The supplier shall not process or otherwise transfer Home Office data outside of the United Kingdom unless the prior written consent of the Home Office has been obtained.

The Home Office holds one of the largest and most comprehensive data sets across Government. Ensuring this data is safe, secure, and is able to be fully utilised to the maximum benefit to the taxpayer is our primary concern. The Home Office agreement with AWS is based on predicted usage and is part of the Crown Commercial contract, called the One Gov Value Agreement 2 (OGVA2) which is a framework allowing all Government departments to combine to leverage an unprecedented discount on AWS services which would not be possible if each department held separate contracts.

AWS provide the below statement which reinforces our requirement under a shared responsibility model to secure our data in such a way that we retain control of any disclosure:

“Protecting the privacy of our customers is something that we take seriously at AWS. We recommend that customers encrypt their data as part of their overall security model when adopting cloud, and there are AWS services available to help you encrypt your data in transit and at rest (such as AWS Key Management Service and AWS CloudHSM). To be clear, the US Cloud Act / US Patriot Act do not give US Law Enforcement unfettered access to data, and only apply to evidence sought in connection with a crime over which the US has jurisdiction. We have a history of challenging government requests for customer information that we believe are inappropriate and, where we need to act to protect customers, we do; we will notify customers before disclosing any data and please be assured that content that has been encrypted is rendered useless without the applicable decryption keys.”

The supplier has no access to any of the data hosted in the AWS cloud. Certain Policing services are hosted in this environment which are assured and approved for this use. The extent of the processing of personal data covered in the contract is the provision of storage.

The nature of the data stored is entirely under the control of the Home Office and, due to the security controls in place, AWS has no knowledge of what is stored, nor is it provided with instructions on the nature of the processing. By design, the contract does not contain details that would that are not necessary to disclose to AWS for it to be bound by a contract that provides the necessary protections to personal data. The Information Commissioner’s Office is aware of this approach. AWS has no access to any personal data under the controllership of policing or the Home Office.