Microsoft 365 Copilot (AI) tool privacy notice

Introduction

Herefordshire Council has started to use Artificial Intelligence (AI) tools to assist with business processes. Magic Notes and Microsoft 365 Copilot (Copilot) have been implemented. 

Copilot is used by officers across the council to enhance staff productivity and efficiency. It is being used to help with tasks such as:

• Meetings: Copilot assists with meetings by taking minutes, producing summaries and actions, and helping staff catch up on missed meetings.
• Drafting: Copilot helps with writing documents and emails, such as suggesting ways to word something, helping to create drafts and format documents. 
• Presentations: Copilot is used to speed up the time it takes to create PowerPoint presentations.
• Data analysis: Copilot is used to analyse and visualise data, identify trends, and create reports and graphs. 

It is important to note that this generative AI tool will not be used to make decisions about service users or residents. 

When using Copilot, we may process the following types of personal information, depending on the context of the meeting or document:

• Names and contact details.
• Information shared during meetings, including case details, service needs and support plans.
• Sensitive information, where relevant, such as health, ethnicity, criminal offence or other special category data. 

If Copilot is used to transcribe or summarise meetings with service users, the information captured will reflect the content of those meetings. Officers will ensure that only necessary and relevant information is included in final documents. 

If further need for the use of AI tools is identified these will be assessed, and if implemented, relevant privacy statements will be published concerning those specific tools. There may be circumstances where we inform you of the use of AI before your user journey begins. This means that if AI is being used to facilitate or enhance a business operation that you are involved in, you may be notified at the outset to ensure there is clarity and trust in our processes.

Who is processing your data

The council’s data, used with Copilot, is stored within our secure Microsoft tenant, which is held within the UK. The data is under the control of the council (the data controller) and is not used to train or improve Microsoft, or third party, AI models. 

All personal data held, is processed in accordance with data protection law. 

How we will use the information we hold about you

Information will be processed in line with the specific procedures and privacy notices for each service, Copilot may be used to assist with this processing in the ways described above.

How the law allows us to use your information

Where the council uses resident or service user personal data with Copilot, this is processed under the lawful basis of ‘public task’ or to fulfil our legal and statutory duties under the legislation cited within our privacy notices. 

We recognise that the potential uses of Copilot may evolve over time. Any new applications will be carefully considered and aligned with our AI policy and the council’s commitment to data privacy and security.

Who we will share your information with

• Copilot processes data within the secure Microsoft 365 environment, with all data stored in the UK or EEA.
• When Copilot processes data it does not leave the council’s Microsoft 365 tenant boundary. Your data stays within the purview of Herefordshire Council security and audit controls.
• Data is not shared with Microsoft for training AI models, and Microsoft does not have access to your content (“no eyes on”).
• We do not share your data with third parties except where required by law or for the provision of council services. Further details on the circumstances in which your personal data may be shared with a third party when interacting with a particular council service will be set out in the privacy statement for that service located on this website.
• Please see the service specific privacy notice for further details about who your data may be shared with.

How long we keep your personal information

We will only keep your information within Copilot for the minimum period necessary. The information outlined in this privacy notice will be kept for a maximum of 30 days. All information processed by Copilot will be held securely and destroyed under confidential conditions.

Please see the service specific privacy notice for further details on retention of your data.

Your rights

You have a number of rights under data protection law, including the right to request your information and to request that the information be amended or erased if incorrect. 

To request your records, you will need to put your request in writing and provide proof of identification to the Information Governance Team, Herefordshire Council, Plough Lane, Hereford HR4 0LE or via email, informationgovernance@herefordshire.gov.uk

You also have a right to make a complaint about our handling of your personal data to the Information Commissioner’s Office.

Providing accurate information

It is important that we hold accurate and up to date information about you in order to assess your needs and delivery the appropriate services. If any of your details have changed, or change in the future, please ensure that you inform us as soon as possible so that we can update your records.

Further information

You can contact the Data Protection Officer, at Herefordshire Council, Plough Lane, Hereford HR4 0LE, email: informationgovernance@herefordshire.gov.uk

More information about data protection and how it applies to you can be found on the Information Commissioner’s Office.

Last updated date

April 2026