Microsoft has expanded local data processing for Microsoft 365 Copilot. For EU and EFTA countries, Switzerland included. It takes place at regional level along the EU Data Boundary. Copilot Chat now counts as a core service and is therefore covered by this commitment.
The point that often gets missed
The commitment ends where Copilot queries the open web. Web search forwards requests to a globally operated search service and the EU Data Boundary explicitly does not apply to those search queries. Transfers to third countries remain possible there on the basis of the established legal frameworks.
This is not a gap in the fine print but a deliberate separation: processing your own company data and enriching it with web knowledge are two different operations with two different data paths.
What this means in practice
- Web enrichment can be switched off. Turning it off costs currency but gains clarity about the data path. This trade-off should be made deliberately and documented. Not left to a default setting.
- The distinction belongs in internal policy. Employees cannot know that a question takes two different paths depending on how it is phrased.
- Regional is not the same as in-country. For EU and EFTA states Microsoft promises regional processing, not processing exclusively in Switzerland. Anyone who needs genuine in-country processing must look more closely.
Our assessment
For most mid-sized companies regional processing is a workable framework, provided web search is treated as a separate case. We regularly see data protection assessments that consider Copilot as a whole and miss exactly this separation.
The pragmatic route: web enrichment off for areas with confidential content, on for general research and both put in writing.