Surf, the Dutch national educational IT institute, conducted a data protection impact assessment. The report itself: (also linked in the article)

https://www.surf.nl/files/2024-12/20241218-dpia-microsoft-36...