← Back to Microsoft 365 Copilot

This is a starting point, not legal advice. It is pre-filled from what Microsoft publishes and what we found on 2026-10-23. The highlighted gaps are for your school to complete. Your data protection officer (DPO) should review the finished DPIA.

Data protection impact assessment (DPIA): draft

Tool: Microsoft 365 Copilot   Supplier: Microsoft
School: [School to complete: school name]   Prepared by: [School to complete: name and role]   Date: [School to complete: date]

Draft generated by AI Prefect from the supplier’s published documents (checked 2026-10-23). A starting point only; not legal advice. Verify every fact before relying on it.

1. What the tool will be used for

Type of toolgeneral chatbot / productivity
Purpose in our school[School to complete: what you will use it for, which year groups or staff, and why]
Who will use itSupplier says pupil-facing: Not stated by the supplier. [School to complete: staff only, or pupils too?]
[School to complete: number and roles of users]
Personal data involved[School to complete: e.g. staff names and emails; any pupil data; any special category data (health, SEND, safeguarding)? Avoid where possible]

2. How the supplier handles data

Processor or controllerprocessor
Where data is storedstored at rest in the tenant's geography (UK for UK tenants) under Microsoft 365 data residency commitments, with no Copilot-specific exceptions listed; transfers under the Products and Services DPA (SCCs)
Trains AI on inputsno - prompts, responses and Graph data not used to train foundation models
How long inputs are keptNot stated by the supplier. [School to complete: retention period]
Data processing agreementhttps://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
Signs individual DPAs: yes - Microsoft Products and Services DPA applies to all customers
Supplier DPO / UK representativeNot stated by the supplier. [School to complete: contact details]
Minimum ageNot stated by the supplier. [School to complete: minimum age]
Other safety notesrespects permissions, sensitivity labels, retention, audit
Lawful basis[School to complete: e.g. public task (Article 6(1)(e)) or legitimate interests; Article 9 condition if special category data]

3. Risks and how we will reduce them

AI Prefect rating: staff Green, pupils Amber.

RiskSuggested measureLikelihood / severityResidual risk
Minimum age: not statedCheck this against the age of any pupils who will use it.[School to complete: low / medium / high][School to complete: accepted?]
AI output may be inaccurate or biasedStaff review all output before it is used; do not rely on it for decisions about individuals.[School to complete: low / medium / high][School to complete: accepted?]
[School to complete: any other risks][School to complete: measure]

4. Sign-off

DPO advice[School to complete: DPO comments and date]
Decision[School to complete: approved / approved with conditions / not approved]
Approved by[School to complete: name, role, date]
Review date[School to complete: usually within 12 months, or when the supplier changes its terms]

Sources

  • https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection
  • https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
  • https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-workload-copilot