Not an answer to your overall question of compliance, but to the specific point:
> Copilot for Business does not retain any telemetry or Code Snippets Data.
https://docs.github.com/en/copilot/configuring-github-copilo...
> Copilot for Business does not retain any telemetry or Code Snippets Data.
https://docs.github.com/en/copilot/configuring-github-copilo...
It's probably still sent to their servers.
... Unless they are selling the compliance as a feature, be careful.