FOI 25-141 Microsoft Contract
Freedom of Information Request
- Reference
- FOI 25-141 Microsoft Contract
- Request Date
- 24 Mar 2025
- Response Date
- 26 Mar 2025
- Information Requested
Last June (2024) it was disclosed in the press that any data uploaded to Microsoft cloud services by a customer may be transferred by them to other countries (i.e. outside the UK) and that all their support works under a worldwide follow-the-sun model.
Microsoft also recently confirmed completion of their EU data boundary work.
This is an new model where Microsoft say that most data will remain in the EU/EEA for their European customers.
UK customers do not benefit from the Microsoft EU Data Boundary guarantees, and should not therefore expect their data to cross the Microsoft data boundary into the EU. A result of that is that data which may previously have been sent to the EU probably does not go to the EU any more.
I am therefore interested in identifying where the data uploaded to Microsoft Cloud from the UK might now get sent, and to obtain any information held by the UK Government and public sector to understand and perhaps adapt to this changed Microsoft landscape.
A request like this has been sent to several dozen organisations to enable me to collect that information across a range of Government and public bodies in a representative sample; but I wish you to handle this request as being unique to your organisation and respond accordingly with the information that YOU hold please.
My request is:
Please supply me with any information, documentation, contract clause change or emails, etc. that you have received in the past two years which identify any countries where Microsoft can or actually do process any data you have uploaded to the following services:
1 - Any service operated by or on the Microsoft Azure cloud platform by any of your processors or contracted service providers (including a direct contract with Microsoft)
2 - Any Microsoft M365 service
For the purposes of this request you should consider any offshored administration or direct system support as being ‘processing’, whether this relates to personal data or not - this is not a GDPR specific request.- Response
The Microsoft contract for the Scottish Ambulance Service is held by NHS National Service Scotland and can be requested from - Freedom of information | National Services Scotland
As a tenant on the contract the Scottish Ambulance Service does not hold the information requested; it is for this reason we have applied section 17 of the Freedom of Information Scotland Act 2002 as information not held.
