Microsoft commitments to M365 Copilot DPIA

Dear Mr. Herkemij and Mr. Barnard,

Thank you for the ongoing dialogue with SLM. This letter sets out Microsoft’s commitment to
SLM regarding the key open concerns related to the M365 Copilot DPIA. Microsoft is
committed to ongoing work between the parties to resolve concerns SLM has raised regarding
the Dutch government’s intended use of M365 Copilot and to enable SLM to advise positively to
its constituents concerning the adoption of M365 Copilot.

In consideration of these commitments, we understand that SLM will partner with Microsoft to
resolve these concerns over the coming months as outlined below and your DPIA for M365
Copilot will be amended by SLM to reflect that these concerns have been addressed.

Retention Timeline

By 4 April 2025, Microsoft commits to implement a policy across M365 applications and Copilot
to retain Personal Data included in service-related data used for diagnostic purposes for no
longer than eighteen (18) months with the exception of data retained for security or reasonably
required for other legitimate legal purposes (e.g., legal holds).

DSAR

By 4 April 2025, Microsoft commits to work with SLM to better understand SLM’s Data Subject
Access Request (DSAR) output use case scenario to evaluate options to help the DSAR format
better work for SLM and provide a reading guide generally applicable to DSAR outputs.

RSD and Diagnostic Data Transparency

We understand that the Required Service Data (RSD) concept has continued to cause confusion
for SLM and we are working to evolve our documentation to provide greater clarity and
transparency. By 4 April 2025, Microsoft commits to provide additional transparency to SLM with
more detailed categories of the types of service-related data processed through use of Microsoft 365 Copilot and existing controls for these types of data, their purpose, and typical
retention timelines.

Accuracy of Personal Data in Copilot Outputs

By 4 April 2025, Microsoft commits to discuss with SLM an approach to supporting an industry wide RAI standard as well as to investigate options to help enable data controllers to assess the
impact of RAI mechanisms on Personal Data and evaluate the output of Microsoft 365 Copilot
accuracy concerning Personal Data themselves.

Relative to asks for specific data re: accuracy of personal data in Microsoft 365 Copilot output,
by 4 April 2025, Microsoft commits to provide insights into the privacy principle within its
Responsible AI practices and will work with SLM to further define the level of detail.

Next Steps

Microsoft proposes that the parties meet on a regular cadence between now and 4 April 2025 to
ensure feedback and progress in resolving the concerns. On behalf of Microsoft, I want to again
thank you for your ongoing collaboration, and we look forward to making continued progress
on these concerns to assist the Dutch government in its deployment of M365 Copilot.

Sincerely,

Aleš Holeček
Chief Technology Officer
Experiences and Devices
Microsoft Corporation