Copilot Studio Agent Data Retention and the Reg S-P Disposal Rule
Platform retention settings alone do not demonstrate reasonable disposal under Regulation S-P. They govern what happens to data after it is stored, and they do not control what customer information enters an agent interaction or tool call. A defensible program starts with an inventory of every store the agent touches, maps each store to the rule's definition of customer information, names those stores in the written disposal policy, and keeps evidence of what was allowed, retained, and disposed of. Runtime policy enforcement can reduce what reaches those stores. It does not replace retention configuration, records management, or legal review.
Conversation transcripts
Users often volunteer account details, identifiers, or financial circumstances in free text. Treat transcripts as likely to contain customer information, whatever the agent's intended scope.
Dataverse tables
Records the agent reads or writes may be customer records in their own right, with retention set by the table's owner rather than by the agent.
Knowledge sources
Documents the agent retrieves from may carry customer information. The agent may not hold a copy, but the source system's disposal rules still apply.
Connector and tool call payloads
Data leaves the agent for other systems. Each destination is a service provider or internal system with its own retention and oversight obligations.
Analytics and diagnostic stores
Telemetry can capture interaction content. These stores are the easiest to overlook and often have different administrators from the agent's builders.
- Build the store inventory for one production agent and assign an owner to each store.
- Decide in-scope status for each store against the customer information definition, with legal review of the decisions.
- Update the written disposal policy to name agent stores, and align each store's retention configuration to the approved schedule.
- Define which customer information categories an agent may receive or send, and decide where policy should allow, redact, or block them.
- Collect service provider due diligence and monitoring records for every system in the tool path.
- Test the evidence by asking a reviewer to trace one interaction from input to disposal, and fix the gaps they find.
Evidence a regulator or auditor would reasonably expect
- A written disposal policy that names AI agent data stores explicitly, with an approval date and an owner.
- A current inventory of stores, each mapped to the customer information definition, with a documented in-scope or out-of-scope decision.
- Dated records of retention and deletion configuration for each store, and of changes to it.
- An exception trail for legal holds or extended retention, showing who approved each exception and why.
- Service provider due diligence and monitoring records for each system in the agent's tool path, including breach notification terms.
- Interaction-level and tool-call-level records showing what the agent was permitted to handle and what was actually passed or withheld.
What the amended disposal rule requires
Under the amended Regulation S-P, every covered institution must adopt and implement written policies and procedures addressing the proper disposal of consumer information and customer information. The final amendments were published in the Federal Register on June 3, 2024. They extend the disposal rule beyond the consumer report information scope of its 2004 form. As of November 2026, the amended text of 17 CFR 248.30 is the reference for current obligations.
For most covered institutions, customer information means any record containing nonpublic personal information about a customer of a financial institution, in paper, electronic, or other form. The definition reaches records in the institution's possession and records handled or maintained on its behalf. That second clause is the practical hook for AI agents. A transcript held in a platform store, or a payload sent to a third-party system through a tool call, can be a record handled on the institution's behalf. Legal counsel should confirm how the definition applies to each store.
Three other parts of the amendments shape an agent program. Covered institutions must maintain written policies for administrative, technical, and physical safeguards. Response programs must include oversight of service providers through due diligence and monitoring, including a provider notice of a breach no later than 72 hours after the provider becomes aware of it. The amendments also add recordkeeping requirements documenting compliance with the safeguards requirements. The 2004 framing of proper disposal, taking reasonable measures to protect against unauthorized access to or use of information in connection with its disposal, remains a useful reading of the standard.
Where platform retention settings stop
Native retention and deletion settings answer one question: how long does a store keep what it already holds, and how is it removed. That is necessary for disposal. It is not sufficient, for four reasons.
First, settings do not control inputs. Customer information enters through user messages, retrieved documents, and tool call arguments before any retention setting applies. Data minimization has to be addressed upstream of storage.
Second, settings are configured per store, so consistency is a governance task. Five stores can mean five owners and five schedules, and none of them may match the retention schedule your records management function has approved.
Third, a setting is not evidence. A regulator or auditor will want proof of what the configuration was at a point in time, when deletion occurred, and who approved exceptions such as legal holds. Whether the platform produces that proof for each store has to be tested, not presumed.
Fourth, copies made through tools and connectors sit outside the agent platform entirely. Their disposal depends on the receiving system and the service provider's obligations. Due diligence and monitoring evidence for those providers belongs in the same file as the agent's own retention configuration.
Where runtime policy enforcement fits, and where it does not
Trussed enforces policy in the execution path, at runtime and not reviewed after the fact. For individual interactions and tool calls, policy can allow, redact, or block content. In an agent program, that means customer information can be removed or stopped before it reaches a stored interaction or leaves in a tool call payload. Less customer information entering the stores means less to retain, less to dispose of, and a smaller set of systems to oversee. Each enforcement decision also produces audit-ready evidence of what the policy allowed, redacted, or blocked. That speaks to the question of what the agent was permitted to handle. Trussed can be self-managed in the customer's cloud, with configurable retention and data residency for that evidence.
The boundaries matter. Runtime enforcement does not delete data already held in a platform store, and it does not automate disposal. It does not set the retention schedule, which belongs to records management. It does not decide whether a store is in scope or how the rule applies, which belongs to legal review. And it does not replace native retention configuration, which still governs whatever information is permitted to be stored. Treat it as a control that complements the platform's settings and narrows what they have to cover.
Where a Copilot Studio agent can hold customer information
Label: Conversation transcripts
Description: Records of what users and the agent said.
Label: Dataverse tables
Description: Structured records the agent reads or writes.
Label: Knowledge sources
Description: Documents and data the agent retrieves from.
Label: Connector and tool call payloads
Description: Data sent to and returned from other systems.
Label: Analytics and diagnostic stores
Description: Telemetry that may capture interaction content.
Review your agent data stores against the disposal rule
Talk through your agent inventory, the gaps platform settings leave open, and where runtime enforcement can support the evidence you need.
Talk to an ExpertHow does your AI governance program compare?
See where your program has gaps in less than 2 minutes.