Is Claude in Copilot compatible with UK GDPR?

What leaders need to know

If you’re a UK business handling personal data, is it safe to use Claude in Microsoft Copilot? It isn’t automatically a UK GDPR problem, and it isn’t automatically fine either. It depends on decisions that sit with you, and one of them may have a deadline. A Microsoft notice reported this week says Claude will be switched on by default for UK tenants on 9 December unless an administrator makes a choice first.

Just to make an important clarification. I’m talking about Claude models used inside Microsoft Copilot in your organisation’s Microsoft 365 tenant, not Claude accessed directly from Anthropic or the free consumer Copilot app. Those are different products with different terms.

The one-minute version

1. There’s a date to check. Microsoft’s documentation, updated on 4 November, says Claude is off by default for UK customers. But Microsoft Message Centre notice MC1546435, which we received as UK partners, says that from 9 December 2026 UK tenants that haven’t made an Anthropic selection will have Claude enabled for all users. Your administrator should check this before then.

2. The EU Data Boundary announcement isn’t about the UK. It covers eligible EU and EFTA organisations, and it isn’t live yet. Microsoft’s documentation currently says Anthropic processes customer data in the United States.

3. Location doesn’t settle compliance on its own. UK GDPR doesn’t say data must stay in the UK, but sending it abroad triggers transfer rules, and the other rules on contracts, risk assessment and staff guidance apply either way.

What Microsoft announced

On 5 November, the Microsoft Copilot blog announced that Claude models from Anthropic in Microsoft Copilot are coming into the EU Data Boundary by the end of 2026. The EU Data Boundary is Microsoft’s contractual commitment to store and process data for Microsoft 365 and other online services inside the EU and EFTA for eligible customers. It isn’t legislation.

For eligible EU and EFTA organisations already using Claude, there’s nothing to do, because processing will move automatically once it’s available. Those who haven’t enabled it can do so at any time. But it’s a commitment, not a switch that’s been flipped, and Microsoft’s documentation still lists Claude as excluded from the boundary. The announcement doesn’t make the same promise for UK tenants.

What’s happening in the UK

Microsoft Learn says Claude models are off by default for customers in the UK, EU and EFTA, and that an administrator has to opt in. There’s also a narrower setting for Copilot in Microsoft 365 apps, whose default can depend on when your tenant was created, so it’s worth checking both.

Then there’s the reported change. Notice MC1546435 says Microsoft will enable Claude by default for UK tenants on 9 December 2026 where no selection has been made, and will retire the option to allow it only in Microsoft 365 apps. If you’d rather decide for yourself, the notice says an administrator can opt out or limit access before that date. If it’s confirmed in your own Message Centre, “review it in the new year” is too late.

Where processing happens today

Microsoft’s documentation on continuing data transfers says that when customers allow Anthropic models, Customer Data is processed by Anthropic in the United States, while stored data stays in the EU Data Boundary. That page is written for EU Data Boundary services, so ask Microsoft or your Microsoft partner to confirm the position for your own tenant and offering. Until you’ve heard back, plan on the basis that processing happens outside the UK.

Location isn’t the whole legal test

UK GDPR doesn’t say personal data has to stay in the UK. It says that when personal data goes to a separate organisation outside the UK, that’s a restricted transfer, and you need a recognised route. That’s either UK adequacy regulations, which include the UK-US data bridge for eligible US organisations certified under its UK Extension, or appropriate safeguards such as the ICO’s international data transfer agreement or addendum. Safeguards need an assessment, which the Data (Use and Access) Act 2025 calls the data protection test, asking whether protection afterwards is “not materially lower” than in the UK. A few narrow exceptions exist, but the ICO says regular, systematic transfers are less likely to qualify.

Residency also matters in other ways. If you’ve promised clients their data stays in the UK or EU, or your sector has its own rules, then processing elsewhere is a problem whatever GDPR says.

Who does the transfer assessment?

The ICO says you’re only responsible for the transfer rules if your organisation initiates the restricted transfer. In Copilot, Microsoft designs the service and brings in Anthropic as a subprocessor, which is a supplier your supplier uses. So Microsoft may be the party responsible for the transfer route and assessment. You’d still need to make reasonable checks that Microsoft gives sufficient guarantees, and your other data protection obligations stay with you. Whether you or Microsoft initiates the transfer here is a question to settle with Microsoft or your Microsoft partner, and your legal adviser.

The EU side

The EU renewed its UK adequacy decisions on 19 December 2025, running to 27 December 2031 with a review after four years. That keeps personal data flowing from the EU to the UK without additional transfer safeguards. It’s a separate question from the EU Data Boundary. Whether EU GDPR applies to you, through EU customers or an EU presence, doesn’t in itself make you eligible for Microsoft’s boundary commitment. That’s a contractual matter for your tenant, and mapping your data flows will tell you which rules apply where.

The bigger questions aren’t about location

Certain Claude offerings, labelled “Anthropic models with Data Retention”, sit in a different position. They’re off by default for every customer and need an administrator to opt in, and Anthropic acts as an independent processor under its own terms rather than Microsoft’s. According to Microsoft’s documentation, Anthropic stores most inputs and outputs for up to 30 days, and for longer if its safety checks flag content. Other advanced offerings are available to eligible customers under Microsoft’s subprocessor arrangements without Anthropic retaining content, so the label and the terms are what matter. I’d keep any Data Retention models off until they’ve been reviewed.

Beyond that come the ordinary obligations for any AI tool. You need a proportionate risk assessment, and a full data protection impact assessment where processing is likely to be high risk for individuals. You also need clear rules on what people can enter, checks on accuracy, extra care with sensitive categories of data, and honest information for staff and customers about how data is used.

Actions for the accountable owner, your DPO and your AI partner

Someone senior should own this decision. Your data protection lead, whether a DPO or your legal adviser, advises, and your IT team or AI partner does the technical work. To be clear, I’m not a lawyer, so take advice on your own position. The effort is proportionate to the use case, and a small pilot with no sensitive data is a much lighter job than a company-wide rollout.

1. Check before 9 December. Your IT team or partner verifies MC1546435 in your Message Centre and checks both Anthropic settings in the Microsoft 365 admin centre, along with whether any Data Retention models are enabled. Then choose deliberately between no users, specific users or groups, or all users, rather than letting the default decide, and record the decision.

2. Ask Microsoft or your Microsoft partner in writing. Where does processing take place for our tenant and offering, which transfer route covers it, who initiates the transfer, and does Microsoft’s data protection addendum cover the models we plan to use?

3. Establish who is responsible for each restricted transfer. Where it’s you and you rely on safeguards, complete and record the data protection test. Otherwise review Microsoft’s assurances and evidence.

4. Update your risk assessment and records. Decide whether a data protection impact assessment is needed for the use cases involving personal data, add Anthropic to your records of processing and supplier list, and check your privacy notices.

5. Scope the rollout. The accountable business owner approves it, informed by data protection advice. Start small, use groups to limit access and agree what data must never go in. Your IT team or partner configures it and your AI policy gets updated to match.

6. Review at the points of change. That means before any rollout or settings change, when Microsoft’s documentation changes, and when its EU processing move lands, repeating steps two and three if the answers differ.

Microsoft will move on its own timetable, and on this one the default may arrive before your policy does. If I had three questions for your next leadership meeting, they’d be who owns this, which use cases we’re starting with, and what we’ve promised our clients about where their data goes.

If it would help to talk it through, ramsac is happy to work through these checks with clients and non-clients alike.

Further reading

Bringing Claude models in Microsoft Copilot into the EU Data Boundary, Microsoft Copilot Blog: the original announcement from Charles Lamanna. https://www.microsoft.com/en-us/copilot/blog/2026/11/05/bringing-claude-models-in-microsoft-copilot-into-the-eu-data-boundary/

Claude models from Anthropic in Microsoft Online Services, Microsoft Learn: regions, defaults, opt-in steps and the Data Retention models. https://learn.microsoft.com/en-us/copilot/implement/connect-to-ai-subprocessor

Continuing data transfers that apply to all EU Data Boundary Services, Microsoft Learn: includes where Anthropic processes customer data. https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-transfers-for-all-services

How do we comply with the transfer rules if we’re initiating the restricted transfer, ICO: the regulator’s guidance on who is responsible and the routes available. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-guide-to-international-transfers/how-do-we-comply-with-the-transfer-rules-if-were-initiating-the-restricted-transfer

Frequently asked questions

Is using Claude in Microsoft Copilot automatically compliant with UK GDPR?

Using Claude in Microsoft Copilot is neither automatically a UK GDPR violation nor automatically fine. Compliance depends on decisions made by your organisation. While UK GDPR does not strictly require data to stay in the UK, transferring personal data abroad triggers transfer rules, requiring risk assessments, appropriate contractual safeguards, and clear governance policies.

Will Claude be enabled by default for UK Microsoft tenants?

Microsoft documentation states Claude is currently off by default for UK tenants. However, Microsoft notice MC1546435 reports that from 9 December 2026, UK tenants that have not made an Anthropic selection will have Claude enabled for all users. System administrators should check tenant settings and make a deliberate choice before that date.

Where is customer data processed when using Claude in Copilot?

According to Microsoft documentation on continuing data transfers, when customers enable Anthropic models, customer data is processed by Anthropic in the United States. While stored data may remain within the EU Data Boundary for eligible customers, organisations in the UK should plan on the basis that processing takes place outside the UK.

Does the Microsoft EU Data Boundary guarantee data residency for UK organisations?

No, the EU Data Boundary announcement applies specifically to eligible organisations in the EU and EFTA, not the UK. Furthermore, the commitment to bring Claude models into the boundary by the end of 2026 is contractual rather than immediate, so UK businesses cannot rely on it to ensure local data processing.

What should UK administrators do regarding Claude Data Retention models?

Anthropic models with Data Retention operate under separate terms, allowing Anthropic to store inputs and outputs for 30 days or longer. These models are off by default for all customers. Administrators should keep these retention models disabled until a full data protection review and risk assessment have been completed by their lead team.