Parliamentary Search

Written question asked by Anna Sabine (Liberal Democrat) on Tuesday, 16 June 2026, in the House of Commons. It was due for an answer on Thursday, 18 June 2026. It was answered by Ian Murray (Labour) on Wednesday, 24 June 2026 on behalf of the Department for Science, Innovation and Technology.

Oracle Corporation UK: Contracts

Question

To ask the Secretary of State for Science, Innovation and Technology, whether the Government has conducted a legal assessment of the interaction between the US CLOUD Act and the use of Oracle’s UK Sovereign Cloud for public sector data.

Answer

Where cloud service providers may be subject to overseas legal obligations, including the United States CLOUD Act, departments are responsible as data controllers to assess and mitigate the associated risks.

The UK has an adequacy decision for certain transfers to the US under the UK Extension to the EU-US Data Privacy Framework. This decision assessed US laws and practices relating to government access to data, including the US CLOUD Act. This analysis is published and available on GOV.UK. Where adequacy is not relied upon, organisations must use alternative safeguards in line with Article 46 of the UK GDPR, such as standard contractual clauses.

Departments’ assessments enable them to identify and implement proportionate mitigations. These may include technical controls, such as encryption and strict access restrictions, contractual safeguards with service providers, and organisational measures governing data handling and oversight. Where relevant, departments must also assess the application of UK international data transfer provisions and ensure appropriate safeguards are in place.

Secondary information

Type
Written question
Reference
10437
Session
2026-27
Subjects
Contracts Public sector Oracle Corporation UK
Link
View this Written question on www.parliament.uk