Question 1

Is Microsoft 365 Copilot GDPR compliant?

Accepted Answer

It can be used in a GDPR-compliant way, but compliance is not automatic. You remain the controller. You still need a lawful configuration, oversharing controls, and usually a DPIA if Copilot will process personal data at scale.

Question 2

Does the EU Data Boundary cover all Copilot processing?

Accepted Answer

No. Copilot is an EU Data Boundary service for eligible tenants, but Flex Routing, Anthropic models and Bing web grounding sit outside that commitment, or can sit outside it, depending on settings.

Question 3

What is Flex Routing, and should we disable it?

Accepted Answer

Flex Routing lets Copilot run LLM inferencing outside the EU Data Boundary during peak load. It is on by default for many EU tenants in 2026. Disable it if your policy requires processing to stay inside the Boundary at all times, and record the decision.

Question 4

Do we need a DPIA before enabling Copilot?

Accepted Answer

Most organisations that will use Copilot with personal data at scale should complete a DPIA under Article 35 GDPR. Microsoft templates help, but you remain responsible for the assessment, residual risk and any prior consultation.

Question 5

What does this scanner actually measure?

Accepted Answer

It depends which assessment you take. The executive pack is 25 questions across seven Copilot control areas. Separate assessments cover only the EU Data Boundary, oversharing, the GDPR file, identity/rollout, or Azure AI Foundry. None of them connect to Microsoft Graph. None of them are a certification or legal advice.

Question 6

Why is this not one questionnaire?

Accepted Answer

Extra-EU processing, oversharing, GDPR paperwork, identity and Azure AI Foundry are different risks and different search questions. One 25-question form covering all of them produces a score nobody can act on, and a page search engines treat as a doorway. Each assessment has its own knowledge page. You see a score before any email.

Question 7

Which risk frameworks does the report use?

Accepted Answer

ISO 31000 for the board process, GDPR for the legal duty, NIST CSF 2.0 for the Current vs Target Organizational Profile, ISO/IEC 27001:2022 Clause 6.1 for an automated 5×5 risk assessment (likelihood = 1 + round(4 × weighted question-gap); impact = floor + open drivers) and Annex A as a Copilot-scoped Statement of Applicability. NIS2 and ISO 42001 / NIST AI RMF are overlays. The scan is not a certification against any of them.

Question 8

Is my data sent to a server?

Accepted Answer

Answers stay in this browser so you can resume. If you unlock the full report, name, work email, company, score and flags are emailed to Datalegale so we can follow up. Knowledge pages and the preview score do not require an email. Details are in the privacy notice.

Path	In the EU Data Boundary?	Leaves or excluded when	What to check
Microsoft 365 Copilot (eligible tenant, Flex Routing off)	Yes — listed EUDB service	You are not eligible (e.g. Multi-Geo), or you enable an excluded model / web grounding	Org profile; Copilot is an EUDB workload
Copilot Chat (work, commercial, eligible)	Yes, same catalogue	Same exceptions as Copilot	Enterprise data protection / DPA applies to work identity
Data at rest (prompts stored, Graph content)	Yes, stays in the Boundary	Limited pseudonymized operational data may be stored outside	Do not confuse storage geo with inferencing geo

Path	Where prompts infer	What it is not
Copilot, Flex Routing off	EU Data Boundary (eligible tenants)	Not a Foundry deployment type. Does not govern Azure resources.
Copilot, Flex Routing on	US, Canada or Australia at peak load	Not Foundry Global. Different toggle, different product.
Foundry regional EU resource	That Azure region, unless the model card says otherwise	Not Copilot EUDB. Resource region is a choice in Azure.

Copilot Flex Routing is on by default.

EU Microsoft assessments

Copilot Flex Routing: Can Inferencing Leave the EU?

Is Microsoft 365 Copilot in the EU Data Boundary?

Copilot Oversharing: SharePoint, Labels and DLP

Is Microsoft’s Copilot DPIA Template Enough?

Safe Copilot Rollout: Identity Before Broad Access

Copilot EUDB ≠ Foundry Data Zone ≠ Global

Microsoft 365 Copilot Readiness Assessment (EU)

What leaves Europe

Does Copilot stay inside the EU Data Boundary?

If Copilot is in the EU Data Boundary, is Azure AI Foundry too?

18-page board pack