Report Summary
Issued 11 April 2025, this FOI response provides some information held regarding data sovereignty and explains that some information held is publicly available with a link provided to assist.
To access the full document please open the PDF document above.
To view as accessible content please use the sections below. (Note that some tables and appendixes are not available as accessible content).
Response
The Scottish Police Authority has considered your request under the Freedom of Information (Scotland) Act (FOISA).
The Authority can confirm information relevant to your request is held.
In terms of part one of your request, information which identifies countries where Microsoft can or actually do process any data uploaded by the Authority to any service operated by or on the Microsoft Azure cloud platform.
The Authority does not currently use Microsoft Azure directly or via processors. However, in dialogue with Microsoft for the Digital Evidence Sharing Capability (DESC) project, Microsoft confirmed that where certain services are not used, data sovereignty can be guaranteed.
In terms of part two of your request, information which identifies countries where Microsoft can or actually do process any data uploaded by the Authority to any Microsoft M365 service.
The Authority does not currently use O365. However, in dialogue with Microsoft around proposed use of O365, Microsoft refer to their Services Subprocessor List which is available on their website. This identifies subprocessors authorised to subprocess customer or personal data in Microsoft Online Services. This list is applicable for all Microsoft Online Services governed by the Microsoft Data Protection Addendum. Microsoft cannot produce a list of processors for each customer due to the dynamic nature of O365.
