Question to the Home Office:

To ask His Majesty's Government whether they intend to publish all information risk assessments prepared by or for the National Enabling Programme, including those prepared by external consultants, relating to the adoption of Microsoft 365 and Microsoft Azure by police forces, together with any subsequent assessments currently in force.

The National Enabling Programme (NEP) rolled out the Microsoft 365 (M365) suites and the Identity and Access Management capability to 40 forces. A redacted version of the NEP programme-level Data Protection Impact Assessment, dated December 2020, has been published and is publicly available online.

As data controllers, individual police forces are responsible for assessing the risks associated with their implementation of the NEP.

The Government does not routinely monitor information risk assessments undertaken by the police and does not determine whether they should be published. Decisions on publication are a matter for policing, and there is no requirement on the police to publish such assessments.