Is work Copilot the same as consumer Copilot?

Commercial Microsoft 365 Copilot under Enterprise Data Protection is a different product, contractually and technically, from consumer Copilot. Commercial Copilot is covered by the Microsoft DPA, admin controls, and — for eligible tenants — the EU Data Boundary with documented exceptions. Consumer Copilot is not appropriate for processing personal data of EU data subjects in a professional context.

Why people mix them up

The brand name is the same. The chat window looks similar. Browser access is easy. Without a clear internal rule, staff will use whichever Copilot answers fastest, including personal accounts on work content.

That mix-up is a controller problem: purpose, processor terms, and international transfers all change if work data leaves the commercial tenant.

What to put in policy and in the tenant

State that work involving personal or confidential data uses only commercial Microsoft 365 Copilot. Confirm licence assignment. Block or discourage consumer Copilot where your tooling allows. Repeat the rule in the short user guidance you issue with the pilot.

How to check it

In the Microsoft 365 admin center, confirm which Copilot licences are assigned and to whom. Look for consumer or unmanaged Copilot use on work devices if your security stack can see it. Ask the pilot group which Copilot they actually open — the answer is often “whatever is in the browser”.

Put the distinction in the employee privacy notice in one sentence: work Copilot is the commercial product under the Microsoft DPA; personal Copilot is not approved for company personal data. That sentence prevents a year of ambiguity.