A municipality's privacy officer is forwarded the SURF DPIA on Microsoft 365 Copilot, with a question: does this mean the DPIA is "done"? She reads it and finds a solid description of what Microsoft does with data. It says nothing about the forty SharePoint sites at the municipality that are open to everyone, or about the agent the social services department wants to build.
That is no fault of the document. A sector DPIA describes the service; your DPIA describes how you use it. What you add yourself: which version and for whom, the permission structure, which data, which connections, which settings and measures, which tools are in use alongside it and how you will later show that the measures are working.
When is a DPIA for Copilot needed?
Article 35 GDPR requires a data protection impact assessment when processing is likely to result in a high risk to individuals, and the EDPB's rule of thumb is that two of its nine criteria are enough. Copilot for dozens or hundreds of employees, with access to mail, calendars and documents full of personal data, quickly meets more than that: new technology, large scale, sensitive data and employees as data subjects. How to weigh this is covered in our article on whether AI tools at work need a DPIA; for Copilot the answer is rarely no.
What is already in the sector DPIA?
SURF, together with SLM Rijk, published a DPIA on Microsoft 365 Copilot in December 2024, finding four high privacy risks and advising institutions not to use the service for the time being. After changes by Microsoft, a September 2025 update downgraded the risks to amber, with two residual concerns: inaccurate personal data generated about real people, and an 18-month retention period for pseudonymised metadata. The facts about the service itself, from the training commitment to flex routing, are collected in the privacy risks of Copilot.
That document describes the processor side, and you do not need to redo it. Carry its residual risks over into your own DPIA as residual risks, and note alongside them what you are doing about them locally. Mind the date, though: the service changes every month, and a DPIA describes the situation at the time it was written.
What do you add yourself?
| Part | What you include | Why it belongs there |
|---|---|---|
| Version and users | Who works with Copilot Chat, who with the paid Microsoft 365 Copilot, what applies to the consumer version | The versions differ in reach and in data protection |
| Permission structure | The dated state of permissions in SharePoint, OneDrive and Teams, and what was cleaned up | Copilot searches with the permissions a user already had |
| Data | Which categories end up in prompts and which are within reach of search, per type of work | The DPIA describes the processing that actually takes place, not the intended one |
| Connections and agents | Connectors, agents from Copilot Studio and plug-ins, with the source and owner of each connection | Every connection widens what can end up in an answer |
| Settings | Flex routing, sensitivity labels and DLP, and which of these are temporary | They determine where processing runs and what is excluded |
| Other AI tools | What is in use alongside Copilot, with its status | Otherwise the DPIA describes one tool while four are in use |
| Measures and evidence | For each measure, how you will later show it is working | A DPIA describes; the figures afterwards show |
The permission structure is the part most often missing, and the most important. Copilot breaks no permissions; it searches with the permissions a user already had, and that makes years of oversharing findable with a single question. What happens when Copilot can reach SharePoint is therefore a DPIA question: which sites are open to everyone, what has been done about it and on which date. Microsoft puts that cleanup at the front of its own deployment guidance.
The data falls into two parts. First, what employees paste into the prompt, per type of work: customer contact, personnel files, residents' case files. Second, what Copilot retrieves on its own from mail and documents, which is everything the user is allowed to open. The first is behaviour, the second is configuration, and both belong in the description.
The connections change the processing without anyone asking for a new DPIA. An agent that pre-processes purchase invoices, a connector to an external system, a feature that arrives with a monthly update: each one widens what Copilot can read. Record who switches them on and when a new use of the same licence gets its own review; the decisions involved are covered in Microsoft Copilot governance.
What does that look like at the municipality?
The privacy officer writes the DPIA in five parts. Copilot Chat for everyone with a work account, the paid version for a hundred and twenty employees, and the consumer version not allowed, with the reason recorded. A permissions report showing that forty sites are open to everyone, and the decision that they will be cleaned up before any licence is assigned. The agent for social services as a separate paragraph, with its own review before it goes live. Summarising meetings with residents in Teams: not allowed until that has been decided separately. And a date, six months on, when the description is held up against the tools actually in use.
On that date it turns out that ChatGPT and a transcription tool are in use alongside Copilot, and that nobody has ever decided anything about the transcription tool. That is not an incident. It is the normal gap between a description and a working day, and exactly why the date was in the DPIA.
How do you show that the measures work?
The DPIA says that sensitive data is highlighted before a prompt is sent, that employees see a decision when they open a tool that has one and that the permissions have been cleaned up. Whether that actually happens is not in the document. It is in the figures afterwards: how many highlights there were and what happened to them, how many notices appeared and what the person did next, what share of AI use went through allowed tools and the permissions report with a new date. Our article on why a dashboard is not evidence explains what still has to be added: the measure and the scope, next to every figure.
