When the DPR applies

Microsoft applies the Microsoft Supplier Data Protection Requirements (DPR) to its suppliers through their contracts and the Supplier Security and Privacy Assurance (SSPA) Program. The DPR is not a law (How to think about supplier requirements).

The Modulos Frameworks MFF-8 and OFF-8 adapt DPR Version 10, October 2024. Microsoft published DPR Version 12 in March 2026 (DPR Version 10 and Version 12).

The sections below give the Version 10 provisions, unless a section names a different edition. The SSPA procedures come from the SSPA Program Guide, Version 12, March 2026, which is the current Program Guide.

Contracts and data

In its Applicability text, DPR Version 10 applies to each Microsoft supplier that Processes Microsoft Personal Data or Microsoft Confidential Data "in connection with that supplier’s performance (e.g., provision of services, software licenses, cloud services) under the terms of its contract with Microsoft (e.g., Purchase Order terms, master agreement)". The DPR calls this work "Performance".

For the agreement and sanctions requirements, read Section A, items 1, 2, and 5, in DPR Version 10 (pages 4 and 5).

Data and roles

DPR Version 10 (Key Definitions) gives these definitions:

Term	Version 10 definition
Microsoft Personal Data	"any Personal Data Processed by or on behalf of Microsoft"
Personal Data	Information about a Data Subject, and all other information that is personal data or personal information in Law
Data Subject	"an identifiable natural person who can be identified, directly or indirectly". The examples include a name, an identification number, location data, and an online identifier.
Microsoft Confidential Data	"any information which, if compromised through confidentiality or integrity means, can result in significant reputational or financial loss for Microsoft". The definition continues: "This includes Microsoft hardware and software products, internal line-of-business applications, pre-release marketing materials, product license keys, and technical documentations related to Microsoft products and services."
Process	"any operation or set of operations which is performed on any Microsoft Personal Data or Confidential Data, whether or not by automated means". The examples include collection, storage, use, disclosure, erasure, and destruction, so Processing is more than storage.
Controller	"the entity that determines the purposes and means of the Processing of Personal Data". The definition includes "a Business, Controller (as that term is defined in the GDPR), and equivalent terms in Data Protection Laws, as context requires".
Processor	"an entity that Processes Personal Data on behalf of another entity and includes Service Provider, Processor (as that term is defined in the GDPR), and equivalent terms in Data Protection Laws, as context requires"
Law	"all applicable laws, rules, statutes, decrees, decisions, orders, regulations, judgments, codes, enactments, resolutions, and requirements of any government authority (federal, state, local, or international) having jurisdiction"

Reduced requirements

DPR Version 10 (Applicability) gives two conditions where a supplier "may have reduced requirements":

• The supplier "operates as a Controller".
• The supplier "does not Process Microsoft Personal Data but only Microsoft Confidential Data".

These two conditions are not automatic exemptions. The SSPA Data Processing Profile sets which requirements Microsoft issues to the supplier (Data Processing Profile).

If the DPR does not agree with a contract or with law

DPR Version 10 (Applicability) gives two rules:

• DPR and contract — If the DPR and the contract between the supplier and Microsoft do not agree, the DPR "takes precedence unless the supplier identifies the correct provision in the contract that supersedes the applicable data protection requirement". In that condition, "the terms of the contract take precedence".
• DPR and law — If the DPR does not agree with "any legal or statutory requirements", then "the legal or statutory requirements take precedence".

The SSPA Program Guide, Version 12 (Self-Attestation to the DPR), gives the current SSPA procedure. The SSPA team reviews each "local legal conflict" or "contractual conflict" selection in a DPR submission. The Program Guide adds: "Local legal and contract conflicts are only accepted if supporting references are provided and the conflict is clear."

Documented instructions

DPR Version 10, item 6, tells the supplier to Process Microsoft Personal Data only in accordance with Microsoft’s documented instructions, "unless required to do so by Law". These instructions include transfers of Microsoft Personal Data to a third country or an international organization. If Law makes the Processing necessary, the supplier informs Microsoft of that legal requirement before the Processing, "unless that Law prohibits such information on important grounds of public interest".

The Evidence of Compliance column of item 6 tells the supplier to keep the documented instructions of Microsoft and its privacy and security policies and procedures electronically, "in an easily accessible location to supplier’s employees and contractors participating in the Performance".

Personnel and assets

DPR Version 10 covers the personnel and assets used for Performance: see DPR evidence (items 3–4) and Security evidence (items 39, 46–47). The scope of an independent assessment in the SSPA Program Guide, Version 12, is "all in-scope data processing activity executed against the supplier account number which received the request" (Prepare for independent assessment).

AI Systems

DPR Version 10 (Applicability) gives a condition for Section K: "Section K of the DPR is only applicable to suppliers providing services to Microsoft involving AI Systems." This condition is different from the general applicability test in Contracts and data. DPR Version 11 and Version 12 keep the same condition for Section K.

In DPR Version 10, an AI System is "an engineered system that applies an optimized model". The system can make predictions, recommendations, or decisions that influence the environments that it interacts with, for a given set of human-defined objectives.

DPR Version 11 and Version 12 also apply the DPR to a supplier that uses AI Systems in connection with its Performance. DPR Version 10 does not have this part of the applicability test (DPR Version 10 and Version 12).

The current SSPA scope also includes suppliers that use AI Systems (Current SSPA scope). The Section K provisions of Version 10 are on AI Systems. The independent assurance for Section K is on Independent assessments.

Subcontractors and Subprocessors

DPR Version 10 (Key Definitions) gives two different actors:

Actor	Engaged by	Version 10 definition
Subcontractor	The supplier	"a third-party to whom supplier delegates its obligations in connection with the contract covering their Performance, including a supplier affiliate not contracting directly with Microsoft"
Subprocessor	Microsoft	"a third party that Microsoft engages to Perform, where the Performance includes Processing of Microsoft Personal Data for which Microsoft is a Processor"

A supplier affiliate is a Subcontractor when the supplier delegates its obligations to it, also without its own contract with Microsoft. The term Subprocessor does not mean the Subcontractors of a supplier.

The SSPA Program Guide, Version 12 (Use of Subcontractors), gives the current SSPA procedure. A supplier selects the Use of Subcontractors approval "if supplier uses Subcontractors to Perform". The Program Guide adds: "This also includes Freelancers (see DPR)." DPR Version 10 (Glossary) defines a Freelancer as "individuals performing on-demand tasks or services, which are procured through digital platforms or other means".

Microsoft sets the Subprocessor role, and a supplier cannot select it (Independent assessments). The Section G duties for Subcontractors, and the disclosure of Subcontractors in SSPA, are on Subcontractor evidence.

International Transfer of Data

DPR Version 10 gives this clause for international transfers:

Without limiting its other obligations, supplier will not make any international transfer of Microsoft Personal Data unless Microsoft provides prior written approval, and in any event, supplier shall comply with the Data Protection Requirements, including the Standard Contractual Clauses, or, at Microsoft’s discretion, other appropriate cross-border transfer mechanisms approved by an appropriate data protection authority or the European Commission, as applicable, and adopted or agreed to by Microsoft. Successor Standard Contractual Clauses adopted by (i) the European Commission or adopted by the European Data Protection Supervisor and approved by the European Commission, (ii) the United Kingdom pursuant to the UK General Federal Data Protection Act, (iii) Switzerland pursuant to the Swiss Federal Data Protection Act, or (iv) clauses governing the international transfer of personal data officially adopted by a government in a jurisdiction other than Switzerland, the United Kingdom, and the jurisdictions comprising the European Union / European Economic Area, shall be incorporated and binding on Supplier as of the day of their adoption. Supplier shall also ensure that any and all sub processors (as defined in the Standard Contractual Clauses) also comply.

Item 6 also includes transfers in the documented instructions of Microsoft (Documented instructions).

Data Processing Profile

The SSPA Program Guide, Version 12 (SSPA Program Overview and SSPA Data Processing Profile), gives the current SSPA procedure for the Data Processing Profile:

• The supplier makes Data Processing Profile selections that "align to the goods and/or services you are contracted to Perform". The Program Guide adds: "These selections trigger corresponding requirements to provide compliance assurances to Microsoft."
• The Data Processing Profile "determines whether the full DPR is issued or if a subset of requirements applies".
• Microsoft checks that data processing for the work matches the supplier’s approvals before work starts.
• The Microsoft group "responsible for the engagement with supplier" can also set "additional organizational level requirements", independently of SSPA.

Current SSPA scope

The Microsoft Procurement SSPA page (undated) gives the current scope of SSPA: "all suppliers globally, that process Personal Data, Microsoft Confidential Data and/or use AI Systems in connection with that supplier’s performance". A supplier in this scope works with its Microsoft business sponsor to enroll in SSPA. For a new supplier, work cannot start before the SSPA compliance cycle is complete (Before work starts).

The data examples in the SSPA Program Guide, Version 12, are "examples and not an exhaustive list". A Microsoft business owner "may ask for enrollment outside of this list considering the confidential nature of the data processed". A Microsoft business owner also "may require participation for data not included in this list".

Data Processing Profile selections

The SSPA Program Guide, Version 12, gives these Data Processing Profile selections:

Selection	Current meaning in the SSPA Program Guide, Version 12
Scope: Confidential	Performance involves Processing of only Microsoft Confidential Data. With this selection, the supplier is not eligible for Personal Data processing engagements.
Scope: Personal & Confidential	Performance involves Processing of Personal Data and Microsoft Confidential Data.
Processing Location: At Microsoft or Customer	All Performance is Processing in the Microsoft network environment with @microsoft.com credentials, or in the environment of a Microsoft customer. This selection is not correct when "Supplier manages a Microsoft designated offshore facility (OF)." It is also not correct when the resources of the supplier sometimes work off the Microsoft network.
Processing Location: At Supplier	All other conditions.
Data Processing Role: Controller	Select it "if all aspects of Performance by supplier meet the Controller data processing role definition (see DPR)". The Program Guide adds: "If supplier is both a Processor and a Controller to Microsoft, do not select ‘Controller,’ select Processor."
Data Processing Role: Processor	"the most common processing role when suppliers Process data on behalf of Microsoft"
Data Processing Role: Subprocessor	Microsoft assigns this role (Independent assessments).
Highly Confidential Data	The supplier Processes Microsoft Highly Confidential Data. Examples include sensitive Personal Data, Protected Health Information, and unannounced Microsoft corporate financial data subject to SEC rules.
Payment Cards	Part of the data that the supplier Processes supports payment card processing on behalf of Microsoft.
Software as a Service (SaaS)	The supplier is a Software as a Service (SaaS) supplier, as the Program Guide defines SaaS. "Most SaaS suppliers will need to add the Subcontractor approval in the Microsoft Supplier Compliance Portal if the Personal Data or Microsoft Confidential data is hosted on a 3rd party platform or cloud infrastructure provider."
Use of Subcontractors	The supplier uses Subcontractors to Perform (Subcontractors and Subprocessors).
Website Hosting	The supplier hosts websites, or supplies website portals, online services, or mobile applications, on behalf of Microsoft.
Healthcare	The supplier "is required to process Protected Health Information".
AI Systems: Publisher or Deployer	See Publisher and Deployer.

The independent assurance that each Data Processing Profile causes is on Independent assessments and Certification.

Publisher and Deployer

The SSPA Program Guide, Version 12 (Artificial Intelligence (AI) Systems), gives two Data Processing Profile options for AI Systems:

• Publisher — The supplier "develops, owns, manages, or controls AI Systems that will be provided to Microsoft".
• Deployer — The supplier "will provide services to Microsoft involving the deployment, integration, or operation of AI Systems, including configuring, hosting, or managing AI Systems for use by Microsoft employees, customers, or the public".

These options are SSPA options. They are not the roles that the EU AI Act defines.

Changes to the Data Processing Profile

The SSPA Program Guide, Version 12 (SSPA Data Processing Profile), gives these rules for a change to the Data Processing Profile:

• The supplier can update its Data Processing Profile "at any point, if there are no open tasks".
• A change issues new tasks. The supplier completes them before the new approvals show in the Data Processing Profile.
• "The existing, completed approvals will apply until newly issued requirements are completed."

For the deadline and what happens if the supplier does not complete the tasks on time, see Annual self-attestation.

Requirements that do not apply

The SSPA Program Guide, Version 12 (Self-Attestation to the DPR), gives this rule: "Suppliers are expected to respond to all applicable DPR requirements issued per the Data Processing Profile." If an issued requirement does not apply to the goods or services of the supplier, the supplier can mark it "does not apply". The supplier adds "a detailed comment for SSPA reviewers to validate". The SSPA team reviews these selections: "The SSPA team may ask for clarification of one or more selections."

An internal decision of the supplier that a requirement does not apply does not show that Microsoft accepts it. The submission steps are on Annual self-attestation.

Collection and consent

DPR Version 10, Sections B (Notice), C (Choice and Consent), and D (Collection), give the duties of a supplier when it collects data. Each item has a requirement and an Evidence of Compliance column:

Item	Version 10 requirement	Conditions and evidence
7	"The supplier must use the Microsoft Privacy Statement when collecting Personal Data on Microsoft’s behalf." The privacy notice "must be obvious and available to Data Subjects".	Item 7 also adds: "Where your company is the Controller of the Processing activity, you would post your own privacy notice." For Microsoft employee services, the evidence column names the Microsoft Data Privacy Notice.
8	When the supplier collects Microsoft Personal Data "via a live or recorded voice call", it "must be prepared to discuss the applicable data collection, handling, use, and retention practices with Data Subjects".	The evidence is a script for voice recordings that includes collection, use, and retention.
9	"Where applicable", the supplier obtains and records the consent of a Data Subject for all its Processing activities, new and updated activities included, before it collects the Personal Data of that Data Subject.	The supplier monitors preference management. The time to honor a preference change is "the most restrictive local legal requirement that applies".
10	"Suppliers that create and manage Microsoft websites and/or applications or sites that carry Microsoft branding must provide Data Subjects with transparent notice and choice regarding the use of cookies in alignment with commitments in the Microsoft Privacy Statement and local legal requirements."	Item 10 applies when sites target users in the European Union/European Economic Area and other regions with applicable privacy laws. It also applies wherever the Microsoft Privacy Statement is used. "Unless specifically requested not to by the contracting business unit, suppliers should use the Standard Banner produced by 1ES to manage choice controls."
11	The supplier monitors the collection of Microsoft Personal Data or Microsoft Confidential Data, so it collects only the data "required to Perform".	The supplier gives the documentation to Microsoft "upon request".
12	Before it collects data from children, as the applicable jurisdiction defines them, the supplier obtains consent "per local privacy laws".	The evidence is documentation of parent or guardian consent.
13	If the supplier receives a data set from Microsoft with reduced identifiability, it keeps the data "in the state in which it was received".	Reduced identifiability includes pseudonymous, Not in a Position to Identify (NPI), unlinked pseudonymous, aggregate, and anonymous data, and related terms such as de-identified. The supplier does not increase the identifiability of the data sets. It has a de-identification or anonymization policy or process.

The Evidence of Compliance column of item 10 also gives these cookie conditions:

• "Persistent cookies must not be used when session cookies suffice."
• "When persistent cookies are used, they must not have an expiration date that exceeds 13 months after a user has visited the site."
• For EU Laws, as applicable, the column names "Privacy & Cookies" as the name of the privacy statement. It also names affirmative user consent before the use of cookies that are not essential, for example for advertising.
• For EU Laws, as applicable, consent "must expire or be re-obtained no longer than every 6 months".

Retention

DPR Version 10, Section E (Retention), gives these duties of a supplier:

• Item 14 — The supplier keeps Microsoft Personal and Confidential Data "for no longer than necessary to Perform", "unless continued retention of the Microsoft Personal and/or Confidential Data is required by Law". The evidence column refers to documented retention policies, or to retention requirements that Microsoft specifies in the contract.
• Item 15, returned or destroyed data — The supplier ensures that, "at Microsoft’s sole discretion", Microsoft Personal and Confidential Data "in the supplier’s possession or under its control is returned to Microsoft or destroyed upon completion of Performance or upon Microsoft’s request".
• Item 15, applications — "Within applications, processes must be in place to ensure that when data is removed from the application either explicitly by users or based on other triggers like the age of the data, that it is securely deleted."
• Item 15, physical assets — When destruction is necessary, the supplier burns, pulverizes, or shreds the physical assets that contain the data. Then nobody can read or reconstruct the information.

The evidence column of item 15 tells the supplier to "Maintain a record of disposition of Microsoft Personal and Confidential Data". It adds: "If destruction is required or requested by Microsoft, provide a certificate of destruction signed by an officer of the supplier."

Data Subject Rights and data quality

DPR Version 10, Section F (Data Subjects), applies when a Data Subject wants to use the rights that Law gives for the Microsoft Personal Data of that Data Subject. The supplier "must enable Microsoft to do the following or perform these actions on Microsoft’s behalf". A Data Subject Right is "a Data Subject’s right to access, delete, edit, export, restrict, or object to Processing of the Microsoft Personal Data of that Data Subject if required by Law".

Item	Version 10 requirement
16	The supplier helps Microsoft, through "appropriate technical and organizational measures, where possible", "to fulfil its obligations to respond to requests for Data Subjects seeking to exercise their Data Subject Rights without undue delay". Unless Microsoft gives other directions, the supplier refers to Microsoft all Data Subjects who contact the supplier directly.
17	When the supplier replies directly to the Data Subject, or gives a self-service online mechanism, it has processes to identify "the Data Subject making the request".
18	If Microsoft tells the supplier to find data that is not available through a self-service online mechanism, the supplier makes "a reasonable effort to locate the data requested". It also keeps "sufficient records to demonstrate that a reasonable search was made".
19	The supplier tells the Data Subject the steps to get access to the Microsoft Personal Data, or to use the other rights.
20	The supplier records the date and time of "Data Subject Rights requests", and its actions in reply. "If their request is denied, at Microsoft’s direction, provide the Data Subject with a written explanation." The supplier gives the records to Microsoft "upon request".
21	The supplier enables Microsoft to supply a copy of the requested Microsoft Personal Data, or gets the copy for the authenticated Data Subject, "in an appropriate printed, electronic, or verbal format".
22	The supplier takes "reasonable precautions to ensure that Microsoft Personal Data released to Microsoft or an authenticated Data Subject cannot be used to identify another person".
23	If a Data Subject thinks that the data is not complete and accurate, the supplier escalates the issue to Microsoft. It cooperates with Microsoft "as necessary to resolve the issue".
24	For access requests, the supplier keeps a record of all recipients with whom it shared, or will share, Microsoft Personal Data.

DPR Version 10, Section H (Quality), item 33, gives this duty: "The supplier must maintain the integrity of all Microsoft Personal Data, ensuring it remains accurate, complete, and relevant for the stated purposes for which it was Processed." In the evidence column, the supplier can show that "procedures are in place to validate Microsoft Personal Data when it is collected, created, and updated". The supplier can also show that "monitoring, review of information system activity and sampling procedures are in place to verify accuracy on an on-going basis and correct, as necessary".

Next steps

• The page Evidence and audits gives the SSPA conditions before work starts, the annual self-attestation, independent assessments, and certification. It also gives the Version 10 evidence for Sections A, G, I, J, and K.
• The page Microsoft Supplier DPR gives the Frameworks MFF-8 and OFF-8, the Requirement table, and the steps that Modulos recommends.
• The page Frequently asked questions about Microsoft Supplier DPR refers each question to the page with the full rules.

Sources

• Microsoft, Microsoft Supplier Data Protection Requirements, Version 10, October 2024. Provisions used: Applicability, International Transfer of Data, Key Definitions, Sections A, B, C, D, E, F, and H, Section J (items 39, 46, and 47), and Glossary.
• Microsoft, Microsoft Supplier Data Protection Requirements, Version 11, April 2025. Provision used: Applicability.
• Microsoft, Microsoft Supplier Data Protection Requirements, Version 12, March 2026. Provision used: Applicability.
• Microsoft Procurement, Supplier Security & Privacy Assurance (SSPA) Program Guide, Version 12, March 2026. The sections used are SSPA Program Overview, SSPA Data Processing Profile, Scope, Microsoft Highly Confidential Data, Processing Location, and Data Processing Role. Also Payment Card Processing, Software as a Service (SaaS), Use of Subcontractors, Website Hosting, and Healthcare. Also Artificial Intelligence (AI) Systems, Self-Attestation to the DPR, and Independent Assessment Requirement.
• Microsoft Procurement, "SSPA: Supplier Security & Privacy Assurance Program" (undated). The sections used are "What is the Supplier Security and Privacy Assurance (SSPA) Program?" and "When is a supplier in scope for SSPA?".

Disclaimer

This page gives general information. It is not legal advice.