Home / FAQ
Is Copilot GDPR compliant? Flex Routing FAQ
Short answers on Copilot, the EU Data Boundary, Flex Routing, DPIA and what this scanner measures — and what it does not claim.
Last source check 24 August 2026. This is not legal advice.
Is Microsoft 365 Copilot GDPR compliant?
It can be used in a GDPR-compliant way, but compliance is not automatic. You remain the controller. You still need a lawful configuration, oversharing controls, and usually a DPIA if Copilot will process personal data at scale.
Does the EU Data Boundary cover all Copilot processing?
No. Copilot is an EU Data Boundary service for eligible tenants, but Flex Routing, Anthropic models and Bing web grounding sit outside that commitment, or can sit outside it, depending on settings.
What is Flex Routing, and should we disable it?
Flex Routing lets Copilot run LLM inferencing outside the EU Data Boundary during peak load. It is on by default for many EU tenants in 2026. Disable it if your policy requires processing to stay inside the Boundary at all times, and record the decision.
Do we need a DPIA before enabling Copilot?
Most organisations that will use Copilot with personal data at scale should complete a DPIA under Article 35 GDPR. Microsoft templates help, but you remain responsible for the assessment, residual risk and any prior consultation.
What does this scanner actually measure?
It depends which assessment you take. The executive pack is 25 questions across seven Copilot control areas. Separate assessments cover only the EU Data Boundary, oversharing, the GDPR file, identity/rollout, or Azure AI Foundry. None of them connect to Microsoft Graph. None of them are a certification or legal advice.
Why is this not one questionnaire?
Extra-EU processing, oversharing, GDPR paperwork, identity and Azure AI Foundry are different risks and different search questions. One 25-question form covering all of them produces a score nobody can act on, and a page search engines treat as a doorway. Each assessment has its own knowledge page. You see a score before any email.
Which risk frameworks does the report use?
ISO 31000 for the board process, GDPR for the legal duty, NIST CSF 2.0 for the Current vs Target Organizational Profile, ISO/IEC 27001:2022 Clause 6.1 for an automated 5×5 risk assessment (likelihood = 1 + round(4 × weighted question-gap); impact = floor + open drivers) and Annex A as a Copilot-scoped Statement of Applicability. NIS2 and ISO 42001 / NIST AI RMF are overlays. The scan is not a certification against any of them.
Is my data sent to a server?
Answers stay in this browser so you can resume. If you unlock the full report, name, work email, company, score and flags are emailed to Datalegale so we can follow up. Knowledge pages and the preview score do not require an email. Details are in the privacy notice.
Why can Copilot show files we thought were private?
Copilot can ground on anything the signed-in user already has permission to open. Forgotten Anyone links, “Everyone except external users”, and broad groups are the usual cause — not a Copilot bypass of permissions.
Do sensitivity labels automatically protect a whole SharePoint site?
Container labels on a site do not automatically protect every file inside it. Apply item-level labels to personal and sensitive content if you want Copilot to honour those restrictions.
Are standard DLP policies enough for Copilot?
Not by default. Review whether Microsoft 365 Copilot is included as a location where the platform supports it. Run policies in simulation, then enforce, and pair them with labels.
What is the difference between commercial and consumer Copilot?
Commercial Microsoft 365 Copilot under Enterprise Data Protection is a different product, contract and admin model from consumer Copilot. Consumer Copilot is not appropriate for processing personal data of EU staff or customers at work.
Does the EU AI Act replace the GDPR for Copilot?
No. Most organisations using Copilot as a deployer have lighter AI Act duties than providers. GDPR obligations — including DPIA, transparency and security — remain fully applicable.
Does Azure AI Foundry follow the same settings as Microsoft 365 Copilot?
No. Foundry region, model and network choices are separate. Apply the same accountability pattern — DPIA, logging, access control and a named owner — but do not assume Copilot tenant settings govern Foundry deployments.
Where do Bing web-grounding queries go?
When web search is on, Copilot can generate a shortened query and send it to Bing. Those queries fall outside the EU Data Boundary. Treat web search as a conscious configuration choice, not a default to leave unreviewed.
Which languages is Datalegale available in?
The interface, assessments, reports and knowledge pages are available in English, German, Finnish, Estonian, Latvian and Lithuanian. Microsoft Learn and Message Center links stay in English. The product is written for EU and EEA organisations, including the Baltics.
How does Datalegale use my work email?
Only if you unlock a report. We email a copy of the request to hello@datalegale.com, with the score and open flags. Occasional updates go out only if you tick that box. You can ask us to erase the mail. See the privacy notice and GDPR guidelines.
Is a high score a green light to roll Copilot out to everyone?
No. A high score means your answers describe a comparatively strong posture. You still need to verify the settings, finish any open actions, and document residual risk. Unknown answers are scored as gaps on purpose.
Can Datalegale help after the score?
Yes. The questionnaire is a self-check. For consultation, implementation, development, or questions about Copilot in your tenant, write to hello@datalegale.com.
Articles match the interface language. Microsoft Learn links stay in English.