Are Copilot prompts in your audit log?

Prompts and responses are stored in ways that can be in-scope for eDiscovery and subject access requests. Default retention is not automatically your legal retention. Configure auditing, document how long you keep Copilot interactions, and test that you can retrieve them.

What to enable

Turn on auditing of Copilot interactions and related activities. Confirm who can read those logs. Decide whether you need to keep prompts, responses, or both, for which period, and for which legal hold scenarios.

If you cannot produce a Copilot thread when a data subject or a court asks, the rest of the DPIA’s “we have audit” sentence is not true.

How to check it

Use Microsoft Purview audit and retention policies that list Copilot workloads. Run a test: a pilot user asks a distinctive question, then an admin confirms the activity is visible and retained as designed. Put the test date in the governance file.

Subject access and deletion

If a staff member or customer asks what Copilot processed about them, you need a retrieval path. If they ask for deletion, you need to know what you can actually delete versus what is in a legal hold. Those answers should exist before the first request, not during it.

Align Copilot retention with the function: HR prompts are not the same as a public-web research chat. A single default for the whole tenant is simpler to run and harder to defend if you hold regulated data for too long — or delete it too soon.