What is enterprise data protection?
Quick answer
Enterprise data protection is the set of contract terms and controls that cover what you type into an AI assistant on a business account: your prompts and its answers are handled like your company's other data, kept out of model training and governed by your admin. Microsoft uses the phrase as the name for Copilot's work-account protections.
Last updated
Updated · By Robert Breen
Why it matters for a small business
This is the line between a personal AI account and a work one. As of October 2026, Microsoft's documentation says that when you sign in to Microsoft Copilot Chat (recently renamed from Microsoft 365 Copilot Chat) with a work account, prompts and responses are covered by Microsoft's Data Protection Addendum, get the same protections as email in Exchange and files in SharePoint, and are not used to train foundation models. Web searches are sent to Bing with user and tenant IDs removed.
Other vendors offer the same idea under different names. OpenAI says ChatGPT Business, Enterprise and API data are not used for training by default. Anthropic says the same for Claude Team, Enterprise and the API. Google says Gemini in Workspace does not use customer data to train models without permission. Personal plans are different: most use chats for training unless you opt out. Before you paste client data anywhere, check which account you're signed into and what your AI acceptable use policy allows.
Default training stance on business plans, as of October 2026
| Vendor | Business plans | Trains on business data by default? |
|---|---|---|
| Microsoft | Copilot Chat and Microsoft Copilot on work accounts | No, per Microsoft's enterprise data protection page |
| OpenAI | ChatGPT Business, Enterprise, API | No, per OpenAI's enterprise privacy page |
| Anthropic | Claude Team, Enterprise, API | No, per Anthropic's privacy center |
| Gemini in Google Workspace | No, without permission, per Google's Workspace privacy hub |
"No training" is not the same as no storage. Retention, admin access and where data is stored still differ by plan.
In a real lesson: Check a Contract for Red Flags with Claude
Stepthrough's Copilot lessons are still being built, so the clearest example of this habit is in the Check a contract for red flags with Claude lesson. Before you upload the Kestrel Point IT agreement for Harbor Lane Accounting, a made-up firm, the lesson stops you: "make sure your company allows it: use a Claude plan your company has approved, and check the model-training setting under Settings › Privacy."
That one check is what enterprise data protection is about. The same contract on an approved business plan is covered by the company's terms; on a personal account, it depends on a setting.
Try this lesson free or read the step-by-step guide.
Common confusions
Enterprise data protection vs zero data retention
Protection keeps your data out of training and under business terms. Zero data retention means the provider does not store it at all, which is a stricter, separate agreement.
Enterprise data protection vs a training opt-out
An AI training opt-out is one setting on one account. Enterprise protection is a contract that covers everyone your company signs in.
Tips
- Look for the shield or "protected" label in Copilot Chat before you paste work content.
- Keep client data in work accounts only, never personal ones.
- Ask IT which AI tools are covered by a business agreement.
Related terms
More AI assistants terms
Where you use it: free lessons
- Check a Contract for Red Flags with Claude (Claude, 11 min)
- Reply Faster to a Client Asking for a Case Update: ChatGPT for Small Law Firms (ChatGPT, 10 min)
Frequently asked questions
- Does Microsoft Copilot Chat have enterprise data protection?
- Yes, when you sign in with a work or school account, according to Microsoft's documentation as of October 2026. A personal Microsoft account uses consumer terms instead.
- Is enterprise data protection enough for confidential client files?
- It is the minimum, not the whole answer. Your firm may also have rules on what client data can go into any outside tool. Follow your policy, and remove details the AI does not need.