Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government what arrangements exist for them to be notified of any request made by the government of the USA to a US-based cloud provider to produce data held on behalf of UK police; and whether the UK–US Data Access Agreement prevents US-based cloud provider from being compelled to produce this data.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The UK-US Data Access Agreement (DAA) applies only to cross-border requests between the UK and the US. It enables law enforcement and security agencies to request data direct from telecommunications operators in the other party’s jurisdiction for the purposes of preventing, detecting, investigating and prosecuting serious crime.
The DAA contains targeting restrictions that prevent US authorities from targeting anyone located in the UK. The DAA does not govern requests made by US authorities to US-based providers.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the 2017 security assessment concerning the use of Microsoft cloud services by police was subsequently revised or supplemented by further security or risk assessments; if so, on what dates; and whether they plan to publish these assessments.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Government would not routinely monitor such police assessments and there is no requirement on the police to publish internal security assessments.
As the police are operationally independent it is the responsibility of Chief Constables to ensure they contract appropriate suppliers, in line with national guidelines, who represent value for money and can meet their strict security requirements.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government which terms in the contract signed with Microsoft concerning the use of cloud services by police prevent the sharing of data with the government of the USA without the express permission of the government of the UK; and whether those terms differ from Microsoft's standard terms of service.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.
Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government whether the use of Microsoft cloud services by public bodies is limited to at and below the OFFICIAL classified information tier; and what assessment they have made of the compatibility of police use of cloud services with Microsoft's service terms regarding high risk use.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
The Government’s Cloud First Policy [Government Cloud First policy - GOV.UK] sets out the position for cloud use in the public sector, including particular considerations for information at different classification levels. It provides principles for the public sector to help navigate delivering technology solutions quickly, the associated cost and resources, and reducing risk.
In relation to police use specifically, it is for policing to determine their technology needs in line with government and policing guidance. However, when evaluating new technology to support and enhance data processing in law enforcement systems, the highest standards of data security are required from any technology provider.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government how the Code of Practice on vetting issued under section 39A of the Police Act 1996 is applied to personnel of Microsoft and other cloud service providers, including sub-processors and personnel based overseas, who have access to police data or to systems holding police data.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.
Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Home Office:
To ask His Majesty's Government what evidence they have that police forces complied with the requirement in section 77(7) of the Data Protection Act 2018 to inform the Information Commissioner of international transfers of personal data, in the period from May 2018 until that requirement was amended by the Data (Use and Access) Act 2025.
Answered by Lord Hanson of Flint - Minister of State (Home Office)
As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.
Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government when will the first AI Assurance Innovation Fund awards be announced; and what the typical award size will be.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The AI Assurance Innovation Fund will issue up to £11 million in funding to support the development of innovative and novel AI assurance mechanisms and help actors across the AI value chain identify and address the risks posed by high-capability AI systems, ensuring the UK is ready and equipped to respond to rapidly advancing AI capabilities.
The Centre for AI Measurement, led by the National Physical Laboratory, was established by Government to deliver on the objectives of the AI Assurance Innovation Fund, with a call for applications to be announced later this year. Fund awards will support industry, start-ups and researchers looking to develop novel assurance techniques in a variety of sectors.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what discussions they have had with the Competition and Markets Authority on the expected timetable for the Strategic Market Status investigation into Microsoft’s business software ecosystem; and what steps they are taking to ensure that any remedies to address competition concerns are implemented without undue delay.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The CMA launched its Strategic Market Status designation investigation into Microsoft’s business software ecosystem on 14 May 2026.
This investigation must be completed within 9 months. An indicative timetable of this investigation is published on the CMA’s website. The CMA operates independently and decisions on which firms to investigate, and how these investigations are conducted rest solely with the CMA.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what assessment they have made of the impact of software licensing restrictions on value for money for public sector organisations seeking to deploy Microsoft software on non-Microsoft cloud infrastructure.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The Government does not maintain an aggregated assessment of departmental dependency on Microsoft software or cloud services. Departments are responsible for selecting technology that meets their needs, in line with security, resilience, procurement and value-for-money requirements. The Cloud First policy does not require use of Microsoft, and departments may procure competing products and services, including from other major cloud providers. The Strategic Partnership Arrangement 2024 secures preferential discounts for eligible public sector organisations but is not a direct route to market; departments must still run compliant procurement processes. Cabinet Office and DCMS continue to monitor the market, including the CMA’s investigation into Microsoft’s business software ecosystem, and will consider its findings when published.
Asked by: Lord Clement-Jones (Liberal Democrat - Life peer)
Question to the Cabinet Office:
To ask His Majesty's Government what assessment they have made of the extent to which central government departments are dependent on Microsoft software and cloud services to deliver core public services; and what steps they are taking to ensure departments retain the ability to procure competing products and services.
Answered by Baroness Twycross - Parliamentary Secretary (Cabinet Office)
The Government does not maintain an aggregated assessment of departmental dependency on Microsoft software or cloud services. Departments are responsible for selecting technology that meets their needs, in line with security, resilience, procurement and value-for-money requirements. The Cloud First policy does not require use of Microsoft, and departments may procure competing products and services, including from other major cloud providers. The Strategic Partnership Arrangement 2024 secures preferential discounts for eligible public sector organisations but is not a direct route to market; departments must still run compliant procurement processes. Cabinet Office and DCMS continue to monitor the market, including the CMA’s investigation into Microsoft’s business software ecosystem, and will consider its findings when published.