Switching on an AI system that reads SharePoint, OneDrive, a document management system or the intranet is a new processing operation under the GDPR, and for an organisation of 250 to 5,000 people it almost always needs a DPIA first. The concern is that the AI answers with everything a user may open, and in most tenants that is far more than anyone intended.
This post is for the IT manager, informatiemanager, CIO or security officer who has to get Microsoft Copilot, a custom assistant or an AI agent past the privacy officer (FG) and the works council. Crux Digits builds AI systems over document stores alongside your ICT partner; the permissions clean-up itself is covered on our Microsoft Copilot implementation page.
Is a DPIA mandatory before an AI system reads SharePoint?
Usually yes: Article 35 GDPR requires one for likely high risk, and a typical deployment meets five of the nine criteria the AP uses.
The AP's list of processing that always requires a DPIA (Staatscourant 2019, 64418) has 17 categories. AI over documents is not named, and the list is not exhaustive; three categories catch common deployments. Category 11, monitoring of employees, applies once the rollout includes systematic review of what staff do with the tool. Category 13, communication data, can apply when the assistant reads mailboxes and Teams chats at scale, which Microsoft Copilot (the new name for Microsoft 365 Copilot) does: it grounds answers in emails, chats and documents the user can access. Category 7, health data, catches hospitals and arbodiensten.
Outside the list, the AP's DPIA page gives a rule of thumb: two or more of the nine criteria means a DPIA. A document-store deployment typically meets sensitive data (4), large scale (5), datasets collected for different purposes combined (6), employees, whom the AP counts as vulnerable because of the unequal relationship (7), and new technology (8). Our post on AI and the GDPR covers the SME baseline.
The AP's draft list of exemptions closed for consultation on 10 August 2026 and is not yet in force. Flemish organisations check the Belgian authority's own list.
Why does AI with a user's permissions turn oversharing into a GDPR problem?
Because the AI shows each user everything that user may open, so a file shared too widely in 2019 becomes an answer in 2026.
Microsoft's wording is that Copilot only surfaces organizational data to which individual users have at least view permissions. Oversharing used to be hidden because nobody could find anything: the verzuim overview in a project site opened to 'Everyone except external users', the salary export in a team made public during a reorganisation. The AI adds no new access. It removes the obscurity that was hiding the access you already gave.
Article 25(2) requires that by default personal data are not made accessible to an indefinite number of people without the individual's intervention. When an employee is shown personal data they had no reason to see, that can be unauthorised access under Article 4(12), and Article 33 then gives you 72 hours to notify the AP unless the breach is unlikely to result in a risk.
For a custom assistant, the design decides. Querying as the signed-in user inherits the same problem. Running under its own identity with tenant-wide read rights is worse: the index is a copy of everything, and the access check must be rebuilt in your own code.
Microsoft's data access governance reports in SharePoint Advanced Management list the sites with the broadest access, content shared with 'Everyone except external users', and sharing links from the last 28 days. Restricted Content Discovery keeps a site out of organisation-wide search and Copilot, but it changes no permissions, removes nothing from the index, does not cover OneDrive, and can take over a week on sites above 500,000 items. Microsoft calls it temporary; in a DPIA it is a stopgap with an end date.
Does purpose limitation allow AI to search documents collected for another purpose?
Only when the new use is compatible: Article 5(1)(b) forbids incompatible further processing, and Article 6(4) lists the factors to weigh.
Documents collected for a project, a recruitment round or a complaint, made answerable to any colleague, serve a new purpose. Article 6(4) weighs the link between purposes, the context of collection, the nature of the data, the consequences and the safeguards. A workable decision rule: scope the AI by purpose, not by data source. 'Answer questions about our procedures, contracts and product documentation' can be documented and defended. 'Everything in SharePoint' cannot. Data minimisation (Article 5(1)(c)) then excludes HR, legal, works council, bedrijfsarts correspondence and personnel files.
For employee data the basis is usually legitimate interest under Article 6(1)(f), with the balancing test written down. Consent rarely works: the AP notes employees cannot freely give or refuse it. And without a valid basis, the AP says, you may not process at all, whatever the DPIA concludes.
On a third-party model, add one question. In Opinion 28/2024, adopted 17 December 2024, the EDPB says supervisory authorities should consider whether the deploying organisation assessed that the model was not developed by unlawfully processing personal data. Get the vendor's material and file it with the DPIA.
What about special category data hidden in old documents?
Article 9(1) prohibits processing health data, union membership and religious beliefs unless an exception applies, and old shares are full of them.
Verzuim registrations, letters from the bedrijfsarts, re-integration files, union deductions in payroll exports. An assistant that retrieves and summarises them is processing them. The measure must sit before retrieval, not in an instruction to the AI. Microsoft documents that when a sensitivity label applies encryption, its AI apps return content only if the user holds both the VIEW and EXTRACT usage rights. Label HR, medical and legal content so broad groups lack EXTRACT. A custom assistant should exclude those locations at index time.
What happens to deletion, retention and access requests once AI has indexed documents?
Every copy counts: the index, cached text, prompts and responses are personal data with their own retention, and belong in Article 15 answers.
SharePoint keeps a deleted item for 93 days across two recycle bins. Microsoft Copilot stores each prompt and response, with citations to its sources, in a hidden folder in the user's mailbox. They go when the user deletes the chat or history, or when a Purview retention policy for Copilot interactions expires; holds suspend deletion, and Microsoft shows a delete-after-one-day policy taking 16 days. So a personnel file deleted at the end of its retention period can live on as a summary in a colleague's Copilot history. Set that policy deliberately and write the number into the DPIA (storage limitation, Article 5(1)(e)).
A custom assistant's vector index holds chunks of source text, so a deletion in SharePoint must reach it. Test it before launch: delete a document, query for it, record how long it takes to disappear.
Article 15(3) gives the data subject a copy, and Article 12(3) gives you one month, extendable by two. An employee asking what the AI said about them is asking about prompts and responses in other people's mailboxes. Microsoft's route is a Purview eDiscovery search with the condition 'Copilot activity'. Assign who runs it before the first request arrives.
Does the works council have to consent to an AI assistant?
Usually yes: WOR Article 27(1) sub k and sub l cover staff data rules and facilities suitable for monitoring behaviour or performance.
The test in sub l is 'gericht op of geschikt voor': aimed at or suitable for. Intent does not decide it. Microsoft records prompts and responses in the unified audit log, with references to the files used, and Purview Communication Compliance can review prompts. That makes the platform suitable for observing behaviour. A decision taken without consent is void if the works council invokes nullity in writing within one month (Article 27(5)).
Run both tracks together: Article 35(9) GDPR asks you, where appropriate, to seek the views of data subjects or their representatives. Our post on shadow AI and instemmingsrecht covers sequencing. The WOR is Dutch law; Belgian participation rules differ.
What must the processor agreement and transfer check cover?
Article 28 requires a contract and written authorisation for subprocessors, and every model provider behind the AI is one.
Under Article 28(2), a general authorisation obliges the processor to tell you about changes so you can object. Microsoft has onboarded Anthropic as a subprocessor; those models are excluded from the EU Data Boundary and off by default for EU, EFTA and UK tenants, behind the setting 'AI providers operating as Microsoft subprocessors'. 'Anthropic models with Data Retention' fall outside Microsoft's DPA altogether. One toggle changes your subprocessor chain, so put those settings under change control.
For a custom assistant, list every hop: hosting, vector database, model API, logging. Transfers outside the EEA fall under Chapter V (Article 44); US recipients certified under the EU-US Data Privacy Framework are covered by the Commission's adequacy decision of 10 July 2023. See our post on data residency for AI; a private AI assistant in your own EU cloud keeps the chain short enough to audit.
Which DPIA questions are specific to AI over document stores?
These twelve, which generic templates miss; answer them and most of the Article 35(7) assessment follows.
A public Dutch precedent: SURF's DPIA on Microsoft 365 Copilot, by Privacy Company and updated 11 September 2025, lists loss of control over content in the Graph as a risk the institution mitigates itself, through labelling, role-based access and SharePoint and Outlook clean-up before go-live.
1. Which locations are in scope, and which are excluded by name? 2. Does the AI query as the user or under its own identity, and how is trimming tested? 3. How many sites are shared organisation-wide, and by when are they fixed? 4. Which special category data are in scope, and what keeps them out of answers? 5. What is the purpose, and why is it compatible under Article 6(4)? 6. What is the legal basis per group: employees, customers, applicants?
7. Which copies exist (index, cache, prompts, responses, audit logs), where, and for how long? 8. How many days until a source deletion reaches every copy? 9. How do you answer an Article 15 request covering AI output within a month? 10. Who reads prompts and logs, why, and has the works council consented? 11. Which subprocessors touch the data, where, and which settings change that list? 12. What happens when the AI says something wrong about a person (accuracy, Article 5(1)(d))? SURF still rated that a medium risk.
The pre-launch checklist by owner. The FG advises on the DPIA, and the AP requires that advice and your response in the report; the FG also owns the register and the access and breach procedures. With high residual risk, consult the AP before processing starts. IT runs the governance reports, fixes organisation-wide sharing, applies encrypted labels, sets AI retention, controls subprocessor settings and runs the deletion test. The business owner writes purpose and scope, names exclusions, handles accuracy complaints and signs the residual risk. The works council receives a written consent request on purpose, logging, log readers and retention, and agrees an evaluation date.
How Copilot, ChatGPT Enterprise, Claude and Gemini differ on permissions, retention and data location is in our comparison for IT departments.
Where Crux Digits fits
We build AI systems over document stores: assistants and agents answering from SharePoint, OneDrive, a DMS or an intranet. Permission trimming sits in retrieval, scope is by named location, and deletion is tested. You receive the code, the technical description Article 35(7)(a) needs, and test evidence for questions 2, 7 and 8. Your ICT partner or IT team keeps running the tenant and its permissions. We are not your lawyer or your FG; they decide whether the DPIA passes.
This is not legal advice. Your privacy officer owns the DPIA and your works council decides on consent; we supply the technical facts both of them need.
For how we run AI projects inside a mid-sized IT organisation, see AI implementation in the Netherlands.
Last updated: 26 October 2026.
A consultant tells you where AI pays off; Crux Digits also builds it. A fixed price per step, one named expert, from Utrecht.
AI consultancy in the Netherlands →
