Question to the Home Office:

To ask His Majesty's Government how many personnel of cloud service providers holding police data have been vetted to Non-Police Personnel Vetting Level 2 (Full) or above since 2017; and which police force or other body carried out that vetting.

The College of Policing’s Vetting Code of Practice requires an appropriate level of vetting of individuals working in policing. This extends to contractors, where the role allows access to police information that is not publicly available. Individuals working for providers who are not based in the UK cannot be subject of police vetting since police vetting is completed against systems holding information from the UK. UK vetting authorities would therefore not have access to the full range of information necessary for vetting decisions.

However, as a result of various security requirements including encryption and legislative data protection requirements, individuals working for cloud service providers are unlikely to be able to access police data when contracted to process data for the police. If they do so, this is strictly under the control of the police and subject to an appropriate duty of confidentiality as data protection legislation requires.

The Home Office does not collect data in relation to the number of individuals who have police vetting or non-Police Personnel Vetting, which is an operational matter for police forces.