Appearance
Microsoft Supplier DPR
The Microsoft Supplier Data Protection Requirements (DPR) are the data protection requirements that Microsoft sets for its suppliers. Microsoft gives the DPR to its suppliers through the Supplier Security and Privacy Assurance (SSPA) Program. DPR Version 10, October 2024, applies to each Microsoft supplier that Processes Microsoft Personal Data or Microsoft Confidential Data in connection with its Performance of its contract with Microsoft. For the full applicability conditions, see Contracts and data.
Key facts
Type
Contractual requirements for suppliers
Issuer
Microsoft
Program
SSPA
Structure
Sections A to K, each requirement with its Evidence of Compliance
Edition in Modulos
Version 10, October 2024
Edition on the Microsoft SSPA page
Version 12, March 2026
Use these instructions
Microsoft suppliers can use the Microsoft Supplier DPR pages for these tasks:
- Applicability — To find if the DPR applies to your work, and which requirements your SSPA Data Processing Profile gives, see When the DPR applies.
- Assurance — For the SSPA conditions before work starts, the annual self-attestation, and independent assessments, see Evidence and audits.
- Modulos — To add the Microsoft Supplier DPR Frameworks and find the Requirement for each DPR section, see Use Modulos.
How to think about supplier requirements
Microsoft applies the DPR to its suppliers through their contracts and the SSPA Program. The DPR is not a law. Its Applicability text connects the DPR to the contract of each supplier with Microsoft and to the Performance of that contract. The Applicability text also has two precedence rules. One rule is for the contract, and one rule is for legal or statutory requirements. For these rules, see Contracts and data.
The DPR is not the only set of Microsoft requirements for a supplier. SSPA Program Guide Version 12 tells suppliers that they can also have "additional organizational level requirements that are decided and communicated independently of SSPA by the Microsoft group responsible for the engagement".
The DPR contains lettered sections, from Section A to Section K. Each section contains numbered requirements. Version 10 contains requirements 1 to 70, and Version 12 contains requirements 1 to 63. Next to each requirement, the DPR has an Evidence of Compliance column with the evidence for that requirement. Some conditions are only in the Evidence of Compliance column, for example the cookie time limits of Version 10, item 10. The Applicability text, the Key Definitions, and the Glossary give the meanings of the DPR terms, for example Performance, Microsoft Personal Data, and Subcontractor.
Not all DPR requirements apply to each supplier: see the possible reduced requirements for Controllers and for suppliers that Process only Microsoft Confidential Data, and the Section K condition for AI Systems.
DPR Version 10 and Version 12
Microsoft published these editions of the Supplier Data Protection Requirements (DPR):
- Version 10, October 2024.
- Version 11, April 2025.
- Version 12, March 2026.
The Microsoft Procurement SSPA page names the "v12 Program Guide" and gives Version 12 as the English DPR download. Microsoft gives the SSPA procedures in its Program Guide Version 12, March 2026. Microsoft Learn also has an SSPA article, with "Last updated" September 29, 2025. That article gives this rule: "If there's a conflict between the information in this article and the SSPA page, the SSPA page takes precedence."
A publication month is not the date from which an edition applies. The Version 12 DPR, SSPA Program Guide Version 12, and the SSPA page give no start date for Version 12. They also give no period for the change to Version 12.
The Modulos Frameworks MFF-8 and OFF-8 use DPR Version 10, October 2024. The Requirements of these Frameworks refer to Version 10 items. The duties on the When the DPR applies and Evidence and audits pages also follow Version 10. The Frameworks do not hold the Version 11 and Version 12 changes in the table below.
For an independent assessment, SSPA Program Guide Version 12 tells suppliers that the assessor uses "the most current DPR". The Version 10 edition of the Frameworks does not change this instruction. See Prepare for independent assessment.
The table compares Version 10 with the editions after it. Each item number is the number in its edition.
| Subject | Version 10, October 2024 | Version 11 and Version 12 |
|---|---|---|
| Applicability | The DPR applies to a supplier that Processes Microsoft Personal Data or Microsoft Confidential Data in connection with its Performance. | Version 11 and Version 12 also apply to a supplier that uses AI Systems in connection with its Performance. In all three editions, the Section K condition does not change. |
| Management | Item 3 gives responsibility and accountability for compliance with the DPR to a designated person or group. Item 5 gives sanctions for employees who do not obey the privacy and security policies of the supplier. | Version 11 removes item 3 of Version 10. The sanctions item adds "applicable Microsoft policies if working within the Microsoft corporate environment". |
| Notice and consent | Item 8 is about the collection of Microsoft Personal Data in voice calls. Item 10 is about cookies. In item 10, suppliers "should use the Standard Banner" unless the "contracting business unit" asks them not to. | Version 11 removes item 8 of Version 10. The cookie item adds a first sentence about legally required consent before the use of cookies. It does not keep the Standard Banner recommendation. |
| Subcontractors | Item 27 is about the contact preferences of Data Subjects where Microsoft is a Controller. Item 29 tells the supplier to "Review complaints for indications of any unauthorized or Unlawful Processing". Item 32 tells the supplier to "Promptly take actions to mitigate any actual or potential harm caused by a subcontractor’s unauthorized or Unlawful Processing of Microsoft Personal and Confidential Data." | Version 11 removes items 27, 29, and 32 of Version 10. Version 12 keeps these removals. Versions 11 and 12 also remove the item 25 instruction: "Indicate your acceptance of this obligation even if you do not currently engage subcontractors but may in the future." Version 11, item 24, tells the supplier to "Require the subcontractor to agree in writing to terms no less protective of Microsoft than the terms in supplier’s agreement with Microsoft". Version 12 keeps this item as item 24. |
| Security | Item 48 gives "a smart card or phone-based authenticator" as examples of Multi-Factor Authentication. Item 50 is about "disk-based encryption". Version 10 has no item about identity checks during hiring. | In Version 11, the Multi-Factor Authentication examples are "a security key, phone-based authenticator or smart card". The device encryption item changes to "full disk encryption". Version 11, item 45, adds identity checks during hiring and placing (Version 12, item 46). Version 12, item 41, is a new item: "Protect information in networks and support systems". |
| AI training | In item 55, Microsoft tells the supplier to "Establish, maintain, and perform annual privacy and security training". This training covers each person who will have access to or Process data in AI Systems in connection with Performance. | Version 11 keeps this item as item 52. Version 12 has no AI training item in Section K. Version 12, item 3, adds that "any person who will Process data within AI Systems in connection with Supplier’s engagement for Microsoft has completed AI training relevant to their role". |
| Sensitive Use and Red Teaming | Version 10 gives a definition of Sensitive Use and uses the term in items 56, 60, 62, 65, and 66. Item 57 gives this requirement: "Supplier must have Red Teaming of AI Systems." | Version 11 keeps the two. Version 12 does not use the term Sensitive Use and does not give its meaning. Version 12 has no Red Teaming item. Version 12 keeps the definition of Red Teaming, but a definition alone creates no requirement. |
| Responsible AI program | Item 54 gives responsibility and accountability for the AI System. Item 58 is an item of its own for the Responsible AI program. Item 61 is about accountability. | Version 11 keeps items 54, 58, and 61 as items 51, 55, and 58. Version 12 has no item of its own for the Responsible AI program. Version 12, item 56, combines responsibility and accountability. Its Evidence of Compliance column continues to show "a document describing the Responsible AI program". |
| AI incident notice | Item 56 starts the notice "upon becoming aware of a Data Incident or a discovered failure that would adversely impact any of the Intended Uses and Sensitive Uses listed for an AI System". | Version 12, item 53, keeps this start condition and the "whichever is sooner" rule, but it gives only the Intended Uses. For the notice rule, see Data Incidents. |
| Prohibited Practice | Version 10 has no item about Prohibited Practice. | Version 12, item 52: "Supplier will not design, develop, place on the market, put into service, or use any AI Systems in connection with your work for Microsoft that are considered a Prohibited Practice." The Version 12 DPR does not give the meaning of Prohibited Practice. |
| AI disclosures and monitoring | Items 59 and 63 to 70 are about transparency, disclosures, and monitoring. Item 67 gives a "standard operating procedure and system health monitoring action plan". Item 68 gives an inventory of monitoring methods. Item 70 is about demographic groups at risk. | Version 12, items 54 and 58 to 63, renumber these items, with some changes to their text. Version 12, item 62, combines items 67 and 68 into one procedure and framework that the supplier "must establish, document, and maintain". Version 12 has no demographic group item. Version 12, item 55, keeps "should" for signed agreements with AI suppliers. |
For the Version 10 AI requirements and their evidence, see AI Systems.
Annual self-attestation
Microsoft makes annual DPR self-attestation mandatory for all suppliers enrolled in SSPA, with independent assurance where applicable (SSPA Program Guide Version 12, March 2026). For deadlines, conditions, and assurance routes, see Annual self-attestation and Independent assessments.
Use Modulos
Modulos has two Frameworks with the name "Microsoft Supplier DPR". OFF-8 is at the Organization level, and MFF-8 is at the AI System level. A Microsoft supplier uses these Frameworks for its own DPR compliance work. For the third parties of the supplier, for example its Subcontractors, use Vendors.
Organization AI Systems
You cannot make a new organization AI System in Modulos. If your organization does not have one, contact Modulos before you add OFF-8.
To use the Microsoft Supplier DPR Frameworks, Modulos recommends these steps. The DPR does not make this sequence of steps in Modulos a requirement.
- Identify your Performance for each contract with Microsoft. See Contracts and data.
- Identify the Microsoft data and the AI Systems in that Performance.
- Select the SSPA Data Processing Profile that agrees with your contracted work. See Data Processing Profile.
- Add
OFF-8to your organization AI System. See Frameworks in Modulos. - Add
MFF-8to each AI System that is part of your Performance for Microsoft. - Set an owner for each Requirement.
- Prepare the self-attestation. Prepare independent assurance when your Data Processing Profile makes it necessary or SSPA requests an independent assessment. See Independent assessments.
The completed SSPA tasks set the SSPA Status and the Data Processing approvals. A record or an export in Modulos does not replace the SSPA submissions in the Microsoft Supplier Compliance Portal. For the documents that you prepare for an independent assessment, see Prepare for independent assessment.
Requirements of the Microsoft Supplier DPR Frameworks
Each Requirement has the same name at the two levels. The items are in DPR Version 10.
| AI System Requirement | Organization Requirement | Requirement name | DPR Version 10 section and items | DPR page |
|---|---|---|---|---|
MRF-202 | ORF-137 | Requirement A: Management | Section A: Management, items 1–6 | Contracts and data, DPR evidence |
MRF-203 | ORF-138 | Requirement B: Notice | Section B: Notice, items 7–8 | Collection and consent |
MRF-204 | ORF-139 | Requirement C: Choice and Consent | Section C: Choice and Consent, items 9–10 | Collection and consent |
MRF-205 | ORF-140 | Requirement D: Collection | Section D: Collection, items 11–13 | Collection and consent |
MRF-206 | ORF-141 | Requirement E: Retention | Section E: Retention, items 14–15 | Retention |
MRF-207 | ORF-142 | Requirement F: Data Subject Rights | Section F: Data Subjects, items 16–24 | Data Subject Rights and data quality |
MRF-208 | ORF-143 | Requirement G: Subcontractors | Section G: Subcontractors, items 25–32 | Subcontractor evidence |
MRF-209 | ORF-144 | Requirement H: Quality | Section H: Quality, item 33 | Data Subject Rights and data quality |
MRF-210 | ORF-145 | Requirement I: Monitoring and Enforcement | Section I: Monitoring and Enforcement, items 34–36 | Data Incidents |
MRF-211 | ORF-146 | Requirement J: Security | Section J: Security, introduction and items 37–52 | Security evidence |
MRF-212 | ORF-147 | Requirement K: AI Systems | Section K: AI Systems, items 53–70 | AI Systems |
For the condition of Section K, see AI Systems. For the Controls that other Frameworks share with these Frameworks, see Control overlap.
FAQ
Microsoft suppliers can find short answers about the DPR, its editions, and SSPA assurance in the Microsoft Supplier DPR FAQ.
Sources
Microsoft suppliers can find the DPR and the SSPA documents here:
- Microsoft, Microsoft Supplier Data Protection Requirements, Version 10, October 2024: Applicability, Key Definitions, Supplier Response, Sections A to K, and the Glossary.
- Microsoft, Microsoft Supplier Data Protection Requirements, Version 11, April 2025: Applicability, Key Definitions, and Sections A, B, C, G, J, and K.
- Microsoft, Microsoft Supplier Data Protection Requirements, Version 12, March 2026: Applicability, Key Definitions, Sections A, B, C, G, J, and K, and the Glossary.
- Microsoft Procurement, Supplier Security & Privacy Assurance (SSPA) Program Guide, Version 12, March 2026: SSPA Program Overview, SSPA Data Processing Profile, Data Processing Role, Artificial Intelligence (AI) Systems, Self-Attestation to the DPR, and Independent Assessment Requirement.
- Microsoft Procurement, SSPA: Supplier Security & Privacy Assurance Program: About SSPA and the SSPA documents.
- Microsoft Learn, Supplier Security and Privacy Assurance (SSPA) program, last updated September 29, 2025: the Important notice.
Disclaimer
This page gives general information. It is not legal advice.