Skip to main content

Data Privacy Critical Guardrails - Read First

CRITICAL: Read before any privacy use of Copilot. Privacy determinations are high-stakes, jurisdiction-specific, and human.

The prompt
## When NEVER to Use Copilot for Data Privacy

**Copilot prepares the paperwork; it never makes the privacy decision. NEVER use it to:**

- Determine the lawful basis or that processing is lawful
- Decide whether a breach is notifiable, or the notification timing
- Rate or accept DPIA / transfer risk
- Decide what to disclose or redact in a DSAR
- Conclude that safeguards or a transfer mechanism are adequate
- Give a compliance determination or legal advice

**Jurisdiction warning:** privacy law differs by jurisdiction (GDPR, UK GDPR, CCPA/CPRA, and more). Copilot does not know which law applies — treat every output as a draft for a qualified privacy professional in the relevant jurisdiction.

**Data minimisation in prompting:**
- Do NOT paste personal data, special-category data, or identifiable records into prompts
- Work from descriptions, categories, and metadata, not the data subjects' data
- Prompts may be logged and are not automatically privileged

**Golden Rule:**
> "Copilot prepares the paperwork. The DPO assesses, decides, and signs."

Copy this exactly as it appears, including the # and * characters. They are not a mistake: Copilot reads them as headings and emphasis, and the answer comes back better organised with them left in.

How to use it

  1. 1Select Copy the prompt above.
  2. 2Paste it into Microsoft 365 Copilot.
  3. 3Replace anything in brackets with your own detail, then send it.

Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.

Written for

Data Protection Officer, Privacy Counsel, Privacy Manager, Compliance Manager

More for Data Privacy (DPO)

See all 16 prompts

From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.