Is Microsoft’s Copilot DPIA template enough for Article 35?

Public Copilot DPIAs worth reading first

These files describe the product or another organisation’s risk model. None of them know your tenant. Combine them with the artefact table on this page.

1. Microsoft “Build your own” Copilot DPIA — Product architecture and residual risk at Microsoft’s level. Does not know your Flex Routing value, ACLs or DLP locations.
2. NHS England Microsoft 365 Copilot template DPIA — Public-sector structure you can steal. Still a template: paste, then fill the tenant rows on this page.
3. Microsoft Learn — GDPR DPIAs — How Microsoft positions DPIA support in the cloud. Controller duties stay yours.
4. SURF (NL) Microsoft 365 Copilot DPIA — Independent DPIA for Dutch education and research (Privacy Company, updated 2026). Architecture insight and residual-risk language — not your Article 35 file.
5. Norwegian Datatilsynet / public Copilot assessments — Supervisory-authority lens on generative AI at work. Useful for residual-risk language; not a substitute for Article 35 on your purposes.

A Copilot score is not a DPIA

Article 35 GDPR asks whether processing is likely to result in a high risk to people. Microsoft 365 Copilot used on employee or customer content at scale usually meets that test: systematic processing, new combinations of data, and a retrieval interface people did not have last year. Microsoft publishes a “Build your own” Copilot DPIA. NHS England publishes another. Both are useful. Neither knows whether Flex Routing is on in your tenant.

If you conclude a DPIA is not required, write that down. Silence is not a decision. A works council, customer or supervisory authority will ask for the document, not for the conversation in which someone said “we’ll do it after the pilot”.

What Microsoft’s template cannot know

Vendor DPIAs describe architecture, subprocessors and residual risk at product level. They do not contain your Flex Routing value, your SharePoint Everyone groups, or whether Purview DLP lists Microsoft 365 Copilot as a location. Those three facts decide whether the residual-risk paragraph you copied is still true. Copy the template, then fill the tenant table. The downloadable artefact list on this page is that table.

The same gap appears with audit and retention. The product can log Copilot interactions. Your DPIA has to say you can produce one. Run the test. Put the date in the file.

What the file actually contains

A Copilot GDPR file in an EU organisation is mundane and specific: commercial licensing under the Microsoft Products and Services DPA (consumer Copilot on work content is the wrong processor path), a RoPA entry that names prompts, grounding and completions, an employee-facing notice that matches what the tool can see, audit of Copilot interactions you can actually retrieve, retention that is yours rather than the product default, and a named owner for configuration drift.

Prompt and response stores are in-scope for subject access and deletion more often than IT expects. People paste names, case IDs and email threads. If you cannot produce a Copilot thread when asked, the DPIA line “we have audit” is not true.

Enable now, document later

You can. It is the expensive gap. Once staff depend on Copilot, disabling Flex Routing, switching off web grounding, or pulling licences while you remediate oversharing becomes a political event. The paperwork is cheaper before the habit. Customer security questionnaires have started to ask for the DPIA as a named artefact, alongside the Flex Routing setting.

EU AI Act is a second conversation

Most organisations using Microsoft 365 Copilot as a deployer of a general-purpose system have lighter AI Act duties than providers. That is not a free pass and it does not replace GDPR. Literacy, transparency to staff and human oversight still apply. Custom agents in Copilot Studio or Azure AI Foundry can look more like a provider or a high-risk use. Finish the GDPR file first. Do not over-claim AI Act exposure to avoid a DPIA, and do not under-claim GDPR because the AI Act is the fashionable statute.

Sources

• Build your own Microsoft 365 Copilot DPIA (public sector / enterprise) — Microsoft
• GDPR Data Protection Impact Assessments — Microsoft Learn
• NHS England Microsoft 365 Copilot template DPIA

Read first

• Are Copilot prompts in your audit log?

  Enable auditing of Copilot interactions and define retention aligned with legal and regulatory needs.

• Does the EU AI Act replace GDPR for Copilot?

  Most organisations using Copilot as a deployer have lighter AI Act duties than providers. GDPR obligations remain fully applicable.

• Is work Copilot the same as consumer Copilot?

  Commercial Microsoft 365 Copilot under Enterprise Data Protection is a different product, contractually and technically, from consumer Copilot.

FAQ

Other assessments — not the same questionnaire

• Copilot Flex Routing: Can Inferencing Leave the EU?

  Yes for inferencing. No for data at rest. Microsoft Learn says Flex Routing lets EU and EFTA customers allow LLM inferencing outside the EU Data Boundary at peak demand. That sentence is true, and it is the whole problem: storage is not what it describes. Prompts, responses and grounding data may be processed in the United States, Canada or Australia. Customer data at rest stays inside the Boundary, except limited pseudonymized operational data. Message Center MC1269223 enabled the setting by default for new eligible tenants after 25 March 2026 and for many existing tenants from 17 April 2026.

• Copilot Oversharing: SharePoint, Labels and DLP

  Yes, if a licensed user can already open them. Copilot does not create a new SharePoint permission. It summarises existing ACLs — including Everyone, Anyone links and “except external users”. Sensitivity labels and Purview DLP only stop that if they are applied and if Microsoft 365 Copilot is a location in the policy.

• Copilot EUDB ≠ Foundry Data Zone ≠ Global

  No. Copilot EU Data Boundary, Foundry Data Zone EU, and Foundry Global are three different commitments. Copilot tenant settings do not govern Foundry. A regional EU resource stores data in that geo; a Data Zone EU deployment may infer anywhere in Microsoft’s EU data zone; a Global deployment may infer in any Foundry region worldwide. Claude / Anthropic on Foundry did not offer a European data zone comparable to Azure OpenAI in 2026.