DPIA Example (2026): Microsoft 365 Copilot Rollout at a Fund Administrator

This page shows extracts from a draft data protection impact assessment (DPIA) for a rollout of Microsoft 365 Copilot at a UK fund administrator. The company and the people named are fictional. The text was produced by our DPIA tool on 13 November 2026 (method version 0.5.20) from a test scenario in which the project owner answered the tool's questions and had no documents to hand. The extracts are reproduced as the tool wrote them, and passages that have been left out are marked with [...]. The notes between the extracts explain what each part of the assessment does.

The scenario

Harbourline Fund Services Limited is a fund administration and corporate services company based in London, with about 650 staff in the UK and a sister company in Ireland that shares its Microsoft 365 tenant. It administers UK and Channel Islands funds for asset managers, so its staff handle investor identity checks and screening results as well as ordinary business correspondence. The company has not switched Copilot on for anyone. It plans a pilot with 60 staff from January 2027 and a rollout to all UK staff from April 2027 if the pilot goes well.

The project owner knows the business and the technical plan and is not a data protection specialist. The data protection officer is aware of the project and has not yet advised. Several facts are still unknown, including where Copilot processes prompts and whether the company's client contracts restrict the use of AI tools.

The summary page (extract)

The Word document opens with a cover and a one-page summary drawn from the sections that follow. This is the part of the summary that deals with risk:

10 risks are recorded. Initial scores: 2 high, 8 medium. Scores in the residual column: 2 high, 8 medium. That column can hold a current score, a forecast that depends on planned measures, or a score kept provisionally until a fact is known, so the totals are not a forecast for every risk. Each risk's measures entry gives its status, evidence and conditions. A score does not show that a risk has been accepted. Owners and dates are shown where recorded.

Screening (extract)

Result: DPIA required.

[...] Law applied: the UK GDPR and the Data Protection Act 2018 (UK), as amended by the Data (Use and Access) Act 2025. Harbourline Fund Services Limited is based in London. The people whose information Copilot could reach are mostly in the UK: the 650 UK staff, client contacts and many investors. The funds are UK and Channel Islands funds. Some investors live in EU countries. Whether any investors live outside the UK and the EU has not yet been checked.

Open point (whether the EU GDPR also applies): residence in the EU alone does not settle this. The question for professional advice is whether the processing takes place in the context of the activities of an establishment in the EU and, where relevant, whether it relates to offering goods or services to people in the EU or monitoring their behaviour there. [...]

Reasons for the screening result:

• The ICO's list of processing likely to result in high risk (the list the UK regulator publishes under Article 35(4) of processing that needs a DPIA), item 1: innovative technology, including AI, when combined with any other WP248 criterion. Copilot is an AI system.
• WP248 criteria (the criteria in the European data protection regulators' guidelines on DPIAs, WP248 rev.01) that are met: "innovative use or application of new technological or organisational solutions"; "sensitive data or data of a highly personal nature" (staff health information and criminal allegations or convictions in investor screening results); and "data concerning vulnerable data subjects", because staff information will be processed and the guidelines treat employees as vulnerable because of the imbalance of power between employer and employee. Whether "data processed on a large scale" is met will be considered once the volumes are confirmed.
• Combined, these meet the ICO list item 1 condition, and more than two WP248 criteria are met. [...]

The DPIA is being carried out before the processing begins, as Article 35(1) requires.

The screening states which law it applied and why, and it gives the reason each criterion is met for this processing. It leaves the question of whether the EU GDPR also applies as an open point with the legal test stated, because the facts needed to answer it were not available.

Description of the processing (extract)

Planned controls (none set up or tested yet):

• Two sensitivity labels, "HR Restricted" and "Investor Identity".
• A Microsoft Purview data loss prevention policy intended to stop Copilot using files and emails carrying those labels to answer a prompt. IT has advised that the name of a labelled file may still appear as a reference, so the policy is described as limiting the use of content, not as hiding that the file exists. The controls cover only labelled material; sensitive content in unlabelled emails, chats or files is not covered by them.
• A permissions review of SharePoint and Teams before the pilot, as a separate piece of work, to fix sites shared too widely, including any shared with "everyone".

Proposed test (to be confirmed): in December, check on the test files, across each route into Copilot (chat, Outlook, Word, Teams and meetings), that labelled content is not used in answers and what is shown about labelled files.

Location: the tenant was set up in the UK, and mailboxes, SharePoint, OneDrive and Teams data are stored in Microsoft's UK data centres. Where Copilot processes prompts is not confirmed. [...] Microsoft's account team has been asked to confirm the processing locations in writing; no answer has been received.

The description records what Microsoft's products do as the project owner described it, and it states that none of the planned controls has been set up or tested. The data flow table then sets out each flow with the legal entity that receives the data, because the transfer rules depend on who receives the data and from where it can be accessed, and the place of storage does not settle them. This is its first row:

Data	Source	Receiving legal entity	Place	Purpose	Transfer status and mechanism
Content of emails, chats, files and meetings that staff can access, and prompts	UK staff and existing Microsoft 365 content	Microsoft Ireland Operations Limited (contracting entity)	Stored in UK data centres; prompt processing locations not confirmed	Answering staff prompts	UK to EEA recipient: UK adequacy provision (Data Protection Act 2018, Schedule 21, paragraphs 4 and 5). Any processing or access by other Microsoft companies or sub-processors outside the UK or EEA: unresolved pending Microsoft's written answer

The table has three further rows, for the records of prompts and responses, meeting transcripts and saved outputs. The transfer position for each is recorded as unresolved until the receiving entities and locations are confirmed.

Lawful basis and conditions (extract)

Special category data (health information): Copilot could reach staff health information in restricted HR sites and in ordinary emails and chats. Processing special category data needs an Article 9 condition in addition to the lawful basis, covering each processing operation (one condition may cover several operations where its requirements are met). No condition has been identified for Copilot's use of this information. [...] The planned labels and data loss prevention policy are intended to keep labelled HR material out of Copilot's answers, but they do not cover unlabelled emails and chats.

Criminal offence data (sanctions and politically-exposed-person screening results, which can include criminal allegations or convictions): under UK GDPR Article 10(1), such processing "shall be carried out only under the control of official authority or when the processing is authorised by domestic law, or relevant international law, providing for appropriate safeguards for the rights and freedoms of data subjects". [...] How Copilot's use of this information would be authorised has not been identified; professional advice is recommended. [...]

In this scenario, the project owner described health information in ordinary emails and chats and criminal allegations or convictions in investor screening results that Copilot could reach. The draft therefore treats health information and screening results as within the assessment, and it records the missing legal condition as a question for professional advice.

Necessity and proportionality (extract)

Alternatives considered:

• Testing with made-up data in a test environment: considered. IT's view is that this can test the controls but cannot show how useful Copilot is in real mailboxes and files. Harbourline therefore plans to test the controls on test files in December 2026 and then run the pilot on real mailboxes, limited to 60 people. This reason addresses why made-up data alone is not used; it does not address whether a narrower group of real users could test usefulness first.
• Choosing pilot staff by what they can open (for example staff without access to the HR sites or investor screening results): not yet considered. [...]
• Using Copilot during meetings without saving a transcript, instead of saved transcripts: under consideration; not decided.

The trial: because the pilot uses real personal data, its necessity and proportionality need to be assessed before it starts in January 2027, including which tests need real data, whether a narrower group could test usefulness first, and what result would justify moving to the April 2027 rollout. [...]

The draft records the reason given for rejecting an alternative and also what that reason leaves unanswered. It treats the pilot as processing that needs its own assessment, because a pilot on real mailboxes processes real personal data.

Risk register (extract)

The register opens with the definitions used for likelihood, severity and overall risk. Five of the ten rows are shown here, without the source, measures, owner and due date columns.

Risk to individuals	Likelihood	Severity	Initial	Residual
Health or criminal-allegation information is used by Copilot without an established legal condition, depriving people of the protection the law gives this information.	Possible	Severe	High	High
Sensitive details typed or pasted into prompts are kept for 12 months and seen by people who should not see them.	Possible	Significant	Medium	Medium
One client's investor information appears in work for another client, breaching confidentiality.	Possible	Significant	Medium	Medium
Investor information is used beyond what a client authorised, or without people being told, leaving them unable to understand or control its use.	Possible	Significant	Medium	Medium
An email or document containing hidden instructions manipulates Copilot into revealing or misusing information.	Possible	Significant	Medium	Medium

The measures column says, for each risk, which measures are confirmed, planned or only recommended, and why the residual score stands where it does. This is the entry for the fourth row:

Planned: Legal's activity mapping and client contract check. Recommended (not confirmed): no Copilot use on a client's information until the check confirms it is permitted; advice from Legal and Daniel on telling clients and investors. Residual provisional, retained pending these answers.

Each risk is described as a harm to people. All ten scores in the residual column equal their initial scores. The measures entries explain the conditions and outstanding evidence relevant to reviewing those scores.

AI systems (extract)

Instructions hidden in retrieved content: an email or document Copilot reads could contain instructions intended to manipulate its output. How this is addressed has not yet been discussed. Proposed (not yet confirmed): raise the question with IT and information security (owner to be assigned).

Records of prompts and responses: planned retention 12 months, searchable through Microsoft Purview (as described by Harbourline), for looking into complaints or incidents only. Who can read them, and on what conditions, is to be agreed with IT, information security and Daniel Okafor.

Outcome and actions (extract)

Status: draft, not approved. The draft remains unapproved until the prerequisites below are resolved, the advice of Daniel Okafor (Data Protection Officer) and the staff forum's views have been considered and recorded, and Helen Marsh (Chief Operating Officer and project sponsor, the accountable decision-maker) expressly records approval and her decision on the residual risks. No approval has been recorded.

[...]

Actions before the pilot (prerequisites; each to be completed before any pilot user is given access):

A1. Complete the permissions review of SharePoint and Teams, fixing sites shared too widely, including any shared with "everyone". Owner to be assigned.

A2. Set up and test the labels and data loss prevention policy in December 2026 on test files. Proposed (not confirmed): test through each route into Copilot and record what is shown about labelled files (file names may still appear as references). Owner to be assigned.

A3. Obtain Microsoft's written confirmation of where Copilot processes prompts (requested; answer awaited). [...]

A6. Obtain and record Daniel Okafor's written advice, beside each decision, with whether it was followed, before Helen Marsh decides. Owner to be assigned.

The draft lists sixteen numbered actions under ‘Actions before the pilot’, including recommendations awaiting confirmation. The data protection officer advises and the organisation's decision-maker approves, and the sign-off section at the end of the document is left blank for both.

The questions the project owner was asked

The tool asks one question at a time and offers buttons where a short answer will do.

Has any part of this already started, for example a few staff trying Copilot or the licences already being switched on?

The transfer rules depend on which company receives the data. Do you know which Microsoft company is named on your contract or the Data Protection Addendum, for example Microsoft Ireland Operations Limited or Microsoft Limited (UK)?

Next, the records Copilot creates of what staff ask and what it answers. Has IT decided who in Harbourline will be able to search or read those records, for example IT administrators, compliance or legal?

Next, whether a less intrusive approach would give you the same benefit. One option I suggest considering is choosing pilot staff who do not have access to the HR sites or the investor screening results, so the pilot tests the time savings without that material. Did you consider this, or any other narrower approach, when planning the pilot?

Where the project owner did not know an answer, the tool recorded the point as unconfirmed and added an action, which is why the draft contains a long list of open points.

Using the example

A privacy team reviewing this draft would check each recorded fact with the project, add the data protection officer's advice beside the decisions it concerns, and return the open actions to the people who can complete them. The draft gives the team a description of the processing and a list of what is still unknown at the start of that review.

Our article on Microsoft 365 Copilot and the GDPR covers the permissions, data residency and retention settings that an assessment of Copilot has to deal with, and our guide to writing a DPIA for an AI system explains each step of an assessment. A second worked example covers vehicle telematics with an AI driver score under Irish law.

Our DPIA tool takes you through your own assessment in a conversation and drafts the document as you answer. It is free to complete. To try it on a fictional project, give the fictional organisation’s name and describe what it does when prompted. Then describe the proposed system, who would use it and the information it would handle as you answer the tool’s questions. Privacy teams can read how the tool works for a team.