AI tool summary for DPOs and governors

Microsoft 365 Copilot

Microsoft · Facts last checked 2026-10-23 · Printed 23 October 2026

AI Prefect

Staff: Green · Lower risk: fine to use with normal checks

Processor, no training on inputs, UK/EU storage or stated transfer safeguards, school DPA available

Pupils: Amber · Use with caution

Minimum age not stated

Supplier	Microsoft
Category	general chatbot / productivity
Pupil-facing	not stated
Processor or controller	processor
Where data is stored	stored at rest in the tenant's geography (UK for UK tenants) under Microsoft 365 data residency commitments, with no Copilot-specific exceptions listed; transfers under the Products and Services DPA (SCCs)
Trains AI models on inputs	no - prompts, responses and Graph data not used to train foundation models
How long inputs are kept	not stated
Data processing agreement (DPA)	https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
Signs individual DPAs with schools	yes - Microsoft Products and Services DPA applies to all customers
UK GDPR representative / DPO	not stated
Minimum age	not stated
Key safety note	respects permissions, sensitivity labels, retention, audit
Main use	General AI assistant / chatbot

Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.

Sources: https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection · https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA · https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-workload-copilot
Full entry: aiprefect.co.uk/tools/microsoft-365-copilot. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.