This policy governs CUCCIO’s collection and use of personal information, within CUCCIO's Microsoft 365 environment (Teams, OneDrive, Sharepoint, Forms), as well as our website and other communication tools and platforms. 

Policy Effective Date: April 9, 2026 

Policy Last Reviewed / Approved Date: April 9, 2026 

CUCCIO is committed to protecting the privacy of its members, partners, and stakeholders. We collect personal information only as necessary to fulfill our mandate as a member-driven organization supporting information technology leaders in higher education. This may include contact information, professional details, and participation history in CUCCIO programs, events, and services. Personal information is collected directly from individuals or through authorized institutional representatives and is used to deliver member services, facilitate engagement, communicate relevant updates, and support the advancement of our community. Information gathered as part of our annual CANHEIT conference (sponsors, photography, delegate data, etc.) is governed under a separate policy https://www.canheit.ca/event/ceba8fe0-f35b-4ee0-a9a2-9ca21a968b32/privacy-policy.  

CUCCIO collects, uses, and discloses personal information with the knowledge and consent of the individual, except where otherwise permitted or required by law. Information is used solely for the purposes for which it was collected, unless additional consent is obtained. CUCCIO does not sell or rent personal information to third parties. We may share limited information with trusted service providers or partners who support the delivery of our programs (such as event platforms or communications tools), and only to the extent necessary and under appropriate safeguards. 

CUCCIO takes reasonable administrative, technical, and physical measures to protect personal information against unauthorized access, disclosure, or misuse. Access to personal information is restricted to individuals who require it to perform their duties. Personal information is retained only for as long as necessary to fulfill the purposes for which it was collected, to meet legal or regulatory requirements, or to support legitimate organizational needs. When no longer required, information is securely destroyed or anonymized. 

Individuals have the right to access their personal information held by CUCCIO and to request corrections if it is inaccurate or incomplete. CUCCIO is committed to maintaining transparent privacy practices and will provide information about its policies and procedures upon request. Questions, concerns, or requests related to personal information can be directed to CUCCIO through designated contact channels. 

CUCCIO’s privacy practices are guided by applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and relevant provincial laws (FOIP, FOIPPA,FOI, etc). We regularly review and update our policies to ensure ongoing compliance and alignment with best practices in privacy and data protection. 

CUCCIO M365 and AI Use Policy: Microsoft Copilot, recording, and transcription in Teams Meetings

Policy Effective Date: April 1, 2026

Policy Last Reviewed / Approved Date: April 1, 2026

Related documents: CUCCIO Privacy Policy; M365 Data Retention Policy.

Purpose

This policy governs CUCCIO’s collection and use of personal information, including Microsoft Copilot for meeting recaps, recording, and transcription within CUCCIO's Microsoft Teams environment.

As per our Privacy Policy, CUCCIO is committed to protecting the privacy of its members, partners, and stakeholders. We collect personal information only as necessary to fulfill our mandate as a member-driven organization supporting information technology leaders in higher education. This may include contact information, professional details, and participation history in CUCCIO programs, events, and services. 

Scope

This policy applies to all employees, contractors, and participants (guests, SIG members, etc.) in Teams meetings hosted within the CUCCIO tenant.

Policy Statement - Use of Microsoft Copilot

Microsoft Copilot is approved for use in Teams meetings to generate meeting recaps, summaries, and action items. Copilot will be enabled by default for all meetings unless a meeting organizer explicitly specifies that a particular meeting should be excluded from Copilot processing.

Recording and Transcription

Meetings may be recorded and transcribed for the following purposes:

• Meeting recap and summary generation (participants to be notified in accordance with Microsoft Teams procedures);

• Note-taking and reference;

• Archive and compliance purposes;

• Knowledge management and institutional memory; and

• Standard protocols.

Data Storage and Security

All meeting recordings, transcripts, and Copilot-generated recaps are stored securely within the CUCCIO Microsoft 365 tenant and are subject to the following controls:

1. Location: All data remains within the CUCCIO tenant infrastructure (SharePoint).

2. Access: Access is limited to meeting participants, CUCCIO members and authorized personnel as determined by organizational access policies.

3. Retention: Recordings and transcripts are retained in accordance with our organization's data retention policy[1].

4. Security: Data is protected by Microsoft 365 enterprise-level security controls and encryption.

Participant Rights and Responsibilities

Meeting Organizers:

• Have the right to exclude specific meetings from Copilot recap by notifying the National Program Manager to configure meeting settings accordingly

• Should inform participants when meetings will be recorded

• Are responsible for ensuring appropriate use of recordings and transcripts

Meeting Participants:

• Will be notified when a meeting is being recorded

• Should be aware that Copilot may generate recaps and summaries from meeting content

• Should refrain from sharing sensitive or confidential information if they are uncomfortable with recording or AI processing

Opt-Out Procedures

1. Meeting organizers who wish to exclude a meeting from Copilot recap and/or recording should:

2. Notify the National Program Manager to configure meeting settings prior to the meeting start.

3. Request to disable recording and Copilot features in the meeting options.

4. Communicate to participants that the meeting will not be recorded.

Unauthorized AI Tools and Bots

Approved AI Tools: Only Microsoft Copilot is approved for use in Teams meetings within the CUCCIO tenant.

 No other AI tools, bots, meeting assistants, or transcription services have been authorized for use in any of CUCCIO’s meetings.

The use of third-party AI meeting assistants, note-taking bots, or transcription services (e.g. Otter.ai, Fireflies.ai, Grain, Supernormal, or similar tools) is strictly prohibited unless specifically approved in writing by the National Program Manager.

Participant Responsibilities: If you are using or have invited any unauthorized AI tools or bots to Teams meetings, you must:

• Immediately disable or remove these tools from your account

• Remove any bots from meeting invites

• Delete any unauthorized recordings or transcripts obtained through these tools

• Contact the National Program Manager if you have questions about whether a specific tool is approved.

3.     Enforcement: Participants who continue to use unauthorized AI tools after being informed of this policy may be subject to being removed from the CUCCIO tenant. Any further action will be at the discretion of the offending participant’s institutional primary representative (CIO) in accordance with organizational policies.

Compliance

This policy complies with applicable data protection laws and regulations. Microsoft Copilot and Teams recording features are used in accordance with Microsoft's privacy and security standards.

Data Subject Requests

Individuals who wish to access, review, or request deletion of recordings or transcripts in which they participated should contact the National Program Manager.

Policy Review

This policy will be reviewed annually and updated as necessary to reflect changes in technology, regulations, or organizational needs.

Questions and Concerns

For questions about this policy or concerns about meeting recording and Copilot usage, please contact the National Program Manager.

CUCCIO follows the Microsoft Data retention, deletion, and destruction in M365 policy: https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-retention-deletion-and-destruction-overview