Microsoft Copilot and Company Data: A Safety Checklist for Employees and HR Teams

What Microsoft says, in plain language

According to Microsoft's privacy documentation for Microsoft 365 Copilot, Copilot works with content you already have permission to access in Microsoft 365, such as emails, chats and documents. Microsoft also states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation large language models.

This is important context, but it is not a complete safety plan. If a file is shared too broadly in your organisation, Copilot can surface it to anyone who already has access. Permissions hygiene is therefore part of a safe rollout.

Use the right account and the right tool

Your organisation decides which Copilot experiences are approved. A personal consumer account and a work account with enterprise data protection are not the same. Before using any AI tool with work content, check which account you are signed into and whether the tool is on your company's approved list.

If you are unsure, ask IT or your manager. Using an unapproved tool for company data is one of the most common shadow AI risks.

• Sign in with your work account for work content.
• Use only tools your organisation has approved.
• Do not paste work content into personal AI accounts.
• Follow your company's AI policy if one exists.

Data to keep out unless your policy explicitly allows it

Even inside an approved tool, include only the data the task needs. Many tasks work equally well with summarised or anonymised details.

• Passwords, access codes and security keys.
• Personal identifiers such as Aadhaar, PAN, passport or bank details.
• Health, salary or disciplinary records.
• Customer contracts or pricing not needed for the task.
• Unreleased financial results or merger information.
• Anything you have been asked to keep confidential.

Report over-sharing instead of exploiting it

If Copilot shows you a document you believe you should not see, such as a salary sheet or another team's confidential plan, do not open, copy or forward it further. Report it to IT so that they can correct the file's permissions.

For HR and L&D teams, this is a useful message for training: Copilot often reveals existing sharing problems rather than creating new ones.

Check outputs before you act on them

Copilot drafts can contain mistakes, outdated information or unsupported conclusions. Verify figures against the source, confirm names and dates, and remove claims the source does not support. You remain responsible for anything you send or publish.

Using only the attached approved document, list the key figures with the page or section where each appears. If a figure is not in the document, say so. Do not estimate or fill gaps.

How HR and L&D can introduce this safely

Combine a short policy briefing with hands-on practice using fictional or sanitised data. Ask employees to complete one task, verify the output and identify one item that should not have been included. This builds habits rather than just awareness.

Nirmal's corporate workshops use sanitised or fictional practice data and can align exercises with your existing AI policy. Legal, compliance and permission decisions remain with your organisation's authorised owners; training does not certify compliance with any law, including India's DPDP Act.