Question to the Home Office:

To ask His Majesty's Government whether cloud service providers holding police data are subject to the same personnel vetting and physical security requirements as UK-based suppliers to policing; and if not, why not.

The College of Policing’s Vetting Code of Practice requires an appropriate level of vetting of individuals working in policing. This extends to contractors, where the role allows access to police information that is not publicly available. Individuals working for providers who are not based in the UK cannot be subject of police vetting since police vetting is completed against systems holding information from the UK. UK vetting authorities would therefore not have access to the full range of information necessary for vetting decisions.

However, as a result of various security requirements including encryption and legislative data protection requirements, individuals working for cloud service providers are unlikely to be able to access police data when contracted to process data for the police. If they do so, this is strictly under the control of the police and subject to an appropriate duty of confidentiality as data protection legislation requires.

The Home Office does not collect data in relation to the number of individuals who have police vetting or non-Police Personnel Vetting, which is an operational matter for police forces.