Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, whether her Department has made an assessment of the potential impact of the increased use of VPNs on the level of (a) data and (b) national security risks since the introduction of the Online Safety Act.

The Department is monitoring the impact of circumvention techniques, including VPNs, on the Online Safety Act. Ofcom told Parliament last month that UK usage of VPN apps had declined from an initial peak when the Act’s child safety duties commenced.

There are legitimate reasons for using VPNs, including enhancing cybersecurity and protection against hostile regimes. The National Cyber Security Centre has guidance for organisations that use VPNs.

Organisations processing personal data, which could include VPN providers, are subject to data protection legislation that is enforced by the Information Commissioner’s Office. This includes obligations to process people’s data fairly, lawfully and ensure it is held securely.