When you add any file-based data source, it is kept on one of your Portal machines as a file. Like any item of content, it will have its own sharing settings that can be configured. These settings are separate from any service that may be published from the layer.
So, to answer your question: the data is copied, but it's only accessible to administrators, or if the sharing settings on the uploaded item are changed.
I should also point out: if the layer is being added to the map only, as opposed to being added as an Item of content, that data is stored in the web map's JSON, and can be accessed by anyone with permissions to view the map.
- Josh Carlson
Kendall County GIS