Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what assessment she has made of the potential implications of the US CLOUD Act for UK government data held on infrastructure provided by (a) Microsoft, (b) Google Cloud and (c) Amazon Web Services under agreements entered into since July 2024.

DSIT has not made any central assessments of the US CLOUD Act and the implications for UK government data.

Under UK data protection laws, UK organisations, including UK Government, must ensure personal data is appropriately protected when transferred internationally.

The UK has an adequacy decision for certain transfers to the US under the UK Extension to the EU-US Data Privacy Framework, which included an assessment of US government access laws and practices, such as the US CLOUD Act. Where adequacy is not relied upon, organisations must use alternative safeguards, such as standard contractual clauses, in accordance with Article 46 of the UK GDPR.