Data protection for AI agents: DLP, labels, residency and retention

Microsoft's guidance is to run data risk assessments before switching agents on. The Purview assessment scans the top 100 SharePoint sites every week by default, with custom item-level scans for the rest, and the fixes are links, labels and permissions. Restricted Content Discovery hides chosen sites from org-wide search and Copilot without touching their permissions; it needs a Copilot licence and SharePoint Advanced Management, and propagation for sites with more than 500,000 items can take over a week.

Labels travel with content when they carry encryption. Copilot and agents return encrypted, labelled content only when the user holds both the EXTRACT and VIEW usage rights; new content Copilot creates inherits the highest-priority label among its sources; Double Key Encryption content is never accessible to Copilot. Mind the gaps: items do not inherit container labels set on Teams, sites or groups, and Copilot does not recognize Teams meeting and chat labels.

Custom agents need the same boundary built in. For retrieval agents, Azure AI Search can enforce Purview labels at query time, and Foundry IQ runs queries under the caller's Entra identity; the permission-aware retrieval page of this guide covers the design.

On Amazon Bedrock, geographic cross-Region inference profiles (us, eu, apac, in) keep processing within a geography while data at rest stays in the source Region, and CloudTrail logs each request in the source Region with additionalEventData.inferenceRegion showing where it ran. A global profile is about 10% cheaper and can route to any commercial Region; block it with a service control policy on the bedrock:InferenceProfileArn condition where residency matters.

On Google Cloud, regional or jurisdictional endpoints (us, eu) keep machine learning processing in that jurisdiction; the eu multi-region excludes the UK and Switzerland, and the global endpoint carries no residency guarantee. Gemini caches data for up to 24 hours by default, which can be disabled, and Grounding with Google Search stores queries for up to three days with no opt-out.

Microsoft 365 Copilot is an EU Data Boundary service for EU customers, with two exceptions to plan around: models provided by Anthropic as a subprocessor are excluded from the boundary, and Multi-Geo tenants fall outside its scope. Copilot Cowork has its own at-rest commitment for 15 countries and regions.

Amazon Bedrock now has explicit data retention modes (none, default, aws_review and the legacy provider_data_share) that a service control policy can enforce. In aws_review, AWS may keep prompts and completions for up to 30 days and have people review them without sharing content with the model provider; some newer models require that mode, and with cross-Region inference the retained data sits in the destination Region. Model providers have no access to the accounts where Bedrock runs their models, or to its logs, prompts or completions.

Microsoft stores Copilot and AI app prompts and responses in hidden folders in each user's Exchange mailbox, under Purview retention locations for Microsoft Copilot experiences, enterprise AI apps and other AI apps. eDiscovery can search and purge them, ten items per mailbox per run and only after holds are removed, and a delete-after-one-day policy can take about 16 days to purge fully. Deleting a Copilot conversation does not delete the Copilot memory tied to it; the memory privacy and retention page of this guide covers agent memory in depth.

Your own stores need the same treatment. The EU AI Act asks providers and deployers of high-risk systems to keep automatically generated logs for at least six months unless Union or national law, in particular data protection law, says otherwise; the Commission's AI Act page puts those duties at 2 Dec 2027 for Annex III uses. Pseudonymize identities in traces where you can: AWS recommends pairwise subject identifiers to keep personal data out of AgentCore Gateway entries in CloudTrail.