Copilot in Dutch government: safe use after the 2025 DPIA

Microsoft 365 Copilot can be used responsibly in government, but only if the organisation sorts out the basics itself. That follows from the revised DPIA from SLM Rijk of September 2025: from four high privacy risks to two medium risks. So Copilot is not safe by itself: authorisations, data classification, training and policy decide whether it stays safe.

At the end of 2024 the conclusion was still that Copilot could not be used in a compliant way. Below you can read what has changed since, which risks remain and which steps municipalities, provinces and central government can take.

What changed after the first DPIA?

The first DPIA (December 2024), carried out by SLM Rijk and SURF, identified four high privacy risks. The core objections: too little transparency about the processing of personal data, unclear retention periods and limited control for organisations.

Microsoft then worked with SLM Rijk and SURF for months. The result:

• the four high risks have been mitigated or reduced;
• according to the sources, Microsoft 365 Copilot has an ISO 42001 certification, the international standard for AI management systems;
• extra technical safeguards around personal data have been built in.

SLM Rijk concludes that the AI assistant can now be used responsibly, provided organisations take measures themselves too.

Which two medium risks remain?

1. Unintended disclosure of sensitive information. Copilot has access to multiple sources within the employee's authorisation: OneDrive, email, SharePoint and Teams. The risk arises when Copilot links information from different sources. An employee can then see combined insights that are no problem separately, but sensitive together.

2. Incorrect or misleading output (hallucinations). Copilot can give answers that sound convincing but are wrong. For organisations where decisions must rest on facts, that is a real risk if employees take over output without checking it.

What does Microsoft say about data protection?

Based on public Microsoft sources, including the document on Enterprise Data Protection and the privacy overview, these safeguards apply:

• Works inside the Microsoft 365 tenant. Users only see data they already have access to through their authorisations. Copilot respects the existing permissions structure.
• No training on organisation data. Prompts and answers are not used to train Microsoft's underlying language models. That sets business versions apart from consumer versions of AI tools.
• Microsoft Graph as information source. Answers are based on content inside the organisation, like documents, emails, chats and calendar data. Logging, auditing and encryption run through the existing Microsoft 365 security.

What role does Microsoft Purview play?

One of the most underrated factors is how you set up Microsoft Purview. This platform lets you classify and protect data before Copilot gets to work with it.

With Purview, organisations can assign sensitivity labels to documents, emails and SharePoint locations. Those labels decide, among other things, which content Copilot may use, which documents are excluded from AI processing and which encryption and access restrictions apply. For organisations that work with the Baseline Informatiebeveiliging Overheid (BIO), the government information security baseline, this is key to a responsible rollout.

Purview also offers DLP policy (Data Loss Prevention) and audit logging, so you can check how Copilot handles organisation data.

Which three pillars does a safe rollout have?

Copilot is only as safe as the environment underneath it. Governance, setup and conscious use have to move together.

Pillar 1: authorisations and information classification

For a broad rollout, the authorisation structure in Microsoft 365 must be right, because Copilot inherits the user's access rights. In practice:

• check and limit excessive access rights in SharePoint and Teams;
• implement sensitivity labels through Microsoft Purview;
• run your own DPIA at organisation level;
• switch on audit logging for Copilot interactions.

Pillar 2: training and AI literacy

Employees need to understand what Copilot does and does not do, how to assess AI output critically, which internal guidelines apply and when human verification is mandatory. Without that knowledge the risk of unchecked use remains, whatever the technical measures. More on getting teams used to AI is at AI adoption.

Pillar 3: governance and policy

Besides technology and training you need organisational policy:

• a formal AI policy with guidelines for responsible use;
• periodic evaluation of risks and measures;
• compliance with the EU AI Act and its deadlines;
• registration in the algorithm register where it applies.

What does Copilot deliver for government?

Governance is a precondition, not a goal in itself. The uses that landed best in pilots are generating meeting minutes automatically and drafting first versions of letters and memos: tasks that structurally cost time. The municipality of Midden-Groningen also named this as promising in a pilot.

How much time you gain depends on your work and how far adoption goes. So start with one department and one concrete use, measure the result and use that to build support for a wider rollout. Examples of uses are at AI implementation.

What is the risk of doing nothing: Shadow AI?

The risk of Shadow AI is often underexposed in the DPIA discussion. If an organisation offers no managed AI solution, employees often start using unmanaged tools like ChatGPT or Gemini on their own. Then organisation data leaves the protected environment, without logging, data classification or control over where the data ends up.

A total ban therefore gives a false sense of safety and can be riskier than a controlled rollout. The question is not whether AI is used, but how. A managed solution with good governance keeps control with the organisation. Also read the explanation on security and governance.

Step-by-step plan: implementing Copilot safely in government

Is Copilot safe enough for government?

The question can now be answered with a conditional yes. The revised DPIA shows that Microsoft has made substantial improvements. But safety is not a product you buy: it is an ongoing process with well-set-up authorisations and data classification, trained employees and governance that grows with the technology.

Want to know where your organisation stands before you start? Look at AI consultancy, or plan an introduction.

Frequently asked questions

Is Microsoft 365 Copilot approved for use in government?

Under conditions, yes. The revised DPIA from SLM Rijk (September 2025) concludes that Copilot can be used responsibly, provided organisations take measures themselves: set up authorisations, classify data with Purview and train employees. Two medium risks remain: unintended disclosure and incorrect output.

What role does Microsoft Purview play in using Copilot safely?

With Purview you give documents and emails sensitivity labels that decide what Copilot may process. Together with DLP policy and audit logging, you prevent confidential information from being exposed by accident.

What is the risk if our organisation does not roll out Copilot?

The risk is Shadow AI: employees use unmanaged AI tools on their own, with data leaving the protected environment without logging or control. A controlled rollout with good governance and training is safer than a ban that is not followed in practice.

Do we, as a municipality, need to run our own DPIA next to the one from SLM Rijk?

Yes. The DPIA from SLM Rijk offers a framework, but every organisation is responsible for its own data processing. Your own DPIA is explicitly recommended to map your own authorisation structure and risks.

Sources

• DPIA Microsoft 365 Copilot (SLM Rijk)
• Update DPIA: SLM and SURF advise responsible adoption (Microsoft Pulse)
• Enterprise Data Protection for Microsoft 365 Copilot
• Microsoft Purview and Copilot (Microsoft Learn)
• Municipalities reconsider use of Microsoft Copilot (VNG)
• Government and education may use Copilot after risks are lowered (Dutch IT Channel)
• iBestuur: a total ban is not a lasting solution
• Purview: protect files from Copilot (AVK)