Information on Microsoft Cloud Service processing at The National Archives

Request

Please supply me with any information, documentation, contract clause change or emails, etc. that you have received in the past two years which identify any countries where Microsoft can or actually do process any data you have uploaded to the following services:

1. Any service operated by or on the Microsoft Azure cloud platform by any of your processors or contracted service providers (including a direct contract with Microsoft)
2. Any Microsoft M365 service

For the purposes of this request you should consider any offshored administration or direct system support as being ‘processing’, whether this relates to personal data or not – this is not a GDPR specific request.

Outcome

Information provided.

Response

In 2023 TPR entered into a Channel Partner Agreement with its Microsoft channel partner Phoenix Software Limited (and auxiliary agreements directly with Microsoft). The Channel Partner Agreement states personal data will be stored and accessed in the UK.
We have not supplied the signed Microsoft documents because they do not themselves identify where Microsoft can or do actually process data as detailed in your request, as they collectively refer out to, and incorporate the terms and provisions in the Microsoft Master Agreement, Product Terms, and the Online Services Terms and other relevant terms to the services. These link to the publicly available sites on the Microsoft website, see Microsoft Product Terms.