FOI/202600519882 · FOI · not held
Hosting jurisdiction and data residency of Scottish Government digital communication service information: FOI release
Information requested
Hosting jurisdiction and data residency of the Scottish Government digital communication service information.
Response
1. Any contract or data processing agreement between the Scottish Government and Netcompany governing the digitalcommunication service, and a summary of its key data-protection terms, in any provisions on data residency and on the use of sub-processors.
The Scottish Government holds recorded information within the scope of your request. This includes a Pre‑Commercialisation Agreement ﴾PCA﴿ between the Scottish Government and Netcompany UK Ltd relating to CivTech Challenge 9.8, and a Call‑Off Contract awarded under the Software Value Added Reseller ﴾SVAR﴿ Framework, with Computacenter UK Ltd acting as reseller for Netcompany. These documents together govern the development and delivery of the Digital Mailbox service.
Both agreements require compliance with applicable data protection legislation, including the UK General Data Protection Regulation ﴾UK GDPR﴿ and the Data Protection Act 2018. They also provide for arrangements to define the respective roles of the parties ﴾for example, controller and processor responsibilities﴿, either within the contract or through associated data processing provisions.
In relation to data residency, the Call‑Off Contract specifies that Scottish Government data must be stored, accessed and processed within the United Kingdom and/or the European Economic Area. This requirement applies not only to the primary supplier but also to any authorised third‐party sub‑processors used in delivering the service. The contract further requires that the service is deployed within the Scottish Government’s AWS Cloud Platform Services, which provides a managed hosting environment aligned with government security and cloud standards.
With regard to sub‑processors, the contractual arrangements require that any third parties engaged by the supplier are subject to appropriate contractual controls. These include obligations to meet equivalent data protection and security standards, with the primary supplier remaining responsible for ensuring their compliance.
The contracts also include provisions requiring the implementation of appropriate technical and organisational security measures, adherence to recognised security standards, and protection of confidential information against unauthorised access or disclosure.
While relevant information has been provided in summary form above, some detailed contractual information has been withheld under section 33﴾1﴿﴾b﴿ ﴾commercial interests﴿ and section 36﴾2﴿ ﴾confidentiality﴿ of the Freedom of Information ﴾Scotland﴿ Act 2002, where disclosure would be likely to prejudice commercial interests and/or breach obligations of confidence.
2. The country and, if held, the data-centre location in which the service's data will be hosted, together with the identity of the entity that operates the underlying infrastructure, including whether a hyperscale cloud provider (for example Amazon Web Services, Microsoft Azure or Google Cloud) is used at any layer.
The Scottish Government holds recorded information within the scope of this request. The service is hosted within the Scottish Government’s cloud environment, specifically utilising Amazon Web Services (AWS) Cloud Platform Services. This is a managed cloud hosting environment provided to support Scottish Government digital services and ensure alignment with its security, governance and operational standards.
In terms of geographic location, the contract requires that all Scottish Government data associated with the service is stored, accessed and processed within the United Kingdom and/or the European Economic Area. The detailed data‑centre location (for example, specific AWS regions or availability zones) is not routinely disclosed.
The underlying infrastructure is operated by Amazon Web Services as the cloud service provider, with the Scottish Government managing its own tenant environment within that platform. The supplier (Netcompany, via Computacenter) is responsible for deploying and operating the application within this environment in accordance with the contractual requirements and Scottish Government standards.
Accordingly, a hyperscale cloud provider is used as part of the service architecture, specifically Amazon Web Services, at the core hosting layer. Any use of additional infrastructure or supporting services is subject to the same contractual requirements in relation to data protection, security and data residency described above.
While the Scottish Government holds some further technical detail regarding the specific configuration and location of infrastructure, this information has been withheld under section 35(1)(a) of the Freedom of Information (Scotland) Act 2002 (law enforcement), as disclosure would, or would be likely to, prejudice the prevention or detection of crime and the security of public sector digital infrastructure. In particular, detailed information about precise hosting locations, system configuration and infrastructure design could increase the risk of unauthorised access or malicious activity. Some information has also been withheld under section 33(1)(b) (commercial interests), where disclosure would be likely to prejudice the commercial interests of suppliers involved in delivering the service.
3. Whether the Scottish Government has assessed whether the hosting provider, or any sub-processor, is subject to the United States CLOUD Act (2018), and a copy of any such assessment held.
The Scottish Government has considered your request for recorded information relating to any assessment of the United States CLOUD Act (2018) in respect of the hosting provider or any sub‑processors. Following searches of the information held, the Scottish Government does not hold a formal recorded assessment specifically assessing the application of the United States CLOUD Act to this service.
However, the Scottish Government has undertaken data protection and security assurance activities in relation to the service, including compliance with UK GDPR and the Data Protection Act 2018, and the application of contractual requirements relating to data residency, security and supplier obligations. These measures include requirements that data is stored, accessed and processed within the UK and/or EEA and that suppliers and any sub‑processors comply with equivalent data protection and security standards under contractual controls.
Under section 17(1) of the Freedom of Information (Scotland) Act 2002, the Scottish Government is not required to create information in order to respond to a request, and where no recorded information is held, this must be stated.
4. Any Data Protection Impact Assessment held for the service that addresses the risk of extraterritorial compelled disclosure of the data it holds, and a copy.
The Scottish Government has considered your request for any Data Protection Impact Assessment (DPIA) held for the service that addresses the risk of extraterritorial compelled disclosure of data. The Scottish Government holds DPIA‑related information for the service; however, following review of the recorded material, no specific DPIA section or standalone assessment has been identified that explicitly addresses the risk of extraterritorial compelled disclosure (for example under foreign legislation such as the United States CLOUD Act) as a distinct category of risk.
The DPIA material that is held considers a range of data protection risks associated with the service, including risks relating to the processing, storage and security of personal data, and includes mitigations such as compliance with UK GDPR and the Data Protection Act 2018, contractual controls on data residency, and requirements for appropriate technical and organisational security measures.
These include requirements that data is stored, accessed and processed within the UK and/or EEA and that suppliers and any sub‑processors are subject to equivalent data protection and security obligations.
A copy of DPIA material has been considered for disclosure. However, this information contains sensitive detail relating to system architecture, security controls, and risk assessments. Accordingly, some information has been withheld under section 35(1)(a) of the Freedom of Information (Scotland) Act 2002 (law enforcement), as disclosure would, or would be likely to, prejudice the prevention or detection of crime and the security of public sector systems. In addition, certain information has been withheld under section 33(1)(b) (commercial interests), where disclosure would be likely to prejudice the commercial interests of the suppliers involved.
Where possible, relevant information has been summarised above in line with the Scottish Government’s obligations under FOISA.
5. Whether the Scottish Government holds any recorded information showing it has considered whether recent demands by United States authorities for data held by major cloud and technology providers represent a change in the level of risk that requires the data protection impact assessment for this service to be reviewed under Article 35(11) of the UK GDPR, together with a copy of any such review, or of any decision or conclusion recorded as to whether such a review is required.
The Scottish Government has considered your request for recorded information relating to whether it has assessed any change in the level of risk arising from recent actions by United States authorities, and whether this has triggered a review of the Data Protection Impact Assessment (DPIA) under Article 35(11) of the UK GDPR. Following searches of the information held, the Scottish Government does not hold specific recorded information demonstrating that a formal review has been undertaken on this basis, nor a recorded decision concluding that such a review is required or not required.
The Scottish Government keeps its digital services under ongoing review in line with its obligations under data protection legislation and wider information governance frameworks. DPIAs are living documents and may be updated where there is a change in the nature, scope, context or purposes of processing, or where new risks are identified. However, FOISA provides a right of access to recorded information only, and does not require public authorities to create information in response to a request, including by forming new judgements or providing opinions where these are not already recorded.
Accordingly, under section 17(1) of the Freedom of Information (Scotland) Act 2002, the Scottish Government confirms that it does not hold recorded information within the scope of this part of your request.
6. Whether the procurement, meaning CivTech Challenge 9.8 and any resulting contract, included any requirement, condition or weighted award criterion relating to data residency or jurisdictional control, and if so, a copy of the relevant wording.
The Scottish Government holds recorded information within the scope of your request. In relation to the CivTech Challenge 9.8 procurement and the resulting Call‑Off Contract, the requirements included provisions relevant to data residency, security and data governance. While the procurement did not use the specific term “jurisdictional control” as a standalone criterion, it did include mandatory requirements and conditions relating to the location and handling of data as part of the non‑functional requirements and security standards.
In particular, the Call‑Off Contract requires that Scottish Government data is stored, accessed and processed within the United Kingdom and/or the European Economic Area. This requirement applies to both the primary supplier and any third‑party sub‑processors involved in delivering the service. The procurement documentation also specified that the solution must be deployed within the Scottish Government’s cloud environment, specifically the AWS Cloud Platform Services, and must comply with Scottish Government security policies, UK GDPR, and recognised standards such as ISO 27001 and NCSC guidance. These requirements formed part of the baseline conditions that solutions were required to meet in order to be considered compliant.
Additionally, the non‑functional requirements included explicit security provisions requiring suppliers to ensure that all contractual security conditions are applied to sub‑processors and that appropriate controls are in place to protect Scottish Government data.
These requirements formed part of the overall evaluation of bidder proposals as compliance criteria within the procurement process.
However, the Scottish Government does not hold a separate recorded document identifying data residency or jurisdictional control as a distinct weighted award criterion in isolation.
Relevant extracts of contractual wording have been summarised above. A copy of the full procurement and contractual documentation has been considered for disclosure; however, some detailed information has been withheld under section 33(1)(b) (commercial interests) and section 35(1)(a) (law enforcement/security) of the Freedom of Information (Scotland) Act 2002, where disclosure would be likely to prejudice commercial interests and/or the security of the service.
7. Where no such requirement was set, what contractual or technical measures, if any, prevent the service's data being stored on, or accessed from, infrastructure outside the United Kingdom, including for replication, backup or disaster recovery.
The Scottish Government holds recorded information within the scope of your request. The contractual arrangements for the service include requirements that Scottish Government data is stored, accessed and processed within the United Kingdom and/or the European Economic Area, and that these requirements apply to both the primary supplier and any authorised sub‑processors.
In addition to these contractual requirements, the service is deployed within the Scottish Government’s AWS Cloud Platform Services environment, which provides controls over the geographic location of infrastructure used to host the service. This includes the configuration of cloud resources within specified regions, and standard controls governing how data is stored, replicated and backed up within that environment, in line with Scottish Government policy and security standards.
The contractual security provisions further require that all data protection and security obligations are flowed down to any sub‑processors, and that appropriate technical and organisational measures are in place to prevent unauthorised access, transfer or disclosure of data. This includes requirements relating to access control, encryption, monitoring and audit, and compliance with recognised standards such as ISO 27001 and relevant National Cyber Security Centre guidance.
Taken together, these contractual and technical measures are intended to ensure that the service operates within the defined data residency constraints and that data is not routinely stored or processed outside the UK or EEA, including in the context of replication, backup or disaster recovery. However, the Scottish Government does not hold recorded information describing a single control that, in isolation, prevents all potential access from outside the UK, as the controls operate in combination through contractual obligations, cloud configuration and security controls.
Some detailed technical and architectural information has been withheld under section 35(1)(a) of the Freedom of Information (Scotland) Act 2002 (law enforcement), as disclosure would, or would be likely to, prejudice the prevention or detection of crime and the security of public sector systems. Certain information has also been withheld under section 33(1)(b) (commercial interests), where disclosure would be likely to prejudice the commercial interests of suppliers involved in delivering the service.
8. Whether the Scottish Government has sought or received legal advice on whether the UK-US Data Access Agreement, in force 3 October 2022, affects the exposure of this service's data, and if so, a copy or summary of that advice.
The Scottish Government has considered your request for recorded information relating to whether it has sought or received legal advice on the UK‑US Data Access Agreement, which came into force on 3 October 2022, and its potential impact on the exposure of data within this service. Following searches of the information held, the Scottish Government does not hold specific recorded information in the form of legal advice addressing the application of the UK‑US Data Access Agreement to this service. More generally, the Scottish Government takes into account applicable legal and regulatory frameworks when designing and operating digital services, including compliance with UK GDPR, the Data Protection Act 2018 and associated international transfer considerations. However, FOISA provides a right of access to recorded information only, and does not require public authorities to create new information or provide legal interpretations where such material is not already held in recorded form.
Accordingly, under section 17(1) of the Freedom of Information (Scotland) Act 2002, the Scottish Government confirms that it does not hold recorded information within the scope of this part of your request.
About FOI
The Scottish Government is committed to publishing all information released in response to Freedom of Information requests. View all FOI responses at https://www.gov.scot/foi-responses.
Contact Please quote the FOI reference Central Correspondence Unit Email: contactus@gov.scot Phone: 0300 244 4000 The Scottish Government St Andrew's House Regent Road Edinburgh EH1 3DG
Detected exemption language
While relevant information has been provided in summary form above, some detailed contractual information has been withheld under section 33﴾1﴿﴾b﴿ ﴾commercial interests﴿ and section 36﴾2﴿ ﴾confidentiality﴿ of the Freedom of Information ﴾Scotland﴿ Act 2002, where disclosure would be likely to prejudice commercial interests and/or breach obligations of confidence. While the Scottish Government holds some further technical detail regarding the specific configuration and location of infrastructure, this information has been withheld under section 35(1)(a) of the Freedom of Information (Scotland) Act 2002 (law enforcement), as disclosure would, or would be likely to, prejudice the prevention or detection of crime and the security of public sector digital infrastructure. Some information has also been withheld under section 33(1)(b) (commercial interests), where disclosure would be likely to prejudice the commercial interests of suppliers involved in delivering the service. Under section 17(1) of the Freedom of Information (Scotland) Act 2002, the Scottish Government is not required to create information in order to respond to a request, and where no recorded information is held, this must be stated. Accordingly, some information has been withheld under section 35(1)(a) of the Freedom of Information (Scotland) Act 2002 (law enforcement), as disclosure would, or would be likely to, prejudice the prevention or detection of crime and the security of public sector systems.
Attachments
No attachments found.