Is Microsoft Copilot Private for Legal Work?

It depends on which Copilot you are signed into. Copilot used with a work account (a Microsoft Entra account) is covered by Microsoft's Enterprise Data Protection, and Microsoft states that prompts, responses and Microsoft Graph data are not used to train its foundation models. Copilot used with a personal Microsoft account is a consumer product governed by the Microsoft Services Agreement and the Copilot Terms of Use, and Microsoft's documentation for it now differs by app version: the older app can use conversations for training by default, and Microsoft says the updated app, available since 18 August 2026, does not use prompts and responses to train foundation models. Either way, a personal account is not the setup your firm vetted. Even on a work account, the duty to confirm your tenant settings stays with you.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice. Every Microsoft statement below comes from a Microsoft page we read on 12 October 2026, named where it appears; check the page before you rely on it, because Microsoft changes these products and their terms often.

TL;DR

• The account you sign in with decides the rules. Microsoft's Enterprise Data Protection applies to Copilot and Copilot Chat when you sign in with a Microsoft Entra work or school account. Personal Microsoft accounts are governed by the Microsoft Services Agreement and the Copilot Terms of Use.
• Personal-account training rules depend on the app version. Microsoft's Privacy FAQ (older app) says conversation activity is used for training by default unless you opt out or fall in an excluded group. Microsoft's page for the updated app says prompts, responses and file contents "aren't used to train foundation models."
• Work accounts: no training on prompts, responses or Graph data. Microsoft states this on its Enterprise Data Protection page, under the Data Protection Addendum (DPA) and Product Terms, with Microsoft as your data processor.
• Configuration is your job. Microsoft says the specific controls vary by subscription plan, and Copilot only surfaces data the user has permission to view, so oversharing in SharePoint or Teams still creates exposure.
• Web search is handled separately. Microsoft says web queries go to the Bing service, which has different data-handling practices and sits outside the DPA and BAA.
• When unsure, do not paste. Confirm the account, the terms and your tenant settings first, and anonymize if anything is shaky.

The three Copilots, and why the name confuses lawyers

Microsoft uses "Copilot" for several products with different data rules. The shared name is a common source of confusion. A lawyer hears "we have Copilot" and assumes one privacy posture, when the reality depends on the sign-in and the license. Microsoft is also renaming the products: its Learn pages carry a note that "Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now named Microsoft Copilot Chat."

For confidentiality, the distinction that matters is the account type:

• Copilot with a personal Microsoft account. A consumer product. Microsoft's personal-account page says use is governed by the Microsoft Services Agreement and the Copilot Terms of Use.
• Copilot Chat and Microsoft 365 Copilot (Basic) with a work account. Microsoft's "What is Microsoft Copilot?" overview page says Copilot Chat (Basic) is included with eligible Microsoft 365 licenses, is grounded in public web data, and can use organizational content only when you provide it with your prompt. It is protected by Enterprise Data Protection when you sign in with an Entra account.
• Microsoft 365 Copilot (Premium), the add-on license. Microsoft says it grounds responses in organizational data through Microsoft Graph and Work IQ, also under Enterprise Data Protection.

The privacy answer changes between the personal tier and the work tiers. The next sections show why.

Does Copilot train on what you type?

This is the question that decides a lot for a lawyer, and the answer splits by account and, for personal accounts, by app version.

Personal account, older Copilot app. Microsoft's "Privacy FAQ for Microsoft Copilot" says: "Except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training. This includes de-identified search and news data, interactions with ads, and your voice and conversation activity with Copilot, including the images or files you upload." The FAQ lists groups it does not train on, including users signed in with an organizational Entra account, users who opted out, and users of Copilot inside Microsoft 365 apps with Personal or Family subscriptions. It says conversation activity is stored for 18 months by default, and you can delete it. It also says: "You shouldn't provide any confidential or sensitive personal data that you would not want Microsoft to use for purposes explained in this FAQ and in the Microsoft Privacy Statement."

Personal account, updated Copilot app. The same FAQ opens with a banner that an updated Copilot app became available on 18 August 2026 and that the FAQ applies only to the older app. Microsoft's page for the updated app, "Microsoft Copilot for individuals: your activity history," says: "Prompts, responses, and your file contents when using the Microsoft Copilot app aren't used to train foundation models." We could not find a retention period for the updated app on the pages we read. Not verified in our October 2026 review. Check Microsoft's "Microsoft Copilot for individuals" privacy pages for the current retention rules.

Work account. Microsoft's "Data, Privacy, and Security for Microsoft Copilot" page says: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot." The Privacy FAQ adds that its content "does not apply to the use of Microsoft 365 Copilot when signed in with Entra ID."

The account, not the brand name, decides which of these applies.

Tier comparison: what each Copilot does with your data

Here is the split in one view. Confirm the current terms yourself, because vendor policies move.

Two notes for the table. First, Microsoft says the specific Enterprise Data Protection controls vary by subscription plan. Second, the add-on license reads your emails, files and chats through Microsoft Graph, and Microsoft says Copilot only surfaces data the user has at least view permission for. Permission settings matter even when training is off.

What Enterprise Data Protection actually covers

Microsoft's "Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat" page says EDP "refers to controls and commitments, under the Data Protection Addendum (DPA) and Product Terms, that apply to customer data for users of Microsoft Copilot and Microsoft Copilot Chat," and that Microsoft acts as a data processor. The page groups the commitments like this:

• Security. Encryption at rest and in transit, rigorous physical security controls, and data isolation between tenants.
• Privacy. "We won't use your data except as you instruct," with support for the GDPR, the EU Data Boundary, and ISO/IEC 27018.
• Your controls apply. Copilot "respects your identity model and permissions, inherits your sensitivity labels, applies your retention policies, supports audit of interactions, and follows your administrative settings," and the specific controls vary by subscription plan.
• No training on your data. The prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models.
• Copyright and AI risks. Protected material detection and Microsoft's Customer Copyright Commitment.

Microsoft describes EDP as "controls and commitments" under the DPA and Product Terms, and says the specific controls vary by plan.

Where your data is processed. Do not assume everything stays in one place. Microsoft's privacy page says calls to the LLM are "routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods." For EU users, EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing. Customers outside the EU may have queries processed in the US, EU or other regions. A footnote on the EDP page says "Anthropic models are currently excluded from the EU Data Boundary" and from in-country processing commitments, and that the EU Data Boundary does not apply to web search queries.

The web-search caveat. Microsoft says web queries sent to the Bing search service are generated from the prompt "into a few words," sent "with user and tenant identifiers removed," not shared with advertisers, and not used to train its foundation models. It also says the Bing service "operates separately from Microsoft 365 and has different data-handling practices covered by the Microsoft Services Agreement between each user and Microsoft, together with the Microsoft Privacy Statement," with Microsoft acting as an independent data controller. A footnote says the DPA and the HIPAA Business Associate Agreement do not cover web search queries. A Copilot answer grounded in a web search is therefore not handled the same way as one that stays inside your tenant. Keep that in mind before a sensitive prompt triggers a web lookup.

What is safe, and what is not, for a lawyer

Tie this back to your duty of confidentiality under Model Rule 1.6 and ABA Formal Opinion 512, issued 29 July 2024. The opinion applies Rule 1.6 to generative AI directly: lawyers must assess the likelihood of disclosure, the sensitivity of the information, the difficulty of implementing safeguards and the effect of safeguards on representation. As a baseline, it says lawyers "should read and understand the Terms of Use, privacy policy, and related contractual terms and policies of any GAI tool they use to learn who has access to the information that the lawyer inputs into the tool" or consult someone who has.

On consent, the opinion says self-learning tools raise the risk that information relating to one client's representation is later disclosed in responses to other users, and that because many of today's self-learning tools are designed so that their output could lead directly or indirectly to disclosure, "a client's informed consent is required prior to inputting information relating to the representation into such a GAI tool." It says merely adding "general, boiler-plate provisions to engagement letters purporting to authorize the lawyer to use GAI is not sufficient." It also notes uses of self-learning tools where consent is not required, so the answer turns on the specific tool and matter. A tool that does not train on your inputs presents a different risk profile from one that does, but the opinion still asks you to read the terms and assess the risk.

Run that standard against each setup.

Not a safe default for client-confidential work:

• Pasting client names, deal terms or privileged material into Copilot with a personal Microsoft account. Microsoft's own FAQ tells users not to provide confidential or sensitive data they would not want Microsoft to use for the purposes in the FAQ.
• Assuming a personal-account Copilot carries the business data terms of your work license. Microsoft says personal-account use is governed by the Microsoft Services Agreement and the Copilot Terms of Use.
• Treating a training setting as a guarantee. Settings and documentation change, as the August 2026 app update shows.

Can be defensible, if configured and checked:

• Using Copilot with a work account under your organization's Data Protection Addendum, in a tenant where permissions and sensitivity labels are set correctly.
• Using Copilot Chat with a work account for tasks that do not pull sensitive organizational data into a web-grounded prompt.
• Confirming retention and audit through Microsoft Purview, so you can show how matter data was handled.

The structural risk Opinion 512 names for self-learning tools is that information you put in could later be revealed to someone else. Opinion 512 asks you to assess the likelihood of disclosure and unauthorized access, not to assume it away, and that assessment starts with knowing where the data goes. Our ABA Formal Opinion 512 guide covers the full set of duties. Your state bar may have its own guidance, so check yours.

Before you let Copilot touch a matter

Run this due-diligence list before any client or matter data goes into a work Copilot. Every Microsoft statement below comes from Microsoft pages read on 12 October 2026. Confirm the current terms and your own tenant settings, because both can change.

• Confirm the account type. Are you signed in with a work or school Entra ID account, not a personal Microsoft account? Microsoft says Enterprise Data Protection applies to Entra sign-ins and personal accounts follow different terms. The account decides this.
• Confirm EDP is in scope. Is Enterprise Data Protection covered for your license, under your Data Protection Addendum and Product Terms? Microsoft says the specific controls vary by subscription plan. Get the contract reference, not a sales assurance.
• Clean up tenant permissions first. Microsoft says Copilot only surfaces data the user has at least view permission for. SharePoint or Teams oversharing becomes exposure. Run a permission review before rollout.
• Set Purview retention and labels. Microsoft says admins can use Purview to set retention policies for Copilot chat interactions, and that Copilot honors usage rights on data encrypted by Purview Information Protection. Configure them so you can show how matter data was handled.
• Check the web-search path. Microsoft says web queries to Bing have separate data handling and are not covered by the DPA or BAA. Confirm how that path is configured before a sensitive prompt triggers a web lookup.
• Check where processing can happen. Microsoft says LLM calls can go to other regions at high utilization, and that Anthropic models are excluded from the EU Data Boundary. Confirm the model and region settings in your tenant if that matters to your clients.
• Match the tool to the matter. For high-sensitivity or privileged work, apply ABA Opinion 512: read the terms, assess the risk, get informed consent where required, and anonymize anything you cannot place under the contract.

The permissions item is the one firms skip. Training-off does not help if Copilot can read a payroll spreadsheet a partner left shared with everyone. Permissions hygiene is half the privacy story.

The verdict

The brand name does not decide privacy. The account type and the contract do. A personal-account Copilot and a work-account Microsoft Copilot share a logo and different terms.

Copilot with a personal account is not the setup to use for client confidences. Microsoft says it is governed by consumer terms, and its training rules now depend on which app version you are running. Microsoft documents its work-account protections separately.

Microsoft Copilot with Enterprise Data Protection can be a defensible choice. The word that matters is "after." It fits privileged work only after the tenant is cleaned up and the data agreement is confirmed. Microsoft provides the commitments. Meeting the conditions is on your firm.

The practical move is to know which Copilot your team is actually using. A lawyer signed in with a personal account may think they are protected because the brand is the same. Check the sign-in, check the license, and check the tenant before any matter data goes in.

For the sibling questions on other assistants, see whether ChatGPT is confidential for legal work and whether Claude is fit for legal work. If you want the task-by-task view on Copilot itself, our Copilot for lawyers guide covers the safe uses and the limits.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

FAQ

Is Microsoft Copilot private for legal work? It depends on the account and the license. Microsoft says Copilot with a work account is covered by Enterprise Data Protection under its Data Protection Addendum and Product Terms, and that prompts, responses and Graph data are not used to train foundation models. Personal-account Copilot follows consumer terms and is not the setup to use for client-confidential matters.

Does Microsoft Copilot train on what I type? On a work account, Microsoft states that prompts, responses and Microsoft Graph data are not used to train foundation models. On a personal account it depends on the app version: Microsoft's Privacy FAQ for the older app says conversation activity is used for training by default unless you opt out or are in an excluded group, and Microsoft's page for the updated app (available since 18 August 2026) says prompts, responses and file contents are not used to train foundation models. Confirm the current terms, since they change.

What is Enterprise Data Protection in Microsoft Copilot? Microsoft's page says it refers to controls and commitments under the Data Protection Addendum and Product Terms that apply to customer data for users of Copilot and Copilot Chat, with Microsoft as data processor. It covers encryption, tenant isolation, a no-training commitment and your own controls such as permissions, sensitivity labels, retention and audit, which vary by subscription plan.

Is the free personal-account Microsoft Copilot safe for client data? It is not the setup to use for confidential client work. Microsoft says personal-account use is governed by the Microsoft Services Agreement and the Copilot Terms of Use, and documents Enterprise Data Protection under the Data Protection Addendum for work-account use. Its FAQ advises against providing confidential data you would not want Microsoft to use for the purposes described there. Use Copilot signed in with a work account, or anonymize before entering anything sensitive.

Does signing in with a work account change Copilot's privacy? Yes. Microsoft says its consumer Privacy FAQ does not apply when you sign in with Entra ID, and that Enterprise Data Protection applies to Copilot and Copilot Chat for Entra sign-ins. The work account is what brings the Data Protection Addendum terms and the no-training commitment, not the Copilot brand name by itself.

Can I use Microsoft Copilot and stay compliant with ABA 512? You can use it with care. Opinion 512 asks you to read and understand a tool's terms, assess the risk of disclosure, and obtain informed client consent before inputting client information into a self-learning tool whose output could lead to disclosure, and it says boilerplate engagement-letter language is not sufficient. Confirm your tenant configuration and the DPA, and apply the opinion to the facts of the matter.

Where does Microsoft Copilot process and store my data, and can I delete it? Microsoft says prompts, responses and the data they retrieve are processed and stored in alignment with the contractual commitments for your organization's other Microsoft 365 content, and the stored interaction data is encrypted at rest. Admins can use Content search or Microsoft Purview to view and manage it and to set retention policies for chat interactions, and users can delete their Copilot activity history in the My Account portal. Processing location is not fixed to one region: Microsoft says LLM calls go to the closest data centers but can go to other regions at high utilization, with EU Data Boundary safeguards for EU traffic and Anthropic models excluded from the boundary. Web search queries sent to Bing have separate handling.

Is a legal-specific AI tool more private than Copilot? Not automatically. Privacy depends on the terms, not the product category. Ask any vendor, Microsoft included, whether it trains on your data, who its subprocessors are, where processing happens, what its retention settings are and what agreement covers your data, and read the answers in writing the way you would check a citation.

Sources

All read on 12 October 2026.

• Microsoft, "Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat," learn.microsoft.com (last updated 18 August 2026).
• Microsoft, "Data, Privacy, and Security for Microsoft Copilot," learn.microsoft.com.
• Microsoft, "What is Microsoft Copilot?" (overview), learn.microsoft.com (updated 1 October 2026).
• Microsoft, "Privacy FAQ for Microsoft Copilot" (older app), support.microsoft.com.
• Microsoft, "Microsoft Copilot for individuals: your data, privacy, and responsible AI" (updated app), support.microsoft.com, and "Microsoft Copilot for individuals: your activity history," support.microsoft.com.
• ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, "Generative Artificial Intelligence Tools," 29 July 2024 (americanbar.org).

Last reviewed: 12 October 2026.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.