Question to the Cabinet Office:

To ask Her Majesty's Government what are their current requirements for the geographic location of servers used to store public data when procuring cloud services.

When procuring cloud services, departments should use the Technology Code of Practice principles and follow the government Cloud First policy. They should also follow NCSC security guidance and the Information Commissioner's Office’s guidance on adequacy of a country’s level of data protection. These policies and guidance provide clear guidelines of the things a department should consider, including security classification and best value for the taxpayer.