Microsoft SSPA: Supplier Security and Privacy Assurance

Microsoft’s Supplier Security and Privacy Assurance (SSPA) program sets the privacy, security and responsible AI requirements for Microsoft suppliers that process Personal Data or Microsoft Confidential Data, or use AI Systems, under a Microsoft contract. The current rules are the Microsoft Supplier Data Protection Requirements (DPR) v12 and the SSPA Program Guide v12 (March 2026). This glossary entry explains how the program works, what it requires and how suppliers stay compliant.

Designed by Freepik.

What is the Microsoft SSPA Program?

The Microsoft Supplier Security and Privacy Assurance (SSPA) program ensures that suppliers processing Personal Data and/or Microsoft Confidential Data comply with stringent privacy and security standards. It is part of Microsoft’s commitment to safeguarding data and aligning with global best practices.

SSPA is a partnership between Microsoft Procurement, Corporate External and Legal Affairs, Corporate Security and the Office of Responsible AI. The program’s scope applies to all suppliers worldwide that process data under their contract with Microsoft. By enrolling in the SSPA program, suppliers agree to adhere to defined compliance requirements tailored to their engagements with Microsoft.

Rather than being a regulatory obligation, the SSPA falls under contractual compliance. This means it is not directly enforced by government laws but is a requirement of the contractual relationship between Microsoft and its suppliers. For in-scope suppliers, SSPA compliance is a prerequisite: new suppliers cannot start work until enrollment is complete, and Microsoft’s purchasing tools check that a supplier’s SSPA status is Green before an engagement can move forward. (SSPA is a compliance program, not a certification; for the buyer-side view, see our vendor risk management overview.)

How Does SSPA Work?

Data Processing Profiles

Suppliers in the SSPA program must establish a Data Processing Profile (DPP), which outlines the types of data they handle and the services they provide. This profile dictates the specific compliance requirements they must meet. Profile selections cover the data in scope, processing location, data processing role, Microsoft Highly Confidential Data, payment cards, Software as a Service (SaaS), use of subcontractors, website hosting, healthcare data and AI Systems. For example, a supplier providing SaaS or handling payment card data faces additional requirements.

Suppliers can update their DPP at any time when they have no open tasks, but changes trigger new compliance tasks that must be completed within 90 days. If they are not, the SSPA status turns Red (non-compliant) and the supplier account is at risk of being deactivated from Microsoft’s Accounts Payable systems.

Microsoft SSPA Attestation Requirements

Suppliers must annually attest to compliance with Microsoft SSPA requirements. This self-attestation process ensures ongoing alignment with SSPA standards. Suppliers processing higher-risk data, such as Subprocessors, SaaS providers, suppliers using subcontractors or suppliers providing AI Systems, also need independent assurance: either an independent assessment against the DPR, or a certification Microsoft accepts instead, depending on the profile, such as ISO 27001, ISO 27701 together with ISO 27001, ISO 42001 for the AI section of the DPR (Section K), or a HITRUST report for US healthcare entities.

Why Does Microsoft Require SSPA Compliance?

Microsoft’s SSPA program is designed to:

– Protect Personal Data and Microsoft Confidential Data.

– Ensure suppliers align with Microsoft’s privacy and security principles.

– Mitigate risks associated with data breaches and noncompliance.

The program’s contractual nature means that compliance is a business requirement for suppliers. It supports Microsoft’s broader efforts to maintain trust with customers and meet global regulatory expectations.

Key Features of the SSPA Program

Scope of SSPA

The SSPA program applies to all suppliers worldwide who process Personal or Microsoft Confidential Data, or use AI Systems, under a Microsoft contract. These data categories are clearly defined in the program’s Data Protection Requirements (DPR) and include examples to help suppliers understand the scope of their obligations.

Data Processing Profile

A cornerstone of the SSPA program is the Data Processing Profile (DPP). This profile empowers suppliers to determine which engagements they are eligible to perform based on their data processing activities.

Assurance Requirements

Microsoft SSPA requirements vary depending on the supplier’s DPP. Suppliers involved in high-risk activities—such as those offering SaaS solutions, using subcontractors, or handling payment card data—need additional assurances, including independent compliance verifications or specific certifications like ISO 27701. SaaS suppliers must provide an ISO 27001 certification that covers the software service in their contract, and suppliers providing AI Systems must provide independent assurance against DPR Section K, for example ISO 42001.

Navigating Compliance 

Annual Self-Attestation

Every supplier enrolled in the SSPA program must complete an annual self-attestation to demonstrate compliance with the DPR. It must be completed within 90 days of the request; for suppliers updating their DPP mid-year, the attestation may be requested more often. If the 90 days pass, the status turns Red and new in-scope purchase orders cannot be processed until it is Green again. Microsoft says the SSPA team cannot grant extensions for this task.

Independent Assessment

Suppliers classified as Subprocessors must undergo an independent assessment annually. The supplier chooses and pays for the assessor (Microsoft publishes a Preferred Assessors List), who issues a Letter of Attestation against the current DPR. SSPA may also require an independent assessment outside the normal triggers, for example to validate data incident remediation.

PCI DSS Certification

Suppliers handling payment card information are required to comply with PCI DSS standards. Depending on transaction volume, suppliers provide either a third-party assessor Attestation of Compliance from a Qualified Security Assessor (QSA) (typically Level 1) or a PCI DSS self-assessment questionnaire signed by an officer (typically Level 2 or 3). Suppliers that process or store Microsoft customer payment data must hold a current PCI Tier 1 certification as a service provider.

Managing Risk and Responsibility

Use of Subcontractors

Suppliers using subcontractors must disclose their involvement, particularly if these subcontractors process Personal or Microsoft Confidential Data. Transparency extends to detailing the countries where data will be processed, ensuring alignment with Microsoft’s high standards for data security.

Maintaining Compliance

Compliance with the SSPA program is not a one-time achievement but an ongoing responsibility. Suppliers must ensure their DPP remains accurate, respond promptly to compliance tasks, and be prepared for additional assessments if circumstances warrant.

Why the SSPA Program Matters

The SSPA program fosters trust between Microsoft and its suppliers. By adhering to the program, suppliers demonstrate their commitment to protecting sensitive data, enhancing their credibility, and positioning themselves as reliable partners in a competitive landscape.

For suppliers, the program clarifies expectations and a pathway to align their operations with global privacy and security standards. For Microsoft, it ensures consistency, accountability, and the highest levels of data protection.

The Microsoft SSPA program represents a rigorous yet essential approach to supplier compliance. By understanding its requirements and proactively managing its obligations, suppliers can meet Microsoft’s expectations and strengthen their reputation in the market. Trust is invaluable in today’s data-driven economy—and the SSPA program ensures it remains uncompromised.