Is Windows Recall Safe? Screenshots and Client Data

Is Windows Recall Safe for Client Work?

Windows Recall has local storage and access protections. Those controls reduce exposure, while the saved history creates another place where client material can remain.

Microsoft’s privacy statement says Recall processes snapshots on the device. It does not transmit that content off the computer unless the user takes an action, such as copying a snapshot into another app or attaching it to feedback.

Snapshots and their search data are encrypted. Recall uses Windows Hello authentication and protects decryption through the device’s security hardware and an isolated environment. Microsoft says other Windows users and IT administrators cannot view your Recall snapshots through the service.

For a firm, the deciding question is whether staff need this separate screen history. In a hypothetical matter, a solicitor briefly opens a confidential settlement email. Recall can preserve its visible content after the email closes. The source email’s location alone no longer describes every copy.

What Recall Captures

Recall is a Windows 11 feature for supported Copilot+ PCs. It requires user opt-in. Buying a compatible laptop does not itself start snapshot saving.

Microsoft’s Recall application description says snapshots are saved every few seconds when screen content changes. Recall analyses images and text locally so you can search what you previously saw. It also keeps details such as the app and capture time. It does not record continuous video or audio as screen history.

Snapshots and related search information stay in Recall’s local storage on that PC. Ordinary saving and analysis do not require a cloud connection. Some Windows diagnostic data depends on the device’s privacy settings. Recall can also fetch website icons or metadata, so local snapshot storage does not mean the feature makes no network requests.

Recall filters private browsing in supported browsers. Website filters depend on browser support and foreground-tab behaviour. An excluded page can still appear indirectly, including as embedded content or in browser history visible elsewhere.

Sensitive information filtering is on by default and helps exclude material such as passwords and credit-card numbers. It does not classify every confidential client document. A settlement email without a password can still contain material your firm needs to protect.

Microsoft’s Recall privacy and control guide explains those filtering limits and local protections.

Turning Off Windows Recall

To stop new snapshots on an individual computer:

1. Open Settings, then Privacy & security, then Recall & snapshots.
2. Authenticate with Windows Hello when asked.
3. Set Save snapshots to Off.
4. Reopen the setting and confirm it remains off. The Recall snapshot-saving icon disappears from the system tray.

Pausing through the tray icon is temporary. Use the setting for an ongoing decision to stop capture. Stopping new capture leaves existing snapshots to be managed separately.

To keep Recall while excluding particular work, return to Recall & snapshots and add the relevant apps or websites to its filter lists. Keep sensitive information filtering on. Filter the whole browser app when website-specific filtering cannot cover the approved workflow.

Use a fictional document to check a permitted configuration. Open it in an excluded app and confirm the tray icon shows filtering. Then inspect Recall’s timeline for that period. Repeat for a supported browser and the excluded website. Do not use a real client file to test filtering.

For existing snapshots, Microsoft’s snapshot management instructions explain deletion by snapshot, app or website. Obtain the firm’s retention decision before deletion. Previously shared copies need separate handling.

Controls Across a Firm

Microsoft says Recall is disabled and removed by default on commercially managed devices. Administrators cannot switch snapshot saving on for users without their opt-in.

Under Computer Configuration, Administrative Templates, Windows Components, then Windows AI, administrators can disable Allow Recall to be enabled. This removes Recall and deletes existing snapshots after the policy takes effect. Removal requires a restart. Enabling Turn off saving snapshots for Recall also blocks capture and deletes previously saved snapshots.

Microsoft’s administrator guide documents both policies. App and website filtering policies, and storage-duration policies, apply only to Enterprise and Education editions. Retention can be limited to 30, 60, 90 or 180 days on those editions.

Before applying a deleting policy, resolve any preservation requirement. After rollout, restart a representative managed PC and confirm the effective policy prevents staff enabling capture. Check each Windows edition the firm actually uses.

Recall and a Firm’s Duties

A Recall snapshot can contain confidential client information even though it stays on the laptop. Treat approved snapshots as part of the firm’s information-handling arrangements.

The Legal Practice Board of Western Australia’s joint statement on AI identifies client confidentiality under the Australian Solicitors’ Conduct Rules as an ongoing duty. Local encryption helps protect a copy. The firm still needs a reason to create and retain that copy, and rules controlling who can use or share it.

For firms covered by the Privacy Act, Australian Privacy Principle 11 requires reasonable security measures. It also requires reasonable destruction or de-identification steps when information is no longer needed, subject to statutory and court-order retention exceptions. The OAIC’s APP 11 guidance explains those requirements.

Match snapshot retention to its approved purpose and the firm’s preservation obligations. A storage limit that deletes the oldest images when full is not a matter-by-matter retention decision. Keep authoritative matter records in the firm’s record system.

If a laptop or account is compromised, include Recall snapshots in the incident assessment. Encryption affects the risk assessment, but its effectiveness depends on what the attacker can access. Under the Notifiable Data Breaches scheme, covered entities assess likely serious harm and the effect of remedial action.

Record whether Recall is allowed, which computers the decision covers and who checks the applied controls. If the firm cannot manage the extra history under its confidentiality and retention arrangements, keep snapshot saving disabled.