Do your DLP policies include Copilot?

Data loss prevention that was designed for email and file sharing does not automatically cover Copilot. Policies should explicitly include Microsoft 365 Copilot as a location where the platform supports it. Review existing policies before you assume Copilot is in scope.

How to implement without freezing work

Pair DLP with sensitivity labels. Labels classify; DLP enforces. Copilot then has something to respect besides raw permissions.

Run policies in simulation, review false positives with a business owner, then enforce. Start with the data types you already treat as high risk — personal identity data, health, financial — rather than inventing a new Copilot-only catalogue.

How to check it

In Microsoft Purview, open the DLP policies that you believe protect personal data. Confirm locations include Microsoft 365 Copilot where available. Confirm the policy is on, not draft, and that simulation results have been reviewed.

Test with a labelled or matching document in a pilot account. If Copilot still summarises it, the policy is not doing what the DPIA says it does.

What to write in the DPIA

Name the DLP policies that include Copilot, the data types they target, whether they are in simulation or enforce, and the date you last reviewed false positives. If Copilot is missing as a location, say that it is a gap — do not imply Exchange DLP covers the chat pane.

DLP without labels is brittle; labels without DLP are incomplete. The scanner treats both as separate questions for that reason. Close them as a pair before you tell a board that technical controls are “in place”.