Question to the Home Office:

To ask His Majesty's Government how the Code of Practice on vetting issued under section 39A of the Police Act 1996 is applied to personnel of Microsoft and other cloud service providers, including sub-processors and personnel based overseas, who have access to police data or to systems holding police data.

As the police are operationally independent it is the responsibility of Chief Constables to ensure that any contracts for services and supplies meet both their legal and security requirements.

Moreover, the use of data by the police for policing purposes is largely governed by Part 3 of the Data Protection Act 2018 which sets out requirements for the use of processors, and what contractual terms must be included. Section 59(7) of the Act makes provision for the international transfer of personal data by a processor acting under the instruction of a controller.