Is Copilot Safe? Copilot Privacy for Legal Teams

Is Copilot Safe for Confidential Information?

Yes, work-account Copilot can be suitable for confidential information when the firm approves its configuration and contractual terms for the matter. Microsoft’s protections cover both Microsoft 365 Copilot and Copilot Chat signed in through the organisation’s Microsoft Entra account.

The same app can also accept a personal Microsoft account. Microsoft’s account guidance says the work experience has a Work label and enterprise protection indicators. Staff must use the firm’s account, including when opening Copilot inside a browser.

Consumer Copilot uses the Microsoft Services Agreement and consumer privacy terms. Its personal-account privacy controls include saved history, memory and personalisation choices. A personal account does not acquire the firm’s enterprise protections because the user opens it on a work laptop. Keep client material out of that account.

Licence entitlement is another distinction. Copilot Chat is included with eligible Business and Enterprise subscriptions. Broader Copilot access to organisational content and application features depends on the assigned licence and configuration. A Business subscription alone does not grant every paid Copilot feature.

What Enterprise Data Protection Covers

Enterprise data protection applies Microsoft’s commercial data-protection terms to work-account prompts and responses. Microsoft is a data processor under its Data Protection Addendum and Product Terms. Its enterprise data protection documentation states that prompts, responses and Microsoft Graph data do not train foundation models.

The protection includes encryption and tenant isolation. The firm’s access rules apply, alongside supported retention and audit controls. Available controls depend on the underlying subscription, so a basic chat entitlement does not prove that every compliance feature is licensed.

Copilot does save data. Microsoft’s privacy documentation says stored interactions include prompts and responses, with supporting citations. Copilot Chat logs prompts and responses in the firm’s Exchange environment for audit and legal discovery.

There is no single retention period for every firm’s work account. Microsoft Purview policies can retain interactions for a chosen duration, including indefinitely. Deletion follows the applicable policies, and legal holds can preserve copies after a user deletes visible history. Set the policy for Copilot interactions explicitly and confirm it through the firm’s compliance tools.

Enterprise protection also has boundaries. Generated web queries go to Bing under separate data-handling terms, with user and tenant identifiers removed. An enabled agent can introduce another data recipient. Approve those connections separately before allowing them to handle a matter.

Copilot Sees What Your Staff Can See

Microsoft 365 Copilot can surface organisational information that the signed-in user already has permission to view. It does not repair a SharePoint site that grants excessive access or a Teams space with the wrong members.

In a hypothetical firm, a litigation team has read access to a confidential employment-advice folder through an old all-staff group. Copilot can make that forgotten material easier to find. The confidentiality problem starts with the group permission, even if nobody previously searched for the folder.

Before rollout, complete these checks in order:

1. Review SharePoint and Teams membership, sharing links and inherited permissions. Remove access that a matter team does not need.
2. Apply sensitivity labels with suitable protection and, where licensed, data loss prevention rules. A label name alone does not enforce the intended restriction.
3. Limit discovery while site owners finish the review. Microsoft is retiring Restricted SharePoint Search and blocks new enablement. Its replacement guidance describes Restricted Content Discovery for selected SharePoint sites. This is a temporary discovery control and leaves underlying permissions intact.
4. Test with representative staff accounts using fabricated matter files. An authorised user must retrieve the relevant file, while a user outside the matter team must be unable to open it directly.

Copilot Chat’s default chat experience differs from full organisational search. Staff can supply files, and particular applications or approved agents can add work context. Include those entry points in the permission review.

Where Copilot Processes Your Data

Australian data residency commitments cover stored Copilot interactions for qualifying Australian tenants. Microsoft’s data-at-rest terms include stored prompts and responses within the relevant geographic commitment, subject to service-specific provisions. The tenant’s provisioning and any Multi-Geo configuration determine which commitment applies.

Storage location and model processing are separate. Microsoft’s local inferencing announcement schedules Australian in-country processing for the end of 2026. Inferencing means the model processing a prompt to generate its answer. That rollout commitment does not establish that every Australian tenant already processes every request locally.

Microsoft’s privacy documentation allows processing outside the EU for customers outside that boundary. Some third-party model options also have exclusions from in-country processing commitments. For a matter requiring Australian processing, require the applicable processing commitment for the firm’s enabled configuration before using client data.

Our data sovereignty guide explains why an Australian storage location alone does not settle control over data.

Copilot Privacy Concerns and Security Risks

Copilot’s privacy risks include excessive staff permissions and malicious instructions inside material the assistant reads. Microsoft documents indirect prompt injection through files and other retrieved content. An attacker can place instructions in a shared document that try to redirect the assistant away from the user’s task.

Microsoft applies prompt-injection detection and other safeguards. The firm still needs controlled sharing and an approval process for agents that can act on information. Treat instructions inside an external document as document content, and review proposed external actions before authorising them.

Limit web grounding where confidential terms must stay out of generated searches. Review audit signals and investigate unexpected access to matter files. Staff also need a clear approved route so they do not move the same task into an unmanaged personal account. Our shadow AI guide covers that staff-use problem.

Start with a defined matter workflow and a limited staff group. Expand access after the firm verifies permissions and retention, then records which search and agent connections that workflow permits.