{"id":129027,"date":"2026-05-30T18:00:20","date_gmt":"2026-05-30T18:00:20","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/05\/30\/microsofts-dpa-update-cuts-ai-subprocessor-notice-to-30-days\/"},"modified":"2026-05-30T18:01:21","modified_gmt":"2026-05-30T18:01:21","slug":"microsofts-dpa-update-cuts-ai-subprocessor-notice-to-30-days","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/05\/30\/microsofts-dpa-update-cuts-ai-subprocessor-notice-to-30-days\/","title":{"rendered":"Microsoft’s DPA update cuts AI subprocessor notice to 30 days"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Microsoft this month quietly modified a contract that governs the way it handles buyer information. The <\/em>update<\/em><\/a> shortens the advance warning firms obtain earlier than Microsoft can usher in a brand new AI vendor with entry to their information – from six months right down to 30 days. Printed on Might 22, 2026, the change sits inside a authorized doc most advertising groups have by no means learn, nevertheless it has direct penalties for anybody whose organisation runs Microsoft 365, Azure, or Microsoft Promoting.<\/em><\/p>\n

What the contract is and why it issues<\/h2>\n

Each enterprise that buys Microsoft cloud companies – whether or not Microsoft 365, Azure, Dynamics 365, or Microsoft Promoting – indicators as much as a contract referred to as the Merchandise and Companies Knowledge Safety Addendum. Microsoft calls it a DPA for brief. It isn’t a product. It’s the authorized settlement that units out what Microsoft is and isn’t allowed to do with the information clients give it: what it could actually retailer, how lengthy it could actually preserve it, who it could actually share it with, and what occurs if one thing goes unsuitable.<\/p>\n

That contract issues for advertising groups for a easy purpose. When an organization runs promoting campaigns by way of Microsoft Promoting, uploads buyer lists to Azure, or makes use of Copilot in Microsoft 365 to course of communications and paperwork, that information sits inside Microsoft’s infrastructure. The DPA is the doc that spells out the principles Microsoft should comply with when dealing with it.<\/p>\n

The change revealed on Might 22, 2026, provides a brand new rule particularly for synthetic intelligence. It’s a single paragraph in a 40-page doc. However its implications run additional than its size suggests.<\/p>\n

What a subprocessor is – and why the discover interval issues<\/h2>\n

To know the change, it helps to grasp one piece of authorized terminology: a subprocessor. In plain phrases, when an organization offers its information to Microsoft, Microsoft doesn’t essentially course of all of that information itself. It hires different specialist firms – cloud infrastructure suppliers, AI mannequin builders, security analysis instruments, information analytics distributors – to deal with particular components of the work. These employed firms are referred to as subprocessors.<\/p>\n

Beneath European information safety regulation – particularly GDPR Article 28 – firms that hand their information to Microsoft stay legally chargeable for what occurs to that information, even when Microsoft passes it to one among its subprocessors. Meaning if Microsoft brings in a brand new AI vendor with entry to buyer information and that vendor mishandles it, the enterprise buyer could be held accountable too, not solely Microsoft. The enterprise is the\u00a0information controller<\/strong>\u00a0– the celebration that decides why and the way information is used. Microsoft is the\u00a0information processor<\/strong>\u00a0– the celebration that handles it on the controller’s behalf.<\/p>\n

That is why the discover interval issues. If Microsoft desires to herald a brand new subprocessor with entry to buyer information, it has to inform clients prematurely, giving them time to evaluate whether or not the brand new vendor meets their information safety requirements – and, if not, to object or exit the contract.<\/p>\n

Till now, the minimal discover for many new subprocessors was six months. That gave authorized, privateness, and procurement groups cheap time to run a vendor evaluation, replace their very own inner data, and resolve whether or not to just accept the change or terminate the contract.<\/p>\n

What modified on Might 22<\/h2>\n

In accordance with the up to date Knowledge Safety Addendum revealed by Microsoft on Might 22, 2026, there’s now a second, shorter observe particularly for subprocessors that help synthetic intelligence performance. The brand new textual content reads: “Microsoft will give Buyer discover and, as relevant, replace the web site and supply Buyer with a mechanism to acquire discover of that replace of any new Subprocessor a minimum of 6 months prematurely of offering that Subprocessor with entry to Buyer Knowledge or for subprocessors that help synthetic intelligence performance, 30 days’ discover with the power to disable use of that subprocessor till a minimum of 6 months after discover.”<\/p>\n

In plain phrases: Microsoft can now introduce a brand new AI vendor into the processing chain with solely 30 days’ warning, relatively than six months. Prospects retain the fitting to disable that vendor’s entry within the interim – however solely till six months after the discover was issued. After that, the choice to dam the seller expires.<\/p>\n

The doc’s personal abstract of the change is unassuming. It reads merely: “Added clarification of subprocessors that help synthetic intelligence performance within the Discover and Controls on use of Subprocessors part.” That framing – clarification – doesn’t absolutely seize that this creates a brand new, faster-moving observe that didn’t beforehand exist as a proper class.<\/p>\n

Two tracks, two timelines<\/h2>\n

The up to date addendum now operates on two distinct timelines working facet by facet.<\/p>\n

For typical, non-AI subprocessors – conventional software program distributors, infrastructure suppliers, information storage firms – Microsoft nonetheless commits to a minimum of six months’ advance discover earlier than giving them entry to buyer information. That timeline stays unchanged.<\/p>\n

For subprocessors that help AI performance – which might embody the businesses offering the underlying language fashions behind Copilot, the infrastructure working Azure AI companies, security analysis instruments, or agentic orchestration layers – the discover interval is now 30 days. The addendum defines a subprocessor broadly: “different processors utilized by Microsoft to course of Buyer Knowledge, Skilled Companies Knowledge, and Private Knowledge.” Any third-party firm in that chain, if it touches AI performance, falls beneath the shorter observe.<\/p>\n

Microsoft’s service ecosystem is giant. Enterprise merchandise comparable to Microsoft 365, Azure, and Dynamics 365 contain dozens of underlying distributors.\u00a0Microsoft’s AI business reached a $37 billion annual run rate<\/a>\u00a0as of April 2026, with Copilot queries per consumer rising practically 20% quarter-over-quarter. AI shouldn’t be peripheral to those merchandise. It’s more and more central to how they perform.<\/p>\n

Why the discover interval is shorter for AI<\/h2>\n

The plain purpose is that AI infrastructure adjustments sooner than conventional software program. Mannequin suppliers launch new variations. Security analysis instruments get changed. Agentic options – AI programs that may take actions on a consumer’s behalf – enter processing chains on timelines {that a} six-month notification cycle can’t accommodate.<\/p>\n

Oliver Schmidt-Prietz, a knowledge, AI, privateness, and digital lawyer, and authorized AI engineer, posted an evaluation of the addendum change on LinkedIn, calling it “a sensible sign.” In accordance with Schmidt-Prietz, “AI provide chains transfer sooner than basic SaaS vendor governance. Mannequin suppliers, infrastructure suppliers, analysis tooling, security layers and agentic options might enter the processing chain on shorter cycles.”<\/p>\n

Schmidt-Prietz framed the change as a direct problem to how most organisations at present run compliance: “If a key cloud supplier can introduce AI-related subprocessors on a 30-day cycle, the inner assessment course of can’t nonetheless function like an annual vendor refresh.”<\/p>\n

What the exit possibility really means in observe<\/h2>\n

The addendum offers clients a proper proper to reject a brand new subprocessor. In accordance with the doc, if a buyer doesn’t approve of a brand new subprocessor for an On-line Service or Skilled Companies, “then Buyer might terminate any subscription for the affected On-line Service or the relevant Statements of Service for the relevant Skilled Service, respectively, with out penalty or termination payment by offering, earlier than the tip of the related discover interval, written discover of termination.”<\/p>\n

For software program licenses, the brink is barely completely different. If the client can’t fairly keep away from utilizing the subprocessor, it might terminate the affected license with out penalty. If the product is a part of a set, “any termination will apply to the complete suite.”<\/p>\n

In observe which means that rejecting an AI subprocessor throughout the 30-day window might require terminating a whole Microsoft 365 subscription – e-mail, Groups, SharePoint, OneDrive, and all productiveness instruments bundled with it. The fitting to exit with out penalty exists within the contract. The operational and industrial value of truly doing so is, for many enterprise clients, prohibitively excessive.<\/p>\n

The compliance clock is now tighter<\/h2>\n

Massive organisations working beneath GDPR are usually required to run a proper privateness danger evaluation – referred to as a Knowledge Safety Influence Evaluation, or DPIA – earlier than permitting a brand new vendor to course of high-risk private information. The EDPB, the EU physique that coordinates nationwide information safety regulators,\u00a0adopted its first standardised DPIA template on 10 March 2026<\/a>, opening a public session till 9 June 2026.<\/p>\n

A correct DPIA includes figuring out what information the brand new vendor will contact, assessing whether or not that processing is critical and proportionate, estimating the danger to people, documenting mitigating measures, and acquiring sign-off from the organisation’s Knowledge Safety Officer. In organisations the place authorized, procurement, IT, and product groups all have a job in that call, 30 days is a decent window.<\/p>\n

Schmidt-Prietz recognized 5 questions that the addendum change forces inner groups to reply – shortly and concretely: who displays Microsoft subprocessor notices; who decides whether or not a brand new AI subprocessor is appropriate; can the enterprise really disable the affected performance; does the DPIA or vendor-risk file get up to date inside 30 days; and who owns the choice when AI performance is already embedded in business-critical instruments.<\/p>\n

None of these questions is new. What the addendum change does is compress the time obtainable to reply them.<\/p>\n

Regulatory context: German and Austrian regulators, and the AI Act<\/h2>\n

The addendum change doesn’t exist in a regulatory vacuum.<\/p>\n

Germany’s Hessian Data Protection Commissioner concluded in November 2025<\/a>\u00a0that Microsoft 365 might function inside GDPR after a three-year negotiation course of that recognized seven deficiencies in Microsoft’s earlier information processing agreements. A kind of deficiencies was inadequate advance notification about subprocessor adjustments. On the time, Microsoft’s repair was to take care of an in depth subprocessor record on its Service Belief Portal and commit to 6 months’ discover for many distributors. The Might 2026 replace now creates a proper, shorter observe for AI distributors particularly – a class that hardly featured in negotiations that started in 2022.<\/p>\n

Austria’s data protection authority ordered Microsoft to stop tracking school children in February 2026<\/a>, discovering that Microsoft US – not Microsoft Eire, which handles EU contracts – controls product growth and implementation. That issues for advertising groups as a result of it bolstered the precept that the enterprise buyer, as information controller, carries regulatory accountability for what occurs contained in the Microsoft provide chain, not solely Microsoft itself.<\/p>\n

The EU AI Act provides one other layer. Its obligations for general-purpose AI suppliers took impact in August 2025. Necessities for high-risk AI programs change into absolutely enforceable in August 2026. Microsoft has signalled willingness to signal the EU’s voluntary Normal-Goal AI Code of Observe, which\u00a0PPC Land covered in July 2025<\/a>. The addendum doesn’t point out the AI Act by title, however the structural logic of the 30-day AI subprocessor observe displays the Act’s underlying premise: that AI programs are usually not static, and their provide chains want room to evolve.<\/p>\n

The\u00a0EDPB’s 2025 annual report<\/a>, revealed in April 2026, recorded 1.15 billion euros in GDPR fines throughout EU member states throughout 2025 alone. Joint pointers on the interaction between the AI Act and GDPR are deliberate for publication all through 2026. The enforcement setting wherein this addendum change lands is energetic, not theoretical.<\/p>\n

What the addendum doesn’t change<\/h2>\n

A number of protections within the addendum stay unchanged and apply throughout the complete subprocessor chain, together with any new AI distributors.<\/p>\n

In accordance with the addendum, Microsoft won’t use or course of buyer information for consumer profiling, promoting, or market analysis – no matter which subprocessors are concerned. Knowledge in transit between the client and Microsoft, or between Microsoft information centres, is encrypted by default. Safety measures mapped to ISO 27001, ISO 27002, and ISO 27018 stay in place. Microsoft is required to inform clients of a safety incident inside 72 hours.<\/p>\n

On regulation enforcement requests, the addendum states Microsoft won’t disclose buyer information to regulation enforcement except required by regulation, will try to redirect businesses to request information instantly from the client, and can promptly notify clients if compelled to reveal – except legally prohibited from doing so.<\/p>\n

What this implies for advertising and advert tech groups<\/h2>\n

Advertising groups working campaigns by way of Microsoft Promoting, utilizing Azure AI for viewers segmentation or inventive era, or counting on Microsoft 365 Copilot for day-to-day operations are all affected by this transformation. Their organisations’ information flows by way of Microsoft infrastructure that now contains AI subprocessors probably topic to 30-day discover cycles.<\/p>\n

The compliance burden falls on the enterprise, not simply on Microsoft. If a brand new AI subprocessor is launched and buyer information is later discovered to have been mishandled, the enterprise – as information controller – shares accountability beneath GDPR. Meaning monitoring subprocessor notices is now an operational process, not an annual one.<\/p>\n

For EU-based advertising groups or these dealing with EU consumer information, a brand new AI subprocessor might set off a number of concrete obligations: updating inner privateness notices, revising data of processing actions beneath GDPR Article 30, and reassessing whether or not information transfers to any new vendor exterior the European Financial Space are lined by satisfactory authorized mechanisms comparable to Normal Contractual Clauses or the EU-US Knowledge Privateness Framework.<\/p>\n

The sensible takeaway from the addendum change is that this:\u00a0AI governance<\/strong>\u00a0is now embedded in contract change administration. Someone within the organisation must be studying Microsoft’s subprocessor notices each month, not yearly.<\/p>\n

Timeline<\/h2>\n
    \n
  • Might 2018<\/strong>\u00a0– GDPR enters into power throughout the EU, establishing the information safety framework that governs Microsoft’s buyer information obligations<\/li>\n
  • September 15, 2022<\/strong>\u00a0–\u00a0Microsoft publishes a Data Protection Addendum that German authorities later determine fails GDPR Article 28 requirements<\/a><\/li>\n
  • July 17, 2024<\/strong>\u00a0–\u00a0EDPB recommends that national data protection regulators – the EU authorities responsible for enforcing GDPR in each member state – serve as AI market surveillance authorities<\/a>\u00a0beneath the AI Act framework<\/li>\n
  • August 6, 2025<\/strong>\u00a0–\u00a0Microsoft Advertising publishes research showing Copilot generates 73% higher click-through rates<\/a>\u00a0in comparison with conventional search, illustrating how deeply AI is embedded in Microsoft’s industrial merchandise<\/li>\n
  • August 2025<\/strong>\u00a0– EU AI Act obligations for general-purpose AI mannequin suppliers take impact<\/li>\n
  • July 20, 2025<\/strong>\u00a0–\u00a0Microsoft signals willingness to sign the EU General-Purpose AI Code of Practice<\/a>\u00a0whereas Meta refuses<\/li>\n
  • November 15, 2025<\/strong>\u00a0–\u00a0Germany’s Hessian Data Protection Commissioner concludes Microsoft 365 can operate within GDPR<\/a>\u00a0after three-year negotiations addressing seven deficiencies, together with subprocessor notification<\/li>\n
  • February 2, 2026<\/strong>\u00a0–\u00a0Austria’s data protection regulator orders Microsoft to stop tracking school children<\/a>, discovering that Microsoft US – not Microsoft Eire – controls product choices<\/li>\n
  • March 10, 2026<\/strong>\u00a0–\u00a0EDPB adopts its first standardised DPIA template<\/a>, opening a public session till 9 June 2026<\/li>\n
  • April 9, 2026<\/strong>\u00a0–\u00a0EDPB publishes its 2025 annual report<\/a>, documenting 1.15 billion euros in GDPR fines and saying joint AI Act-GDPR pointers for 2026<\/li>\n
  • April 29, 2026<\/strong>\u00a0–\u00a0Microsoft reports Q3 FY26 results<\/a>\u00a0with AI enterprise at $37 billion annual run fee, Copilot queries rising 20% quarter-over-quarter<\/li>\n
  • Might 22, 2026<\/strong>\u00a0– Microsoft publishes the up to date Merchandise and Companies Knowledge Safety Addendum, introducing the 30-day AI subprocessor discover observe<\/li>\n<\/ul>\n

    Abstract<\/h2>\n

    Who:<\/strong>\u00a0Microsoft Company, and all enterprise clients whose quantity licensing settlement incorporates the Merchandise and Companies Knowledge Safety Addendum – together with organisations utilizing Microsoft 365, Azure, Dynamics 365, and Microsoft Promoting.<\/p>\n

    What:<\/strong>\u00a0Microsoft up to date its information safety contract on Might 22, 2026, to create a separate, sooner discover interval for third-party distributors that help synthetic intelligence performance. Beforehand, Microsoft was required to provide clients a minimum of six months’ discover earlier than including any new vendor with entry to buyer information. Beneath the up to date contract, AI-specific distributors now require solely 30 days’ discover. Prospects retain a proper to disable the seller’s entry throughout that interval, however the possibility expires six months after discover is given.<\/p>\n

    When:<\/strong>\u00a0The up to date addendum was revealed on Might 22, 2026, and its commitments are binding on Microsoft from that date.<\/p>\n

    The place:<\/strong>\u00a0The contract is world, masking all of Microsoft’s enterprise buyer base. Its GDPR-specific provisions apply throughout the European Financial Space. Microsoft Eire Operations Restricted is Microsoft’s information safety consultant for the EEA and Switzerland.<\/p>\n

    Why:<\/strong>\u00a0AI infrastructure adjustments sooner than conventional software program vendor chains. The 30-day observe offers Microsoft the operational flexibility to replace the AI distributors underpinning Copilot, Azure AI, and associated merchandise with out being locked right into a six-month notification cycle. For enterprise clients, it creates a concrete new obligation: inner processes for reviewing vendor notices, working privateness danger assessments, and making AI vendor choices now have to work inside 30 days relatively than six months.<\/p>\n

    \n


    \n Share this text \n <\/p>\n

    \n
    \n
    \n <\/a> <\/p>\n


    \n
    \n <\/a><\/p>\n


    \n
    \n <\/a><\/p>\n


    \n
    \n <\/a><\/p>\n


    \n The hyperlink has been copied!<\/small> \n <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n