden folder in the user's own Exchange mailbox, where eDiscovery, the legal process for searching records during litigation or a regulatory investigation, reaches it. Deleting the chat does not delete that copy, and deletion is suspended under litigation hold.
5. Copilot respects existing permissions rather than correcting them, so a document a user was already over-permissioned to see becomes one Copilot will surface and summarize.

Is Copilot private?

Is Copilot private? Copilot is private within a Microsoft 365 tenant on a licensed work or school account, and Copilot is not private in the same sense on a free or personal account. A private Copilot session on a work account means prompts, responses and the Microsoft Graph data behind them stay inside the tenant boundary and are not used to train foundation models. Private does not mean invisible: an administrator with the right Purview role can read the same prompts.

A lawyer asking this usually means two things at once: whether Microsoft will see the content, and whether anyone at their own organization will. Microsoft constrains itself by contract on the first for licensed tenants, meaning organizations running Copilot inside their own dedicated Microsoft 365 environment. The second is governed by the organization's own retention policies, compliance roles and legal holds.

Which Copilot you are using decides the answer

Whether Copilot is confidential at work depends on which account the person at the keyboard is signed in with. Copilot is confidential at work on a licensed work or school account, subject to the exclusions set out below, and Copilot is not confidential on a free or personal account, even though the product name is identical on both sides. Microsoft draws that line at the identity: a personal Microsoft account on one side, a work or school account on Microsoft Entra ID on the other, Entra ID being the identity service that holds an organization's user accounts.

On a personal or free account

1. Microsoft states that it uses data from Bing, MSN and Copilot to train generative AI models unless the user turns off the use of conversation activity for model training.
2. The stored conversation activity default is 18 months.

Microsoft publishes both points in the privacy FAQ for Microsoft Copilot, which describes the consumer product specifically rather than the licensed one. Because this activity sits outside any tenant's compliance boundary, a prompt typed here leaves no record the firm can retrieve, preserve or produce. A lawyer signing in with a personal account, at home or on a phone, is working under those terms whatever their firm's tenant does.

On a licensed work or school account

1. Prompts, responses and the data Copilot retrieves through Microsoft Graph, the service that connects Copilot to a user's files, email and calendar, stay within the tenant's compliance boundary.
2. Microsoft states that users signed in with an organizational Entra ID account are excluded from model training.
3. Copilot inherits existing sensitivity labels and applies the organization's retention policies to the interaction.
4. Interactions are auditable, which means the organization can see them, not only Microsoft.

One naming note for the admin center: Microsoft has renamed Microsoft 365 Copilot to Microsoft Copilot, and Microsoft 365 Copilot Chat to Microsoft Copilot Chat. Some licenses still show the older labels during the transition, and Microsoft states that the security, compliance and privacy position is unchanged.

What enterprise data protection covers, and where it stops

Enterprise data protection is the contractual layer that makes Copilot usable for confidential work. Under it Microsoft acts as a data processor rather than a controller, bound by the Data Protection Addendum (DPA) and the Product Terms, and it sets the commitments out in its enterprise data protection documentation.

1. Encryption at rest and in transit, with logical tenant isolation.
2. A commitment not to use customer data except as the customer instructs.
3. Support for the General Data Protection Regulation (GDPR) and the EU Data Boundary.
4. Inheritance of the customer's sensitivity labels, retention policies, audit settings and administrative controls.
5. A statement that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.
6. The Customer Copyright Commitment and protected material detection on generated output.

Microsoft also attests Copilot against ISO/IEC 27018, the code of practice for protecting personal data in public cloud services. That is a Microsoft attestation rather than a general cloud-industry one.

Microsoft's own page footnotes three exclusions from those commitments. Retention is treated separately below, because it is a consequence of the commitments rather than an exclusion from them.

Web search grounding leaves the enterprise contract

When Copilot grounds an answer in a web search, the query goes to the Bing search service, which Microsoft describes as operating separately from Microsoft 365 under different data-handling practices. Microsoft removes user and tenant identifiers, but states that it acts as an independent data controller for those queries, governed by the Microsoft Services Agreement between each individual user and Microsoft rather than the organization's DPA. Microsoft documents the behavior and the switch that turns it off in its guidance on managing public web access for Copilot. Grounding that reaches outside the tenant runs that part of the interaction on consumer terms.

HIPAA coverage and the EU Data Boundary stop at the same line

Microsoft states, in the same enterprise data protection documentation cited above, that Copilot supports compliance with the Health Insurance Portability and Accountability Act (HIPAA) for properly configured implementations, and that this does not extend to web search queries, because those fall outside both the DPA and the Business Associate Agreement (BAA) governing protected health information (PHI). The EU Data Boundary carries the identical carve-out. For a team handling health data or European data-residency obligations, both collapse into one instruction: turn web grounding off for those groups rather than rely on user discretion.

Anthropic models sit outside the EU Data Boundary

Copilot calls more than one model provider, and Microsoft names Anthropic as a subprocessor in its documentation on connecting to an AI subprocessor. Microsoft states that Anthropic models are currently excluded from the EU Data Boundary and, where applicable, from in-country processing commitments. Keeping prompts inside the tenant for training and access purposes is not the same commitment as one about where processing physically occurs. A team with a data-residency obligation in a client engagement letter treats the subprocessor list and the regional processing position as separate questions from the training question, and confirms which Copilot experiences in its tenant may call which providers.

Does Copilot train on your data?

No, Microsoft Copilot does not train foundation models on data from a licensed work or school account. Microsoft states the commitment in the enterprise data protection terms and extends it to prompts, responses, and the organizational data Copilot retrieves through Microsoft Graph. It is contractual rather than a setting, so no administrator has to find a switch to make it true.

The consumer exception

1. The control that stops consumer model training is an opt-out rather than an opt-in, so participation is the default state.
2. Turning it off changes future activity only and does not reach what the user has already submitted.
3. Microsoft names product improvement, advertising, safety, security and compliance as purposes that continue after the user opts out.

Microsoft documents that control and its limits in its guidance on Copilot privacy controls, and the scope of that page is the consumer experience. This matters inside a firm not because anyone plans to draft on a personal account, but because the same brand name sits in Windows, in a browser sidebar and on a phone. Which terms apply is decided by which account is signed in, not by which window the clause was typed into.

Can my employer see what I do on Copilot?

An employer can see what an employee does on Copilot. Microsoft, by contract, does not. An administrator at the employer can retrieve the prompts an employee typed into Copilot and the answers Copilot gave, because those interactions are stored in that employee's work mailbox and are covered by the organization's compliance tooling. Copilot itself grounds answers in the files, email and chats the signed-in user already has permission to open, retrieving under that user's own identity rather than an elevated service account.

1. An administrator holding the relevant Microsoft Purview role can run an eDiscovery search that returns a user's Copilot interactions.
2. Audit logging records Copilot interactions alongside other Microsoft 365 activity.
3. Retention policies applied to Exchange reach the stored copies of those interactions.
4. Data Loss Prevention policies can be scoped to Copilot, so the organization can block interactions rather than only observe them.
5. None of these require the user's knowledge, because they are tenant administration rather than a feature of the chat window.

Microsoft sets out the grounding model and the permissions it relies on in its Copilot privacy, security and compliance documentation. The record lands in the user's mailbox, and whoever already has access to that mailbox can read it.

What an administrator can and cannot retrieve

1. An administrator can retrieve the text of prompts and responses through compliance tooling, subject to the roles the organization has assigned.
2. An administrator cannot see interactions from a personal Microsoft account, because those sit outside the tenant entirely.
3. An administrator with no assigned compliance role has no routine path to another user's prompts, which is a governance question rather than a product limitation.

Copilot prompts are discoverable records

Copilot prompts are discoverable in litigation. A Copilot prompt is a business record stored in the user's own mailbox, reachable by eDiscovery. This is what decides how to advise a firm using Copilot on a matter under litigation hold.

1. Microsoft stores data from generative AI messages in a hidden folder in the mailbox of the user who ran the AI application.
2. Messages stored in mailboxes, including those hidden folders, are searchable by eDiscovery tools.
3. What the chat window shows is not an accurate reflection of whether a message has been retained or permanently deleted for compliance purposes.
4. Permanent deletion is suspended whenever the mailbox is covered by another retention policy for the same location, litigation hold, delay hold, or an eDiscovery hold.
5. Even an aggressive policy takes time: Microsoft notes that a delete-after-one-day policy can take up to 16 days before a message stops being returned in eDiscovery searches.

Microsoft documents the storage location, the hold behavior and the timing in its guidance on retention policies for Copilot. A Copilot prompt is a business record in the lawyer's own mailbox, and on a matter under litigation hold it cannot be deleted.

What deleting a chat actually does

Clearing a conversation from the Copilot interface removes it from the interface. It does not remove the retained copy from the mailbox, and on a tenant with a hold in force it cannot, because the hold overrides the deletion step by design. A lawyer who needs to know whether a prompt still exists asks the compliance team to run an eDiscovery search rather than checking the chat history.

[cta-2]

Oversharing is the risk Copilot inherits

Copilot oversharing is a SharePoint permissions risk rather than a Microsoft failure. It is a permissions problem that already existed and that Copilot makes visible, because Copilot respects the permissions on a document rather than correcting them. A SharePoint site opened to the whole organization years ago becomes a source Copilot will summarize for anyone who asks the right question.

1. A document a user could already open, but would never have found, becomes a document Copilot will find and quote.
2. Site-level and tenant-level sharing defaults set long before the product existed are a common source, not individual mistakes.
3. Departed-employee content and legacy matter folders are frequent sources, because permissions on material nobody is using are rarely re-reviewed.
4. Sensitivity labels only constrain what they have been applied to, which makes unlabeled historical content the weak point.

What to check before rollout

Microsoft built reporting for this problem, and its Data Security Posture Management for AI documentation describes the reports showing which AI interactions touched sensitive material and which sites are oversharing. Running that assessment before a rollout, rather than after an incident, surfaces exposure the firm already has. Three things are worth pulling out of it before anyone is licensed:

1. Which sites and document libraries are shared organization-wide, ranked by how much labeled material they hold.
2. Which matter folders belonging to departed staff are still reachable by current users.
3. Which document sets carry no sensitivity label at all, since those are the ones no policy can act on.

The confidential-email bug Microsoft fixed

Microsoft tracked one documented failure of the labeling mechanism as CW1226324, detected it on 21 January 2026, and began rolling out a fix in February 2026. TechCrunch reported the disclosure and Microsoft's account of it.

1. Draft and sent emails carrying a confidential sensitivity label were processed by Microsoft Copilot Chat despite a Data Loss Prevention (DLP) policy configured to block automated AI processing of labeled content.
2. Sent Items and Drafts were affected. The Inbox was not.
3. Microsoft's position is that the bug did not give anyone access to information they were not already authorized to see, because a user could only summarize their own drafts and sent mail.

For a regulated organization, the defect was that a label-based control did not hold: a labeling and logging failure, even though no unauthorized person read anything beyond what they could already access. The practitioner conclusion is narrow: a label is a control rather than a guarantee, so verify what was processed through eDiscovery and audit records rather than through the chat window.

How Copilot affects attorney-client privilege

Copilot does not waive attorney-client privilege on its own, though waiver always turns on the facts of a particular use. Using Copilot on a licensed tenant is not, by itself, a disclosure of privileged material to a third party, because the tenant boundary keeps the content with the organization and Microsoft binds itself as a processor. The analysis is the ordinary one applied to a new tool: whether the communication remained confidential, whether disclosure to an outside party occurred, and whether the firm took reasonable steps to protect it. That framework across AI tools is set out in our guide to privilege and AI tools, and it applies to Copilot without modification. The American Bar Association addressed a lawyer's duties when using generative AI in ABA Formal Opinion 512, which treats competence, confidentiality and supervision as the operative duties.

Where Copilot changes the analysis

Two features of Copilot move the privilege analysis, and only one of them is an exclusion. A prompt grounded in a web search has left the organization's Data Protection Addendum, a disclosure to an independent controller under separate terms, and a reasonable-steps argument gets harder when an administrator could have switched that behavior off. Retention is the second, and it cuts the other way: because prompts persist in the mailbox and are producible, a privileged analysis typed into Copilot becomes a document to be logged and defended on a privilege log. Teams working through how an inadvertent disclosure is assessed will find that question treated in depth in our analysis of waiver risk when AI tools are involved.

Configuring Copilot for confidential legal work

How to configure Copilot for confidential information starts with the administrator rather than the user. Configuring Copilot for confidential legal work is tenant-level work: the controls that decide whether Copilot handles confidential information safely are set once in the Microsoft 365 admin center and in Microsoft Purview, and Microsoft documents each one. A lawyer cannot configure Copilot for confidential information from inside the chat window, because none of these controls appear there. Labeling is the foundation, and Microsoft's documentation on sensitivity labels describes how a label travels with a document and how Copilot inherits it.

Tenant-level controls

Matter-level habits

1. Decide with IT which practice groups get web grounding and which do not, rather than leaving the switch at the tenant default, since legal owns the obligation and IT owns the setting.
2. Run the oversharing assessment before rollout and again at matter close, where stale permissions accumulate.
3. Treat Copilot prompts on a held matter as producible from the day the hold attaches, and say so in the hold notice.
4. Label privileged material before Copilot is deployed, not after, because the label is what the DLP policy acts on.
5. Confirm the compliance roles able to read prompts are the ones intended, since the default assignment may not match a firm's conflicts and ethical-wall expectations.

A firm-wide AI data policy is where all of this belongs, and the drafting considerations are covered in our guide to AI data privacy for law firms. The controls above are the technical half of that policy, and the policy is what makes them survive a change of administrator.

Day-to-day use is the other half. A lawyer who knows which prompts the tool handles well is less likely to paste a whole agreement into a chat window to find out, and our collection of Copilot prompts for lawyers sets out the patterns that work on legal material.

Where Spellbook fits for confidential contract work

A private AI alternative to Copilot for lawyers is a different kind of tool rather than a more private chat window. Lawyers looking for a private alternative to Copilot are usually looking for something that keeps contract work inside a narrower boundary and returns a finished document rather than an answer. Copilot is a general productivity assistant with access to a firm's documents, which is both its strength and the source of every risk above. It summarizes an agreement and answers questions about it, and the limits of that on contract work are covered in our assessment of whether Copilot can review a contract. What it does not do is apply a firm's own playbook positions and return the agreement marked up against them.

Spellbook is a contract tool built for that job, and the confidentiality position is scoped to contract work and set out in a single published page a firm can attach to a questionnaire. Our security page states that zero data retention agreements have been negotiated with both OpenAI and Anthropic, so customer data in requests and responses to those models is not persisted and exists only in memory for the duration of a request. The same page documents SOC 2 Type II compliance, HIPAA compliance under the Security, Privacy and Breach Notification rules, alignment with the GDPR and the California Consumer Privacy Act, processing on Amazon Web Services in Canada and the United States, and single sign-on through Microsoft accounts so a firm can enforce multi-factor authentication in its own Entra tenant.

1. The Review feature runs a first-pass review and proposes redlines as native Track Changes in Word, which the lawyer reviews and accepts or rejects.
2. The Draft feature generates and revises language from a team's own precedents rather than from general web text.
3. The Playbooks feature encodes a team's own primary and fallback positions internally, so reviews apply the same standard rather than depending on whoever ran them.
4. The Compare to Market feature benchmarks a clause against data from 20M+ real contracts across a broad set of clause types.

What Spellbook does not do

Spellbook is a commercial-contract specialist rather than a legal research or litigation platform, and it does not replace the tenant-level governance described above. A firm running Spellbook still owns its Purview configuration, its retention schedule and its oversharing posture, because those govern the Microsoft 365 environment rather than any one add-in. Teams weighing a wider set of options against their own confidentiality requirements will find the category surveyed in our comparison of the most private AI tools for legal work.

For contract work the question is usually not whether a general assistant can read an agreement but whether the output can be relied on and defended to a counterparty, which depends on checking it against a firm's own playbook positions rather than against a general standard. See how the Review feature works in Word on a live agreement.

[cta-3]

Frequently asked questions

Is Copilot reading my emails?

Copilot reads email the signed-in user already has permission to read, and only when it needs that content to ground an answer. Retrieval runs through Microsoft Graph under the user's own identity, so it reaches the same mailbox the user could open manually and no mail beyond it.

How do I delete my Copilot chat history?

A user can clear a conversation from the Copilot interface, and that is the only deletion control a user has. Whether the retained copy goes with it is set by the organization's retention policy rather than by the user, so the answer to "is it gone" comes from the compliance team rather than from the chat window.

Is Copilot HIPAA compliant?

Microsoft states, in its enterprise data protection documentation, that Copilot supports HIPAA compliance for properly configured implementations, which is conditional rather than a certification. The condition that matters most is web search grounding, which Microsoft excludes from both the Data Protection Addendum and the Business Associate Agreement, so an organization handling PHI disables web grounding for the affected groups first. The same tier-dependent pattern holds for retrieval-first tools such as Perplexity, where the plan a firm is on, not a single setting, decides whether client data stays private.

Is Copilot more secure than ChatGPT?

Neither is more secure in the abstract, because both depend on the account tier in use and how the tenant is configured. The comparison that matters is between the enterprise terms of each rather than the consumer versions most people have tried, and the two sit side by side in our comparison of Copilot and ChatGPT privacy terms.

Does Copilot keep prompts after someone leaves the firm?

Yes. When a user leaves and their mailbox becomes an inactive mailbox, the Copilot messages stored in it remain available to eDiscovery search. A departure does not clear the record, which is worth knowing before assuming that offboarding resolves an exposure question.