Skip to main content
Praxikon
Free check

Free template · Word · English and Dutch

Copilot DPIA pack: checklist, questionnaire and text blocks for Microsoft 365 Copilot

The Copilot DPIA pack bundles three templates with which a municipality or other public body drafts the DPIA for Microsoft 365 Copilot along the advice of the Dutch Data Protection Authority (case 2025-018225): a checklist per DPIA part with the section of the advice, a questionnaire for IT and the vendor on tenant settings, oversharing, logging, retention, the EU Data Boundary, sub-processors and data processing terms, and text blocks for necessity and proportionality and for risks and measures. The DPA itself writes that every organisation must assess whether its processing matches the processing described; the pack helps with that assessment and is not legal advice.

Last checked against the law
Editor
, jurist, privacy and AI
Version and template ID
2.0 · praxikon:template:copilot-dpia-checklist, praxikon:template:copilot-vragenlijst, praxikon:template:copilot-dpia-tekstblokken
Legal basis
Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744

Who is this template for?

  • Privacy officer or drafter of the DPIA, on behalf of the controllerContent of the DPIA (Article 35(7) GDPR)
  • Data protection officer (DPO)Advice on the DPIA (Article 35(2) GDPR) and the decision on prior consultation (Article 36 GDPR)
  • CISO, information security and tenant administrationSecurity and authorisations (Article 32 GDPR); the preconditions in sections 6.1 and 6.3.2 of the Dutch DPA's advice
  • Information manager and records managerRecord of processing (Article 30 GDPR), data management and retention (Article 5(1)(e) GDPR)
  • Procurement and contract managementTerms with the vendor as processor (Article 28 GDPR) and additional arrangements (DPA advice, section 6.3.1)

What is inside

DPIA checklist for Microsoft 365 Copilot (Word)

A DPIA checklist for Microsoft 365 Copilot sets out, for each part of the DPIA (Article 35(7) GDPR), what the Dutch Data Protection Authority expects before a municipality or other public body uses Copilot: the basics in order, purpose and legal basis, necessity, accuracy, rights, the vendor's role, the four high residual risks and the fifteen measures from the advice, each with its section.

  • The preconditions the DPA expects before the DPIA: record of processing, data management and labelling, authorisations and the cloud environment (chapter 0)
  • For each DPIA part the points to tick off, with the section of the DPA advice (chapters 1 to 6)
  • The five preconditions from the reference DPIA that the DPA names expressly, including blocking Bing and central retention periods (chapter 6)
  • The four high residual risks from the reference DPIA with what the DPA asks per risk (chapter 7)
  • The fifteen measures from chapter 8 of the advice on one list, with a column for the evidence in your file
  • Completion: DPO advice, prior consultation, decision and review, plus the links with the AI Act (chapters 9 and 10)

Copilot questionnaire for IT and the vendor (Word)

A questionnaire for IT and the vendor collects the facts the DPIA on Microsoft 365 Copilot needs: how the tenant is configured, who can access what, what is logged and kept, and what the vendor processes, where and on which terms. Each question names the section of the Dutch DPA's advice or the GDPR article.

  • Part 1 for your own IT department or managed service provider: rollout and licences, access and oversharing, the five preconditions from the reference DPIA, logging and retention (modules A to E)
  • Part 2 for Microsoft or your licensing partner: roles and data protection terms, Required Service Data, EU Data Boundary and transfers, sub-processors, filters, rights and incidents (modules F to K)
  • For each question the reason, with the section of the DPA advice or the GDPR article, and an answer field
  • An internal assessment guide that translates each answer into a consequence for the DPIA

Copilot DPIA text blocks (Word)

DPIA text blocks for Microsoft 365 Copilot are texts to adapt for the necessity and proportionality part and the risks and measures part of a DPIA, built along the advice of the Dutch Data Protection Authority. They are a starting point for the controller's own assessment, not legal advice.

  • A box that marks the text as a starting point and not as legal advice
  • Block 1: purposes per use case, legal basis, suitability, necessity and data minimisation, subsidiarity, storage limitation, proportionality and conclusion
  • Block 2: eleven risks with their source and a measure text, including the four high residual risks from the reference DPIA
  • Texts for the high residual risks around Required Service Data, accuracy and human assessment, and the decision on prior consultation (Article 36 GDPR)
  • A list of moments at which you review the DPIA

How to use the template

  1. Start with chapter 0. The DPA calls having the basics in order a precondition for any use of generative AI.
  2. Send the questionnaire in this pack to IT and to the vendor, and use the answers for chapters 1 to 6.
  3. Tick a point only when you can point to the evidence, and record that evidence in the list of measures in chapter 8.
  4. Record the risks in chapter 7 and use the text blocks in this pack for necessity and proportionality and for risks and measures.
  5. Ask the DPO for advice and have the controller decide before the start, also for a pilot.

Common mistakes

  • Treating the DPA advice as if it applied to your organisation. The DPA itself writes that every organisation must assess whether its processing matches the processing described.
  • Writing 'supporting employees' as the purpose. The DPA called that description too vague and too general; write a purpose per use case.
  • Assuming a pilot is not processing because the data are already in-house. The DPA did not follow that reasoning: a pilot must also comply with the GDPR.
  • Cleaning up authorisations only once Copilot is running. Copilot sees everything the user can access; the DPA asks for this beforehand.
  • Starting while the vendor does not say which data it collects and how long it keeps them. In that case the DPA advised not to start.

When do you need legal advice?

  • A high residual risk remains. After your measures a high risk is still open, for example because the vendor does not make clear which data it collects and how long it keeps them. The controller must then consult the supervisory authority before processing starts (Article 36(1) GDPR). In this case the Dutch DPA advised not to start (DPA advice, sections 6.3.5 and 6.3.6).
  • Copilot enters a process with decisions about residents. Think of objections and appeals, permits or benefits. The controller must ensure that the human assessment stays decisive (Article 22 GDPR; DPA advice, section 6.2.3) and check whether the AI Act brings a stricter regime.
  • The vendor's role is unclear. According to the reference DPIA, Microsoft is a controller for some processing operations. The controller determines the role per processing operation, assesses whether it is acceptable and makes additional arrangements where needed (DPA advice, section 6.3.1; Article 28 GDPR).

Frequently asked questions

What did the Dutch DPA say about Microsoft 365 Copilot?

In its advice on a municipality's prior consultation (case 2025-018225) the Dutch DPA concluded that the intended use of Copilot would infringe the GDPR without additional measures. It lists measures for any generative AI system and additional measures for Copilot, and advises not to start until they have been taken.

Does the advice apply to my organisation?

Not automatically. The advice concerned the processing one municipality described. The DPA writes that other municipalities and public bodies must assess for themselves whether their processing matches and make their own assessment. Outside the Netherlands it is not binding, but it gives a detailed picture of what a supervisory authority expects.

Do I have to consult the supervisory authority beforehand?

Only if your DPIA shows that a high risk remains after measures (Article 36(1) GDPR). If the risks around Required Service Data and retention remain open, the Dutch DPA advised in this case not to start.

Is Microsoft 365 Copilot a high-risk system under the AI Act?

As a general assistant, usually not. If you use Copilot for a purpose in Annex III, such as evaluating eligibility for public assistance benefits, check separately whether that use results in a high-risk system. The duty to take AI literacy measures (Article 4) does apply.

May I adapt the checklist and share it?

Yes. You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

What is Required Service Data?

According to the reference DPIA, as the Dutch DPA describes it, the umbrella term Microsoft uses for the data sent to Microsoft when online services such as Copilot are used. It can include content and diagnostic data. The lack of transparency about it is one of the four high residual risks.

Why ask about oversharing?

Copilot can use everything the user has access to. If authorisations are too broad, Copilot processes more personal data than necessary. The DPA therefore asks to examine the authorisation structure first and limit it to what is necessary.

What if the vendor does not answer?

Record which questions remain open and weigh that in the DPIA. Where it concerns the content and retention of Required Service Data, the Dutch DPA advised not to start until there is sufficient transparency. A vendor that does not cooperate with the measures cannot be engaged.

Are these text blocks legal advice?

No. They are a starting point that you adapt to your own processing. The controller remains responsible for the assessment in the DPIA.

What is the difference between necessity and proportionality?

Necessity asks whether the processing and each category of data are needed for the purpose, and whether the purpose cannot be achieved by less intrusive means. Proportionality weighs the organisation's interest against the interference with the interests of data subjects.

When should I review the DPIA?

When the processing in practice differs materially from what the DPIA describes, for example through new features, agents, sources or more users. According to the Dutch DPA you then reassess and consult again where needed.

Use and credit

You may use, adapt and share this template freely, including within your organisation, provided the credit 'Source: Praxikon' with the link to this template stays in place.

How to cite this template: Source: Praxikon, Copilot DPIA pack: checklist, questionnaire and text blocks for Microsoft 365 Copilot, version 2.0, as of 6 October 2026, https://www.praxikon.com/en/templates/copilot-dpia

This template is a tool, not legal advice for your situation. It reflects the law as of 6 October 2026. Legislation, guidance and supervisory practice may change after that date. Using this template does not guarantee compliance: applying it in your organisation remains your own responsibility.

Praxikon is a trade name of Embed AI · Chamber of Commerce 90283597

Which obligation this belongs to