Is Copilot Safe? Copilot Privacy for Accountants

It depends: Microsoft 365 Copilot can suit confidential client work under an approved work account with enterprise data protection. Personal Copilot needs a separate assessment.

Is Copilot Safe for Confidential Information?

Copilot’s suitability depends on the account and service you use. A Microsoft 365 work account with enterprise data protection has organisational terms and settings that the consumer Copilot app does not share.

Microsoft now calls its organisational product Microsoft Copilot. Some apps still use Microsoft 365 Copilot.

Check the signed-in account before staff summarise a client email. The Copilot name or its appearance inside an app does not establish which agreement applies.

Work and Personal Accounts

Use Microsoft 365 Copilot through the practice’s approved work account for authorised client tasks. Organisational protections depend on the service, subscription and configured settings.

Copilot Chat’s privacy protections also apply through an eligible work account. Its access to work content depends on the experience and subscription.

Consumer Copilot through a personal account follows personal-service terms. Exclude confidential client material unless your practice has separately approved that use.

Microsoft’s enterprise data protection guidance covers both organisational Copilot and Copilot Chat. It includes encryption and existing permissions, with the available settings depending on the underlying subscription.

Model training alone does not decide confidentiality. Microsoft’s updated consumer activity-history guidance says prompts, responses and file contents in that version of the Copilot app do not train foundation models.

That promise does not turn a personal account into the practice’s managed workspace. Keep client work in the approved organisational service, with client permission where required.

The Tax Practitioners Board’s AI guidance requires client permission before disclosure to third parties unless a legal duty applies. Your approval must cover the information shared and where the provider handles it.

These rules concern Microsoft 365 Copilot and Copilot Chat. Security Copilot and GitHub Copilot are separate products.

What Enterprise Data Protection Covers

Enterprise data protection applies Microsoft’s organisational data terms to Copilot prompts and responses. Business information retrieved for an answer is not used to train foundation models.

Copilot can still process and store client information to answer a request. A no-training commitment does not mean Microsoft keeps no copy.

Microsoft’s Copilot privacy documentation explains that stored interactions include prompts, responses and references to source material. Authorised administrators can use Microsoft Purview to search and manage those records.

How Long Chat History Remains

Work-account retention follows the organisation’s policies and deletion arrangements. There is no single short expiry period you can assume for every Copilot conversation.

Under Microsoft’s Copilot retention rules, compliance records sit in hidden Exchange mailbox folders. A retention policy can preserve them for a defined period or indefinitely. A legal hold can suspend permanent deletion.

Ask your administrator to record the actual retention period and who can search the retained records. Set the period deliberately before staff use Copilot for client work.

Australian Storage and Overseas Processing

For a tenant provisioned in Australia, Microsoft’s storage-at-rest terms include an Australian storage-at-rest commitment for specified Microsoft 365 data. This includes stored Copilot interactions, subject to the stated service conditions and exclusions.

Storage at rest and processing an answer are different commitments. Microsoft says customers outside the EU can have queries processed in the US, EU or other regions. An Australian storage commitment does not guarantee Australian-only processing.

Use the Microsoft 365 data-location guidance to inspect the tenant’s Current Geography and Committed Geography. In the admin centre, open Settings > Org settings > Organization profile > Data location.

Record those locations alongside the approved services and any relevant cross-border disclosure arrangements. Do not infer a location from the practice’s billing address.

Web Search and Agents

Web search queries sent to Bing have separate handling terms. Copilot generates those queries from prompts and removes user and tenant identifiers, but query text still needs consideration before staff include confidential details.

Approve external agents separately. Their permissions and terms can change where information goes. For the wider policy, use the practice’s AI privacy rules.

Copilot Sees What Your Staff Can See

Copilot can use eligible work content that the signed-in user is permitted to view. Excessive SharePoint or OneDrive access can therefore bring another client’s records into an answer.

That does not mean Copilot reads every accessible file for every prompt. Permissions set the outer boundary, while the experience and request determine what content is retrieved.

Consider a hypothetical practice where all staff belong to a group with access to every client folder. A junior employee’s Copilot search can surface material the employee could already open, even when their current job concerns another client.

Review Permissions Before Enabling Client Work

Run this review with the administrator and the staff member responsible for each client folder.

1. Identify folders containing client returns, identity documents and confidential correspondence. Record who needs access for their work.
2. Compare that list with direct access, group membership and sharing links. Remove unnecessary organisation-wide access and stale guest permissions.
3. Where your licence includes them, run SharePoint’s data access governance reports. Start with site permissions, then inspect sharing links and “Everyone except external users” exposure.
4. Give SharePoint site owners a site access review to correct excessive access. Review OneDrive sharing separately because that review feature supports SharePoint sites only.
5. Test the corrected permissions with a representative staff account. A folder outside that person’s work must refuse direct access before you approve client use of Copilot.

A prompt asking Copilot to show only the current client’s files does not repair excessive access. Fix the underlying permissions and keep an owner responsible for future sharing changes.

The Microsoft 365 security guide covers the wider tenant setup. Complete that work before treating Copilot as ready for confidential email summaries.

Copilot in Outlook and Teams

Copilot in Outlook processes email content to produce summaries, while Teams can use meeting speech or saved transcripts. Each use brings existing client information into the AI task.

Client Emails in Outlook

Microsoft’s Outlook summary instructions describe scanning the selected thread and linking summary points to source messages. Supported versions can also summarise selected attachments.

An email thread can contain bank details or information about several related entities. Approve the whole information set involved, even when the requested summary is only a few lines.

Before sending a reply, read the original messages and verify each requested action. A summary can omit a condition or confuse which entity the client means.

Meeting Speech and Saved Recordings

Microsoft’s Teams Copilot settings distinguish “Only during the meeting” from “During and after the meeting”. The latter uses a saved transcript once transcription starts.

The during-only option uses speech-to-text processing data that is not saved after the meeting ends. Copilot prompts and responses can still be retained under the organisation’s compliance policies, even when recording and transcription are off.

Saved Teams recordings and transcripts have their own storage and permissions in OneDrive or SharePoint. Removing a Copilot chat does not remove those source records.

Agree the recording and transcription arrangements before a client meeting. Use the AI note takers guide for the separate consent and meeting-record decision.

Delete Copilot Chat History

For a work or school account, Microsoft’s activity-history deletion instructions use the My Account portal.

1. Sign in with the account used for the Copilot work.
2. Open Data and Privacy > Data options > Copilot activity history.
3. Select Delete, select Microsoft Copilot in the dialog and submit the deletion request.
4. Close and reopen the affected app after the request is processed. Confirm the old activities no longer appear.

Saved content in an email or document remains. Retention policies and legal holds can preserve compliance records, so clearing visible history is not proof that every copy has gone.

For personal Copilot, the consumer privacy settings provide individual chat deletion and link to the privacy dashboard for all activity. Use the procedure for the account involved.

Approve Copilot for client work only after the account, sharing permissions and retained records match your practice’s written rules. Assign a practitioner to check each summary before it becomes advice or a client instruction.