Responding to personal data discovery requests from data subjects

The first step in responding to a data subject rights request is to search for and identify the customer data that's the subject of the request. Microsoft provides capabilities that assist you in responding to data subject rights requests, and thereby accessing customer data. However, it's your responsibility to ensure that personal data is located and classified appropriately.

The following table summarizes the types of Copilot Studio resources that contain personal data for a specific user.

Resources containing personal data	Purpose
Telemetry logs	Logging that captures historical events within the service.
Copilot content and settings	Information such as content topics and copilot settings.
User settings	Settings specific to the user of the copilot.
Conversation logs	Used to calculate copilot metrics and analytics.
Aggregated metrics	Used to determine copilot behavior.