# Microsoft 365 Copilot DPIA artefact list

Datalegale — August 2026.

Microsoft’s “Build your own” Copilot DPIA describes the product. Article 35 still needs tenant facts the template cannot know. Fill every row. A blank is a decision you have not made.

This is not legal advice and not a DPIA.

## Tenant

- Organisation:
- Tenant geo / billing address:
- Date:
- Owner:
- AI Administrator who checked settings:

## Rows Microsoft’s template does not fill in

| Artefact | Status (done / missing / N/A) | Value, date, evidence |
|---|---|---|
| Flex Routing: Allow or Do not allow |  |  |
| Extra-EU inferencing treated as Chapter V transfer if Allow |  |  |
| Power Platform / Copilot Studio flex checkbox (if used) |  |  |
| Multi-Geo purchased or used (not in scope for M365 EUDB) |  |  |
| Anthropic / excluded models enabled in Copilot |  |  |
| Web grounding / Bing on or off |  |  |
| Oversharing assessment (Everyone / Anyone / stale groups) |  |  |
| Restricted Content Discovery or equivalent holding control |  |  |
| Microsoft 365 Copilot listed as a DLP location |  |  |
| Commercial Copilot licences (not consumer on work data) |  |  |
| Audit: we produced one Copilot thread on [date] |  |  |
| Retention period for prompts and responses (ours, not default) |  |  |
| Employee notice matches what Copilot can see |  |  |
| RoPA entry names prompts, grounding, completions |  |  |
| Named owner for configuration drift |  |  |
| Foundry / Azure OpenAI: in scope, or explicit out-of-scope |  |  |
| Foundry deployment type: regional / Data Zone EU / Global |  |  |
| Decision if a DPIA is not required (dated) |  |  |

## How to check Flex Routing

1. Sign in to the Microsoft 365 admin center as AI Administrator.
2. Copilot → Settings → View all.
3. Flex routing during peak load periods.
4. Set Do not allow flex routing — or record Allow as a transfer.
5. Write the date and owner here. Check Power Platform if you use Copilot Studio.

## Sources

- Flex routing (EU and EFTA): https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-flex-routing
- Microsoft Build-your-own Copilot DPIA: https://wwps.microsoft.com/content/o365-impact-assessment/
- GDPR DPIA guidance (Microsoft Learn): https://learn.microsoft.com/en-us/compliance/regulatory/gdpr-data-protection-impact-assessments