You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: copilot/enterprise-data-protection.md
+6-4Lines changed: 6 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.collection:
13
13
- m365copilot
14
14
- magic-ai-copilot
15
15
hideEdit: true
16
-
ms.date: 02/25/2025
16
+
ms.date: 03/13/2025
17
17
---
18
18
19
19
# Enterprise data protection in Microsoft 365 Copilot and Microsoft 365 Copilot Chat
@@ -32,7 +32,7 @@ Use of Microsoft 365 Copilot and Microsoft 365 Copilot Chat involves prompts (en
32
32
33
33
-**We secure your data:** We help protect your data with [encryption](/purview/office-365-encryption-in-the-microsoft-cloud-overview) at rest and in transit, rigorous physical security controls, and data [isolation](/compliance/assurance/assurance-microsoft-365-isolation-controls) between tenants.
34
34
35
-
-**Your data is private:** We won’t use your data except as you instruct. Our commitments to [privacy](https://www.microsoft.com/trust-center/privacy) include support for [GDPR](/compliance/regulatory/gdpr), [ISO/IEC 27018](/compliance/regulatory/offering-ISO-27018), and our [Data Protection Addendum](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
35
+
-**Your data is private:** We won’t use your data except as you instruct. Our commitments to [privacy](https://www.microsoft.com/trust-center/privacy) include support for [GDPR](/compliance/regulatory/gdpr), the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn)<sup>[3]</sup>, [ISO/IEC 27018](/compliance/regulatory/offering-ISO-27018), and our [Data Protection Addendum](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA).
36
36
37
37
-**Your access controls and policies apply to Copilot:** Copilot respects your [identity model](microsoft-365-copilot-privacy.md#how-does-microsoft-365-copilot-protect-organizational-data) and [permissions](microsoft-365-copilot-privacy.md#how-does-microsoft-365-copilot-use-your-proprietary-organizational-data), inherits your [sensitivity labels](/purview/sensitivity-labels#sensitivity-labels-and-microsoft-365-copilot), applies your [retention](/purview/retention-policies-copilot) policies, supports [audit](/purview/audit-search?tabs=microsoft-purview-portal) of interactions, and follows your administrative settings. The specific controls and policies will vary depending on the underlying subscription plan.
38
38
@@ -57,7 +57,7 @@ In addition to prompts and responses, web search queries (different from Microso
57
57
58
58
- The Bing search service operates separately from Microsoft 365 and has different data-handling practices covered by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) between each user and Microsoft, together with the [Microsoft Privacy Statement](https://www.microsoft.com/privacy/privacystatement). The means that Microsoft acts as an independent data controller responsible for complying with all applicable laws and controller obligations. This approach is consistent with other [optional connected experiences that rely on Bing](/microsoft-365-apps/privacy/optional-connected-experiences#experiences-that-rely-on-bing).
59
59
60
-
-[Learn more about data, privacy, and security of web queries in Microsoft 365 Copilot and Microsoft 365 Copilot Chat](manage-public-web-access.md)
60
+
-The [Product Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all) provide additional commitments about the web queries sent to the Bing search service. For more information, see [Data, privacy, and security for web search in Microsoft 365 Copilot and Microsoft 365 Copilot Chat](manage-public-web-access.md#how-microsoft-handles-generated-search-queries).
61
61
62
62
## Agents in Microsoft 365 Copilot
63
63
@@ -67,4 +67,6 @@ When you’re using agents in Microsoft 365 Copilot, check the privacy statement
67
67
68
68
<sup>[1]</sup> The specific controls will vary depending on a customer's Microsoft subscription plans.
69
69
70
-
<sup>[2]</sup> Microsoft 365 Copilot and Microsoft 365 Copilot Chat support HIPAA compliance for properly configured implementations. HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and BAA.
70
+
<sup>[2]</sup> Microsoft 365 Copilot and Microsoft 365 Copilot Chat support HIPAA compliance for properly configured implementations. HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and BAA.
71
+
72
+
<sup>[3]</sup> The EU Data Boundary doesn’t apply to web search queries.
Copy file name to clipboardExpand all lines: copilot/manage-public-web-access.md
+17-4Lines changed: 17 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.collection:
13
13
- m365copilot
14
14
- magic-ai-copilot
15
15
hideEdit: true
16
-
ms.date: 02/19/2025
16
+
ms.date: 03/13/2025
17
17
---
18
18
19
19
# Data, privacy, and security for web search in Microsoft 365 Copilot and Microsoft 365 Copilot Chat
@@ -44,7 +44,7 @@ When using Microsoft 365 Copilot, the generated search query doesn't include the
44
44
45
45
- When the user explicitly references a specific document in their prompt.
46
46
47
-
The user's prompts and Copilot's responses are stored within Microsoft 365 and never leave the service boundary for both Microsoft 365 Copilot and Microsoft 365 Copilot Chat.
47
+
The user's prompts and Copilot's responses are stored within Microsoft 365 and never leave the service boundary for both Microsoft 365 Copilot and Microsoft 365 Copilot Chat without customer direction. [Enterprise data protection](enterprise-data-protection.md), the [Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA), and the [Product Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all) apply to prompts and responses, with Microsoft acting as a data processor.
48
48
49
49
After Microsoft 365 Copilot and Microsoft 365 Copilot Chat receive additional information from the Bing search service, this information is used to compose the response returned to the user.
50
50
@@ -87,13 +87,26 @@ The following table provides multiple examples of a user's prompt and the genera
87
87
88
88
Microsoft 365 Copilot and Microsoft 365 Copilot Chat both use generated search queries sent to the Bing search service to ground responses in web data. The way Microsoft handles these queries is identical in both services.
89
89
90
-
Generated search queries sent to the Bing search service have the user and tenant identifiers removed. They aren't shared with advertisers and aren’t used to train foundation large language models (LLMs). Also, web search queries sent to Bing don't affect any of the following:
90
+
Generated search queries are sent to the Bing search service with user and tenant identifiers removed. Also, web search queries sent to Bing don't affect any of the following:
91
91
92
92
- Search Ranking
93
93
- Answers or features like Rich Captions
94
94
- Social features like Auto Suggest, Trending, and Zero Input
95
95
96
-
The Bing search service operates separately from Microsoft 365 and has different data-handling practices. The use of Bing is covered by the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) between each user and Microsoft, together with the [Microsoft Privacy Statement](https://www.microsoft.com/privacy/privacystatement). The [Microsoft Products and Services Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) doesn't apply to the use of the **Web content** toggle in Microsoft 365 Copilot, Microsoft 365 Copilot Chat, or the Bing search service.
96
+
The [Product Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all) provide the following additional commitments about the generated search queries sent to the Bing search service:
97
+
98
+
- Microsoft has no rights to them other than as needed to provide the service.
99
+
- They aren’t used to improve Bing.
100
+
- They aren’t used to create advertising profiles or to track user behavior.
101
+
- They aren't shared with advertisers.
102
+
- They aren’t used to train generative AI foundation models.
103
+
- They are treated as customer confidential information and protected by appropriate technical and organizational measures.
104
+
105
+
The Bing search service operates separately from Microsoft 365 and has different data-handling practices. The web search queries generated by Copilot and sent to Bing are subject to the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement) between each user and Microsoft, together with the [Microsoft Privacy Statement](https://www.microsoft.com/privacy/privacystatement).
106
+
107
+
The [Product Terms](https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all) add additional commitments on Microsoft as a controller with respect to handling of web query data. Microsoft acts as a data controller, responsible for complying with all applicable laws and controller obligations. In the event of conflict with respect to the use of Bing with Microsoft 365 Copilot and Microsoft 365 Copilot Chat, the Product Terms supersede the Microsoft Services Agreement and the Microsoft Privacy Statement.
108
+
109
+
The [Microsoft Products and Services Data Protection Addendum (DPA)](https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA) doesn't apply to the use of generated web search queries in Microsoft 365 Copilot, Microsoft 365 Copilot Chat, or the Bing search service. Also, HIPAA compliance and the [EU Data Boundary](/privacy/eudb/eu-data-boundary-learn) don’t apply to generated search queries.
0 commit comments