Hanover Buys Wrong Microsoft Licenses Worth €324,000

Posted by DeFuchsIschKeinHaas@reddit | sysadmin | View on Reddit | 218 comments

This is a German article translated into English. Source

The city of Hanover purchased Microsoft 365 Education licenses worth €324,000 in 2025 that cannot be used in schools. As reported by the Hannoversche Allgemeine Zeitung, the 60,000 licenses do not comply with data protection regulations for children and young people.

When purchasing the licenses, a Data Processing Agreement (DPA) was signed, but the wrong one. Instead of the DPA required for schools, only a standard data processing contract was used.

To make matters worse, no data protection officer reviewed the purchase beforehand, and a Data Protection Impact Assessment (DPIA) was only carried out after the licenses had already been bought. Had it been conducted beforehand, the city would likely have signed the stricter school-specific DPA. A DPIA is required whenever the planned processing of personal data is likely to pose a high risk to individuals.

Licenses Must Be Purchased Again

According to the report, Hanover decided to introduce Microsoft software in schools despite criticism, partly arguing that students would need these programs in their future careers, a stance the city intends to maintain.

However, the purchase of the wrong licenses has delayed the rollout of Microsoft 365 Education indefinitely. The city must now first complete a proper DPIA, then select the correct DPA, and only then repurchase the licenses on the correct legal basis.

Microsoft software in schools has been a controversial topic in Germany for years. Data protection responsibilities are often placed on schools themselves, which are frequently overwhelmed by them. Many schools also lack a dedicated IT administrator, with teachers often taking on those responsibilities on top of their regular duties.