diff --git a/app/main/views/templates.py b/app/main/views/templates.py
index 244c796ef..90afd139d 100644
--- a/app/main/views/templates.py
+++ b/app/main/views/templates.py
@@ -379,6 +379,13 @@ def copy_template(service_id, template_id):
         str(template_id),
     )['data']
 
+    template_folder = template_folder_api_client.get_template_folder(service_id, template['folder'])
+    if (
+        current_service.has_permission('edit_folder_permissions') and
+        not current_user.has_template_folder_permission(template_folder)
+    ):
+        abort(403)
+
     if request.method == 'POST':
         return add_service_template(service_id, template['template_type'])
 
diff --git a/app/notify_client/template_folder_api_client.py b/app/notify_client/template_folder_api_client.py
index f7015c1cb..4755cfca2 100644
--- a/app/notify_client/template_folder_api_client.py
+++ b/app/notify_client/template_folder_api_client.py
@@ -21,6 +21,19 @@ class TemplateFolderAPIClient(NotifyAdminAPIClient):
     def get_template_folders(self, service_id):
         return self.get('/service/{}/template-folder'.format(service_id))['template_folders']
 
+    def get_template_folder(self, service_id, folder_id):
+        if folder_id is None:
+            return {
+                'id': None,
+                'name': 'Templates',
+                'parent_id': None,
+            }
+        else:
+            return next(
+                folder for folder in self.get_template_folders(service_id)
+                if folder['id'] == str(folder_id)
+            )
+
     @cache.delete('service-{service_id}-template-folders')
     @cache.delete('service-{service_id}-templates')
     def move_to_folder(self, service_id, folder_id, template_ids, folder_ids):