DPO Agent processes no personal data about its users beyond what is strictly necessary for authentication. No conversation content is stored, logged, or used for any purpose other than generating the immediate response. This document describes the technical and organisational measures in place.
Data minimisation
GDPR art. 5(1)(c)
Only the data strictly necessary for the service to function is processed. Conversation content never leaves the user's browser session.
No conversation storage. Chat history exists only in the browser's memory during the active session. When the tab is closed, all conversation data is permanently deleted.
No user profiling. DPO Agent does not build profiles, track usage patterns, or store any information about individual users or their queries.
No third-party analytics. No tracking pixels, no cookies beyond authentication, no analytics scripts.
Purpose limitation
GDPR art. 5(1)(b)
Data is processed exclusively for the purpose of generating legal guidance responses. No secondary use is possible.
Single purpose. Each query is processed to generate a response and then discarded. The system has no mechanism for secondary processing.
Not used for AI training. Azure OpenAI contractually guarantees that customer data is not used to train or improve Microsoft's models.
Storage limitation
GDPR art. 5(1)(e)
No conversation data is retained beyond the immediate processing required to generate a response.
Stored Completions disabled. The Azure OpenAI Stored Completions feature has been explicitly disabled, ensuring prompts and responses are not retained by Microsoft beyond in-memory processing.
No application-level logging of content. The Azure Function App does not log query content or response content. Only technical telemetry (response time, error codes) is retained.
Integrity and confidentiality
GDPR art. 5(1)(f) · art. 32
Technical and organisational measures ensure that data in transit and at rest is protected against unauthorised access.
HTTPS everywhere. All traffic between the user's browser and the service is encrypted using TLS 1.2+. The service is accessible only via HTTPS.
SSO via Microsoft Entra ID. Authentication is handled exclusively by Microsoft's enterprise identity platform. DPO Agent never handles or stores passwords.
Managed Identity for infrastructure. The application uses Azure Managed Identity to access storage — no credentials are stored in code or configuration files.
Secrets in environment variables. API keys are stored as encrypted environment variables in Azure, not in source code.
Lawful basis and access control
GDPR art. 6 · art. 25
Access to DPO Agent requires active authentication. No unauthenticated access to the service is possible.
Authentication required. Every session requires explicit login via Microsoft Entra ID. Incognito or unauthenticated access is not possible.
Tenant-scoped access. Access can be restricted to users within a specific Microsoft 365 tenant, ensuring only authorised employees can use the service.
Accountability
GDPR art. 5(2) · art. 24
DPO Agent is operated by DPO Agent under Danish law. Documentation of technical and organisational measures is maintained and available on request.
Infrastructure in Sweden Central. All processing takes place within the EU on Microsoft Azure infrastructure in Sweden Central, ensuring GDPR territorial compliance.
Data Processing Agreement available. A DPA is available for enterprise customers who require formal documentation of the controller-processor relationship.
Microsoft as sub-processor. Microsoft Azure acts as a sub-processor under Microsoft's standard Data Processing Addendum, which is incorporated by reference into the service terms.
Infrastructure overview
Hosting
Microsoft Azure
Sweden Central (EU)
AI model
Azure OpenAI GPT-4o
No training on customer data
Authentication
Microsoft Entra ID
SSO — no passwords stored
Data retention
Zero
No conversation data stored
Transport
TLS 1.2+
HTTPS enforced
Operator
DPO Agent
CVR available on request
Data Processing Agreement
Enterprise customers who require a formal Data Processing Agreement (DPA) documenting the controller-processor relationship, sub-processors, and technical and organisational measures may request one by contacting DPO Agent. The DPA covers the processing of any personal data that users may include in their queries to DPO Agent.