Since January 2026, Anthropic is on Microsoft’s subprocessor list for Microsoft 365. If you use Copilot and your data protection impact assessment doesn’t mention Anthropic, your compliance documentation is incomplete.
This isn’t a technicality. When a regulator requests your DPIA, a missing subprocessor that’s been processing data for months is going to be hard to explain.
What changed
Microsoft added Anthropic as a subprocessor to the official Microsoft Online Services Subprocessor List. Anthropic provides AI processing capabilities for M365 services. That includes the infrastructure behind Copilot and other AI features within the M365 platform.
This is not the same as using Claude directly through anthropic.com. If your employees use Claude as a standalone tool, that’s a separate processing activity with its own legal basis and contract. What we’re talking about here is the processing that happens in the background when you use Microsoft 365 Copilot.
Microsoft communicated the change through the standard channel. The subprocessor list was updated. If you subscribed to the RSS feed or email notifications, you were informed. If you didn’t, you may have missed it entirely.
The EU Data Boundary problem
This is where it gets relevant for regulated firms in Germany and across the EU. Microsoft introduced the EU Data Boundary in 2023. The commitment: EU customer data stays within the EU for processing and storage.
Anthropic is excluded from that commitment.
Microsoft’s documentation states this clearly. Data processed through Anthropic does not automatically fall under the same data residency rules as the rest of M365 processing. For firms that rely on the EU Data Boundary as part of their compliance posture, this changes the risk picture.
If your DPIA states that M365 data remains within the EU, that’s still true for most of the processing. But for the portion routed through Anthropic, the situation is different. And that difference needs to be documented.
For firms handling client data protected under Section 203 of the German Criminal Code, this is particularly significant. The criminal confidentiality obligation requires complete documentation of data flows. A subprocessor that may process data outside the EU belongs in that documentation.
What needs updating in your DPIA
If your DPIA was written before January 2026, it’s likely missing several items. This isn’t a one-paragraph fix. It touches multiple sections of the document.
Your data flow diagram needs to show the Anthropic processing path. Most Copilot DPIAs show Microsoft as the processor and map data flows within the M365 environment. The additional path through Anthropic as a subprocessor is missing. Map out which data may be routed to Anthropic and through what mechanism.
Your risk assessment needs to address processing by a new subprocessor outside the EU Data Boundary. That’s a standalone risk that requires separate evaluation. How likely is it that personal data gets processed through Anthropic? What categories of data are affected? What would be the impact of an incident?
Your subprocessor register needs an entry for Anthropic. Include: processing purpose, processing location, legal basis for the transfer, and the specific security measures Anthropic applies. Microsoft provides some of this through the DPA and subprocessor list. But as the controller, you need to consolidate this information in your own documentation.
Your technical and organizational measures (TOMs) may need updates. If Anthropic’s security measures differ from Microsoft’s, or if certain safeguards don’t apply to the Anthropic processing path, that needs to be documented. This includes whether sensitivity labels and DLP policies apply to data processed through Anthropic.
What to do first
Start with the subprocessor register. That’s the fastest part. Download the current Microsoft subprocessor list, find the Anthropic entry, and transfer the relevant information into your documentation.
Then the risk assessment. Evaluate: What data do your employees process with Copilot? Does it include client data, HR data, or other categories where a transfer outside the EU Data Boundary would be problematic? How likely is that scenario? What measures can reduce the risk?
Update the data flow diagram. And check whether your TOMs are sufficient for the new processing path.
The entire update process takes half a day to a full day for an existing DPIA. Not a project. But work that needs to happen.
Why this needs to happen now
The change has been in effect since January 2026. It’s April. If your DPIA hasn’t been updated, that’s three months of incomplete documentation. When a regulator asks, that gap is difficult to justify.
GDPR Article 28 requires the controller to assess changes in subprocessors. This isn’t a one-time task during initial setup. It’s ongoing compliance work. Microsoft’s DPA typically provides a 30-day objection window. That window is long closed. The change is accepted by default. But the documentation obligation remains.
If you deployed Copilot before the Anthropic change, your DPIA may have been complete at the time. It isn’t anymore. And if you deployed Copilot after January 2026 without accounting for Anthropic, the DPIA was incomplete from the start.
Subprocessor monitoring is not a one-time task
This case illustrates why ongoing monitoring of the subprocessor list is necessary. Microsoft can add subprocessors at any time. The 5 GDPR questions before a Copilot rollout covers this under question 5. But even after rollout, someone in your organization needs to track and evaluate these changes.
This also connects to the oversharing risk with Copilot. Your permissions structure controls what data Copilot can process. But the subprocessor question is about where that data goes after Copilot processes it. Both belong in a complete risk assessment.
Next step
The Managed Compliance Service includes quarterly DPIA reviews. Built for exactly these situations: subprocessors get added, processing paths change, risk assessments need updating. This isn’t something you do once and forget. It’s ongoing.
Book a 30-minute call. I’ll look at your current DPIA and tell you what’s missing. No sales pitch. Just an honest assessment.
Jose Lugo is a CISSP-certified AI compliance consultant with M365 Endpoint Administrator certification. He builds and updates data protection impact assessments for firms in Germany using Microsoft 365 Copilot.