Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what steps she is taking to ensure that the Government can access sensitive information and data from overseas cloud software providers in the event of contract cancellation or expiration.

When departments procure cloud software, the Government requires that contracts include clear provisions on data ownership, control and exit, so that government data can be securely accessed, transferred or deleted when contracts expire or are terminated.

Under UK data protection law, government acts as the data controller and sets binding contractual instructions on how suppliers may process government data, including requirements covering data access, retention and deletion at the end of a contract. These arrangements are underpinned by standard contractual security and data protection terms and are assured by departments in line with the sensitivity of the data involved.