Question
To ask His Majesty's Government what guidance they have issued to police forces on meeting the international transfer provisions of Part 3 of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, in respect of their use of Micros
Answer
The government has not issued specific guidance to law enforcement authorities, including the police, on meeting the requirements of the international transfer provisions of Part 3. As the police are operationally independent it is for Chief Constables to ensure that forces are compliant with the data protection legislation. However the Government’s Cloud First Policy [ Government Cloud First policy - GOV.UK ] and the additional public sector guidance [ Cloud guide for the public sector - GOV.UK ] sets out the position for cloud use in the public sector, it provides principles for the public sector to help navigate delivering technology solutions quickly, the associated cost and resources, and reducing risk. As set out in the policy, organisations seeking to procure cloud solutions need to, amongst other things, ensure they comply with the law and that the relevant service is resilient as per the additional National Cyber and Security Centre guidance [ Cloud security guidance | The cloud security principles | Principle 2: Asset protection and resilience | National Cyber Security Centre ] The Information Commission (ICO) has also been reviewing all its guidance following the Data (Use and Access) Act 2025 coming into effect. We expect the updated chapter on international transfers which, sits within the existing Guide to Law Enforcement Processing, to be published before the end of 2026.
Verdict: AMBER (72/100)
The reply directly answers the question: the government has not issued specific guidance to police or other law enforcement on the Part 3 international transfer requirements. It explains that police forces are the responsibility of Chief Constables and points to an updated international transfers chapter in the Guide to Law Enforcement Processing that is still to come. Some of the material on Cloud First is general and does not address Part 3 transfers, so the asker may still want the timing of that forthcoming chapter.
How we got there
| Question item | Coverage | Specificity | Rationale |
|---|---|---|---|
| What guidance the Government has issued to police forces on meeting the international transfer provisions of Part 3 of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, in respect of their use of Microsoft services | Addressed | Direct | Statement 1 directly answers the question by stating that the government has issued no specific guidance to law enforcement, including the police, on the Part 3 international transfer requirements. Statement 2 explains that forces are the responsibility of Chief Constables, and statement 7 points to the forthcoming updated international transfers chapter in the Guide to Law Enforcement Processing. The Cloud First references (3–5) are general public-sector material and do not address Part 3 transfers specifically, so they add little, but the core question is answered plainly. |