Microsoft DPR v11: A Guide to the Latest Updates for Suppliers
Published: Apr 23, 2025
Microsoft recently released v11 of their Data Protection Requirements (DPR) for suppliers required to undergo an annual security and privacy assessment through Microsoft’s Supplier Security and Privacy Assurance (SSPA) program. Microsoft DPR v11 went into effect April 2025 and features a total of 67 requirements.
While version 11 doesn’t bring nearly as many drastic changes as version 10 did specific to its new AI requirements, it does notably remove five requirements that were included in version 10. Additionally, it adds two new requirements, focused on data protection agreements with subcontractors and background verification checks for the staffing of Microsoft personnel.
In this article, we’ll describe the SPPA program at a high-level and highlight the key changes in DPR v11 as compared to v10 so that suppliers can be well prepared to pursue the best course of action to ensure they remain compliant with Microsoft’s requirements ahead of their next annual assessment.
What is the Microsoft SSPA Program?
Microsoft’s SSPA program serves as their internal vendor risk management framework and applies to all suppliers who want to do business with them and who process confidential or personal data. It requires suppliers to first implement Microsoft’s DPR, which is a set of requirements for establishing a data protection framework intended to ensure the security, privacy, and compliance of data across Microsoft’s cloud services.
Once the DPR measures are implemented and requirements are met, suppliers then must validate the effectiveness of their controls through a self-assessment and potential independent evaluation, occurring during procurement and annually thereafter. More information about the requirements can be found on Microsoft’s Supplier Data Protection Requirements and SSPA official resources.
What’s New in Microsoft DPR v11?
Most notably, there are five requirements from SSPA v10 that have been removed in version 11 pertaining to management, notice, and subcontractors.
The five requirements that are no longer featured in Microsoft DPR v11 include:
|
Section |
Old Microsoft Requirement (v10) |
|---|---|
|
Management |
Assign responsibility and accountability for compliance with the DPR to a designated person or group within the company. |
|
Notice |
When collecting Microsoft Personal Data via a live or recorded voice call, suppliers must be prepared to discuss the applicable data collection, handling, use, and retention practices with Data Subjects. |
|
Subcontractors |
Where Microsoft is a Controller of Microsoft Personal Data, ensure the subcontractor uses Microsoft Personal Data in accordance with a Data Subject’s stated contact preferences. |
|
Subcontractors |
Review complaints for indications of any unauthorized or Unlawful Processing of Microsoft Personal Data. |
|
Subcontractors |
Promptly take actions to mitigate any actual or potential harm caused by a subcontractor’s unauthorized or Unlawful Processing of Microsoft Personal and Confidential Data. |
As aforementioned, DPR v11 features two additional requirements pertaining to subcontractors and security, outlined below:
|
Section |
New Microsoft Requirement (v11) |
|---|---|
|
Subcontractors |
Require the subcontractor to agree in writing to terms no less protective of Microsoft than the terms in supplier’s agreement with Microsoft, including the privacy and data protection terms. |
|
Security |
Suppliers will verify throughout the hiring and placing process, via voice and visual appearance, the employee they interviewed, hired, and placed in Microsoft is the same person. Address information for the employee must match their banking information and the location for any equipment shipments. |
Moving Forward Microsoft DPR v11
Microsoft DPR v11 went into effect April 2025, allowing suppliers to now dismiss the recently removed requirements while requiring their compliance with the two new additions.
If your organization is required to go through an independent assessment of your compliance with the DPR this year, or if you have any inquiries as they relate to the updated requirements or overall assessment process, Schellman can help. Contact us today and we’ll get back to you shortly.
In the meantime, discover additional Microsoft SSPA and DPR insights in these helpful resources:
About CHRIS LIPPERT
Chris Lippert is a Director and Privacy Technical Lead with Schellman and is based in Atlanta, GA. With more than 10 years of experience in information assurance across numerous industries, regulations, and frameworks, Chris developed a passion for and concentration in data privacy. He is an active member of the International Association of Privacy Professionals (IAPP), holds his Fellow of Information Privacy (FIP) designation, and advocates for privacy by design and the adequate protection of personal data in today’s business world.