Cloud Platform Service: CLOUD Act Risk Assessment and Data Residency: FOI release

Information requested

1. Whether any Data Protection Impact Assessment (DPIA) under Article 35 of the UK GDPR has been conducted for the Scottish Government Cloud Platform Service (CPS), specifically addressing the risk that data held on AWS or Microsoft Azure infrastructure may be subject to disclosure orders under the United States Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act). If so, a copy of that assessment.

2. Whether the CPS contract terms with AWS and/or Microsoft specify that Scottish public sector data must be hosted exclusively within UK-based data centres, and if so, which specific regions (e.g. AWS eu-west-2, Azure UK South/UK West). Whether any replication, backup, or disaster recovery processes transfer data to facilities outside the UK.

3. Whether the Scottish Government has sought or received legal advice on whether the UKUS Data Access Agreement (entered into force 3 October 2022) affects the legal exposure of Scottish public sector data held on US-owned cloud infrastructure. If so, a copy of or summary of that advice.

4. The total expenditure on the Cloud Platform Service (AWS and Azure combined) for each financial year from 2021/22 to 2025/26, and the number of Scottish public sector organisations currently using the service.

5. Whether the Cloud and Hosting Services framework (SP-22-023) includes any contractual requirement for data to remain within a specified jurisdiction, and if so, a copy of the relevant clause(s).

Response

1. Whether any Data Protection Impact Assessment (DPIA) under Article 35 of the UK GDPR  has been conducted for the Scottish Government Cloud Platform Service (CPS), specifically addressing the risk that data held on AWS or Microsoft Azure infrastructure may be subject to disclosure orders under the United States Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act). If so, a copy of that assessment.

Yes, a DPIA has been carried out covering the data held by the Cloud Platform Service (CPS) for the operation of the service. This was assessed under UK GDPR, not against the United States Clarifying Lawful Overseas Use of Data Act 2018 (CLOUD Act).

The CPS is not responsible for data relating to customers of the platform. Under the shared responsibility model, CPS customers are responsible for managing their own data and are therefore responsible for carrying out their own DPIA in respect to that data.

A redacted copy of the CPS DPIA has been included in this response.

2. Whether the CPS contract terms with AWS and/or Microsoft specify that Scottish public sector data must be hosted exclusively within UK-based data centres, and if so, which specific regions (e.g. AWS eu-west-2, Azure UK South/UK West). Whether any replication, backup, or disaster recovery processes transfer data to facilities outside the UK.

No, the CPS contract terms with AWS and Microsoft Azure do not specify that Scottish public sector data must be hosted exclusively within UK-based data centres.

The CPS infrastructure does not transfer data outside the UK for any replication, back-up or disaster recovery processes.

Each CPS customer is responsible for managing their own workloads and data. It is the CPS customer’s responsibility to decide if their data can be hosted in other regions, in line with their own DPIA.

3. Whether the Scottish Government has sought or received legal advice on whether the UKUS Data Access Agreement (entered into force 3 October 2022) affects the legal exposure of Scottish public sector data held on US-owned cloud infrastructure. If so, a copy of or summary of that advice.

The CPS has not specifically sought or received legal advice related to the UK-US Data Access Agreement.

4. The total expenditure on the Cloud Platform Service (AWS and Azure combined) for each financial year from 2021/22 to 2025/26, and the number of Scottish public sector organisations currently using the service.

Total expenditure for AWS and Azure combined for the CPS (ex VAT)

	01/04/2021 - 31/03/2022	01/04/2022 - 31/03/2023	01/04/2023 - 31/03/2024	01/04/2024 - 31/03/2025	01/04/2025 - 31/03/2026
Total ex VAT	£229,101	£533,550	£950,017	£1,345,335	£1,664,189

The total number of CPS customers is currently 41, which includes both core Scottish Government customers and other public sector organisations.

5. Whether the Cloud and Hosting Services framework (SP-22-023) includes any contractual requirement for data to remain within a specified jurisdiction, and if so, a copy of the relevant clause(s).

No, the Cloud and Hosting Services framework (SP-22-023) does not have a contractual requirement for data to remain within a specified jurisdiction.

About FOI

The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.

FOI 202600516384 - Information Released - Annex

File type

PDF

File size

576.8 kB