Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment he has made of the potential impact of the implementation of the Online Safety Act on the level of risk that private bodies could harvest sensitive data on UK citizens who seek out VPN services.

Organisations that process personal data, which could include VPN providers, are subject to requirements of the data protection legislation. This includes obligations to process people’s data fairly and lawfully and to ensure that any data collected is held securely. Organisations that fail to comply may face enforcement action by the Information Commissioner’s Office.