The privacy officer of a municipality is forwarded the SURF DPIA on Microsoft 365 Copilot, with the question whether that means the DPIA is "done". She reads it and finds a solid description of what Microsoft does with data. About the forty SharePoint sites open to everyone at the municipality, and the agent the social services department wants to build, it says nothing.
That is not a shortcoming of that document. A sector DPIA describes the service; your DPIA describes your use of it. What you include yourself: which variant and who, the permission structure, which data, which connections, which settings and measures, which tools are in use next to it, and how you later show that the measures are running.
When is a DPIA for Copilot needed?
Article 35 GDPR requires a data protection impact assessment when processing is likely to result in a high risk to individuals, and the EDPB uses the rule of thumb that two of its nine criteria are enough. Copilot for dozens or hundreds of employees, with access to mail, calendars and documents full of personal data, quickly meets more: new technology, large scale, sensitive data and employees as data subjects. How that weighing works is in do you need a DPIA for AI tools at work; for Copilot the answer is rarely no.
What is already in the sector DPIA?
SURF, together with SLM Rijk, published a DPIA on Microsoft 365 Copilot in December 2024, finding four high privacy risks and advising institutions not to use the service for the time being. After changes by Microsoft, a September 2025 update downgraded the risks to amber, with two residual concerns: inaccurate personal data generated about real people, and an 18-month retention period for pseudonymised metadata. The facts about the service itself, from the training commitment to flex routing, are collected in the privacy risks of Copilot.
That document is the description of the processor side, and you do not need to redo it. Carry the residual risks into your own DPIA as residual risks, and write next to them what you do about them locally. Mind the date, though: the service changes monthly, and a DPIA describes the state at the moment it was written.
What do you add yourself?
| Part | What you include | Why it belongs there |
|---|---|---|
| Variant and users | Who works with Copilot Chat, who with the paid Microsoft 365 Copilot, what applies to the consumer version | The variants differ in reach and in data protection |
| Permission structure | The state of permissions on SharePoint, OneDrive and Teams, with a date, and what was cleaned up | Copilot searches with the permissions a user already had |
| Data | Which categories end up in prompts and which lie within reach of the search, per kind of work | The DPIA describes the actual processing, not the intended one |
| Connections and agents | Connectors, agents from Copilot Studio and plug-ins, with the source and owner per connection | Every connection widens what can land in an answer |
| Settings | Flex routing, sensitivity labels, DLP, and which of these are temporary | They determine where processing runs and what is excluded |
| Other AI tools | What is in use next to Copilot, with a status | Otherwise the DPIA describes one tool while four are in use |
| Measures and evidence | Per measure, how you will later show it is running | A DPIA describes; the figures afterwards show |
The permission structure is the part most often missing, and the most important. Copilot breaks no permissions; it searches with the permissions a user already had, and that makes years of oversharing findable in a single question. What happens when Copilot can reach SharePoint is therefore a DPIA question: which sites are open to everyone, what has been done about it, and on which date. Microsoft puts that cleanup at the front of its own deployment guidance.
The data splits in two. What employees paste into the prompt, per kind of work: customer contact, personnel files, case files of residents. And what Copilot retrieves on its own from mail and documents, which is everything the user may open. The first is behaviour, the second is configuration, and both belong in the description.
The connections change the processing without anyone requesting a new DPIA. An agent that pre-processes purchase invoices, a connector to an external system, a feature that arrives with a monthly update: each widens what Copilot can read. Record who switches them on and when a new use of the same licence gets its own review; the decisions around that are in Microsoft Copilot governance.
What does that look like at the municipality?
The privacy officer writes the DPIA in five parts. Copilot Chat for everyone with a work account, the paid variant for a hundred and twenty employees, the consumer version not allowed with the reason written down. A permissions report showing that forty sites are open to everyone, and the agreement that those are cleaned up before any licence is assigned. The agent for social services as a separate paragraph, with its own review before it goes live. Summarising meetings with residents in Teams: not allowed until that has been decided separately. And a date, six months on, when the description is laid next to the actual list of tools.
On that date it turns out that ChatGPT and a transcription tool are in use next to Copilot, and that nobody has ever decided anything about the transcription tool. That is not an incident. It is the ordinary distance between a description and a working day, and exactly what that date in the DPIA was for.
How do you show that the measures work?
The DPIA says that sensitive data is marked before a prompt leaves, that employees see a decision when they open a tool that has one, and that the permissions have been cleaned up. Whether that actually happens is not in the document. It is in the figures afterwards: how many markings there were and what happened to them, how many notices appeared and what the person did next, what share of AI use ran through allowed tools, and the permissions report with a new date. Why a dashboard is not evidence explains what still has to be added: the measure and the scope, next to every figure.
