AI tool summary for DPOs and governors

Microsoft Copilot Chat (work/school account)

Microsoft · Facts last checked 2026-10-23 · Printed 23 October 2026

AI Prefect

Staff: Green · Lower risk: fine to use with normal checks

Processor, no training on inputs, UK/EU storage or stated transfer safeguards, school DPA available

Pupils: Amber · Use with caution

Minimum age not stated

Supplier	Microsoft
Category	general chatbot
Pupil-facing	not stated
Processor or controller	processor (Bing web queries: Microsoft is independent controller)
Where data is stored	stored at rest in the tenant's geography (UK for UK tenants) under Microsoft 365 data residency commitments, with no Copilot-specific exceptions listed; transfers under the Products and Services DPA (SCCs)
Trains AI models on inputs	no - prompts/responses not used to train foundation models
How long inputs are kept	not stated
Data processing agreement (DPA)	https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
Signs individual DPAs with schools	yes - Microsoft Products and Services DPA applies to all customers
UK GDPR representative / DPO	not stated
Minimum age	not stated
Key safety note	prompts and responses logged; IT admin can audit
Main use	General AI assistant / chatbot

Before using it: check the minimum age fits your pupils, confirm a data processing agreement is in place, switch off AI training where possible, and record the decision in your DPIA.

Sources: https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection · https://support.microsoft.com/en-us/privacy/data-protection-when-using-microsoft-365-copilot-chat-for-work-or-school · https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA · https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-workload-copilot
Full entry: aiprefect.co.uk/tools/microsoft-copilot-chat. Rating is a rules-based summary of the supplier’s published terms. “Not stated” means we could not find it in their documents. This is not legal advice and does not replace your DPIA.