Copilot DPIA

[techie17]

Is anyone using the paid version of copilot (not copilot chat)in their trust and has a DPIA they can possibly share with me so I don’t have to reinvent the wheel and save me some time? Thanks 

[psydii]

Copilot itself is covered by the same contracts as 365. So doesn’t strictly need one if you’ve got your 365 paperwork up to date. You should however add it to your AI register, and mention it alongside 365 in your RoPA.

 

But if you light up any of the integrations that alter that, such as Anthropic models, you might need to more formally consider whether an additional DPIA is needed based on the specific terms of those additional integrations.

 

in Microsoft-land if you have to click through a licence agreement to enable it, then you need to do at least a light-pass on a DPIA and add it to your RoPA and stat sharing registers.

[browolf]

We just started using copilot premium and weren't required to make a DPIA by the trust dpo.  

When you add files to copilot they are stored in a folder in your onedrive. 

If they do force you to make a new dpia, put a blank dpia and this link and the addition resource links at the bottom of the page into copilot Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat | Microsoft Learn

 

 

I've done a few dpias with copilot basic before i got premium. 

Use this prompt. 

I need to make a data protection impact assessment for using Copilot premium.  use these links as source material. Ask me questions one at a time for anything else you need to know before filling in the document. 

Edited October 15 by browolf