Docs

Appearance

Frequently asked questions about Microsoft Supplier DPR ​

Each answer gives a short rule from the Microsoft Supplier Data Protection Requirements (DPR) or from Supplier Security and Privacy Assurance (SSPA). It gives the conditions that change the rule, and it refers to the section with the full rule and its sources.

Disclaimer

This page gives general information. It is not legal advice.

What is Microsoft Supplier DPR, and is it a law? ​

The Microsoft Supplier DPR is not a law. Microsoft applies its contractual requirements through supplier contracts and SSPA. Its requirements are commitments, while wording such as "should" gives a recommendation (DPR structure).

DPR Version 10, Applicability, gives two rules for disagreement:

  • The DPR takes precedence unless the supplier identifies the contract provision that supersedes the applicable requirement.
  • If the DPR and "legal or statutory requirements" do not agree, "the legal or statutory requirements take precedence".

See Contracts and data for these rules.

Which version of the Microsoft DPR does Modulos use? ​

The Modulos Frameworks use DPR Version 10, October 2024: OFF-8 at Organization level and MFF-8 at AI System level.

Microsoft published Version 11 in April 2025 and Version 12 in March 2026. The SSPA page gives Version 12 as the English DPR download. The Frameworks do not hold these subsequent changes. The publication dates give no Version 12 start date or period for the change (DPR editions).

The assessor uses "the most current DPR", also when the Frameworks use an older edition (SSPA Program Guide Version 12, page 17). See Prepare for independent assessment.

Does Microsoft SSPA apply if we only use AI systems and do not process Microsoft personal data? ​

It can. The Microsoft SSPA page puts in scope all suppliers that "process Personal Data, Microsoft Confidential Data and/or use AI Systems" in connection with their Performance for Microsoft. These suppliers enroll in SSPA with their Microsoft business sponsor.

  • DPR Version 10, which the Modulos Frameworks use, applies only to suppliers that Process Microsoft Personal Data or Microsoft Confidential Data. DPR Version 11 and Version 12 add the use of AI Systems.
  • In all three versions, Section K (AI Systems) applies only to suppliers "providing services to Microsoft involving AI Systems".
  • A supplier that Processes only Microsoft Confidential Data "may have reduced requirements". That is not an automatic exemption.

See Data Processing Profile and AI Systems.

Can a controller or confidential-data-only supplier skip the DPR? ​

No. DPR Version 10 tells a supplier that operates as a Controller, or that Processes only Microsoft Confidential Data, that it "may have reduced requirements". The DPR gives these suppliers no automatic exemption.

  • Microsoft uses the supplier's Data Processing Profile to select the applicable DPR requirements (SSPA Program Guide Version 12).
  • If an issued requirement does not apply to the goods or services, the supplier marks it 'does not apply' with a detailed comment. SSPA reviewers validate that comment. The supplier's decision alone does not mean that SSPA accepts the requirement as inapplicable.
  • The current SSPA scope also includes suppliers that use AI Systems in their Performance.

See Contracts and data and Data Processing Profile.

What is the difference between a subcontractor and a Microsoft subprocessor? ​

The supplier delegates contractual Performance obligations to a Subcontractor, also "a supplier affiliate not contracting directly with Microsoft". Microsoft engages a Subprocessor to Process Microsoft Personal Data for which Microsoft is a Processor (DPR Version 10, Key Definitions).

  • Microsoft assigns the Subprocessor role, which suppliers cannot select or remove. A Subprocessor has an independent assessment each year, subject to the profile 8 alternatives (Program Guide Version 12, pages 6, 11, 16). See Independent assessments.
  • For Subcontractor Processing of Microsoft Personal or Confidential Data, the supplier notifies Microsoft before it subcontracts services or adds or replaces a Subcontractor (DPR Version 10, item 25). The supplier also discloses Subcontractors and the countries where each Processes Personal Data (Program Guide Version 12, page 13). See Subcontractor evidence.

When is Microsoft DPR self-attestation due, and can SSPA extend the deadline? ​

Each enrolled supplier completes annual DPR self-attestation "within 90 days of receiving the request". SSPA cannot extend this deadline (SSPA Program Guide Version 12, pages 15–16).

  • Profile changes can cause more frequent requests. Late attestation makes SSPA Status Red and blocks new in-scope orders until Green.
  • Late profile-change tasks also cause Red status and Accounts Payable deactivation risk after the 90-day period (page 3).
  • The Authorized Representative signs and submits, with a different security contact's Section J sign-off (page 16).

See Annual self-attestation. New suppliers complete issued requirements and get Green status before work starts (page 16).

When does Microsoft require an independent SSPA assessment? ​

SSPA independent assurance depends on the supplier's profile, with self-attestation also necessary (Program Guide Version 12):

  • Independent assurance is mandatory for suppliers in profiles 3–5, 8, and 9, with alternatives for each profile. Subprocessors have an independent assessment each year, subject to the profile 8 alternatives (Program Guide Version 12, pages 4–6 and 16–17). See Independent assessments.
  • AI suppliers add Section K assurance to their profile requirements (Program Guide Version 12, pages 7 and 13–14). See Certification.
  • Payment card Processing adds PCI assurance (pages 6, 11–12). SaaS suppliers supply ISO 27001 or other certification for contracted software services. Page 18 makes ISO 27001 conditional on the Microsoft Cloud Services Agreement (Program Guide Version 12, pages 7, 12, and 18). See Certification.
  • SSPA can make assessment necessary regardless of profile for "additional due diligence", or tell suppliers without an assessment task to give evidence "outside of the annual compliance cycle" (Program Guide Version 12, pages 16–17). See Independent assessments.

Does ISO 27001 or SOC 2 replace the Microsoft DPR assessment? ​

Only in some cases. Microsoft accepts ISO 27001 and SOC 2 for specified DPR assurance requirements, with these conditions:

  • DPR Version 10 accepts "valid ISO 27001 Certification" as an "acceptable substitute" for Section J. The supplier contacts SSPA to apply the substitution and provides the certification.
  • Program Guide Version 12 permits ISO 27001 for profiles 3–4, or combined with ISO 27701 or an independent assessment against Sections A–I for profiles 5, 8, and 9. All profile conditions apply.
  • SSPA can accept SOC 2 for Section J with security trust criteria and no qualifications.
  • For SaaS, page 12 requires ISO 27001 or other certification that applies to the contracted software services. Page 18 says ISO 27001 "may be required" if the Microsoft Cloud Services Agreement requires it, and asks suppliers not to send a datacenter certification (Program Guide Version 12).
  • Section K has its own assurance alternatives.

See Certification (DPR Version 10, page 13) and (Program Guide Version 12, pages 4–7, 12, 17–18).

Is ISO 42001 mandatory for Microsoft AI suppliers? ​

No. Microsoft permits an independent assessment against Section K or ISO 42001 certification. Each supplier that provides AI Systems gives this assurance and completes its other Data Processing Profile requirements (SSPA Program Guide Version 12, pages 7, 13–14).

ISO 42001 does not replace privacy or security assurance for other sections (Independent assessments). Publisher and Deployer are Microsoft's AI profile options, not legal roles. A Publisher "develops, owns, manages, or controls AI Systems that will be provided to Microsoft". A Deployer supplies deployment, integration, or operation services (Program Guide Version 12, pages 13–14). See Data Processing Profile.

Does DPR Version 12 remove the Responsible AI program requirement? ​

Microsoft Supplier DPR Version 12 removes the item, but not all of the documentation. DPR Version 10, item 58, gives this requirement: "Supplier has a Responsible AI program to ensure data compliance through disclosures and documentation". Version 12 has no such item.

  • In Version 12, item 56 (Accountability), the Evidence of Compliance column continues to include "a document describing the Responsible AI program, including accountability and responsibilities of person or group".
  • Item 56 keeps responsibility and accountability "for the operation, oversight, and risk management of AI Systems during and after deployment".
  • The Modulos Frameworks use Version 10, which has item 58.

See DPR Version 10 and Version 12.

Can we assess only one service under a supplier account? ​

Not if the supplier account has other in-scope data processing. The SSPA Program Guide Version 12 sets the scope of an independent assessment as "all in-scope data processing activity executed against the supplier account number which received the request".

  • If one independent assessment covers more than one supplier account, the Letter of Attestation lists all of those accounts.
  • The DPR Version 10 scope follows the Performance for Microsoft. It includes the personnel with access to Microsoft Personal Data or Microsoft Confidential Data (items 3 and 4). It also includes the physical and virtual assets used for Performance, security, and operations (item 39).

See Prepare for independent assessment and Contracts and data.

Do international transfers need Microsoft approval if we have standard contractual clauses? ​

Yes. The supplier gets prior written Microsoft approval for international transfers of Microsoft Personal Data and follows the applicable transfer mechanism (DPR Version 10, International Transfer of Data).

  • Standard Contractual Clauses apply unless Microsoft accepts a different "appropriate" mechanism, with approval by an "appropriate data protection authority" or European Commission as applicable, and Microsoft adoption or agreement.
  • The specified successor Standard Contractual Clauses are "binding on Supplier as of the day of their adoption".
  • The supplier ensures that all clause-defined sub processors also comply.

See International Transfer of Data for these conditions. Item 6 limits Processing to documented Microsoft instructions "unless required to do so by Law". Prior notice applies unless Law prohibits it "on important grounds of public interest" (Documented instructions).

How quickly must a supplier report a data incident to Microsoft? ​

In DPR Version 10, item 34, the supplier's incident response plan requires notice to Microsoft "upon becoming aware of a Data Incident". The earliest contractual, applicable-privacy-law, or "without undue delay" condition applies, with no fixed number of hours in the DPR.

  • The supplier cooperates "at Microsoft's request or direction" (item 34) and implements a remediation plan (item 35).
  • Version 10, item 56, also requires notice "upon becoming aware of a Data Incident or a discovered failure that would adversely impact any of the Intended Uses and Sensitive Uses listed for an AI System". Version 12, item 53, omits Sensitive Uses (AI Systems).
  • The supplier reports through SupplierWeb or [email protected] (Program Guide Version 12, page 18).

See Data Incidents for the notice, cooperation, and remediation conditions.

Does a Modulos export complete Microsoft SSPA approval? ​

No. Completed SSPA compliance activities set the SSPA Status and Data Processing approvals. An export does not send self-attestation or independent assessment.

SSPA Program Guide Version 12 gives these conditions:

  • The Authorized Representative signs and submits through Microsoft's portal with a different security contact's Section J sign-off (page 16).
  • For independent assessment, suppliers use an assessor with the specified qualifications. The assessor uses the most current DPR and prepares an unqualified Letter of Attestation. Suppliers resolve and remediate all noncompliance before submission. Certification alternatives are subject to the applicable profile conditions (pages 4–7, 17).
  • SSPA reviews submissions. New suppliers complete issued requirements and get Green status before work (pages 16–17).

See submission and document conditions. Modulos recommends recording document dates and versions. Suppliers use OFF-8 and MFF-8 for their own compliance work.