Microsoft cloud platform exposes UK police data to US government access risks

Sensitive UK police data, including information about victims, witnesses, and active operations, sits on Microsoft cloud infrastructure that an official security assessment found vulnerable to foreign government access. That includes the US government, which can compel disclosure under its own laws regardless of where the data physically resides. The scope of exposure Microsoft’s hyperscale cloud architecture routes data through a sprawling global network. Reports from investigations and Freedom of Information disclosures between 2024 and 2026 indicate that UK policing data could potentially be accessed from 105 countries via various subprocessors. Microsoft itself has acknowledged it cannot guarantee data sovereignty for M365. The company also said it cannot operationalize case-by-case consent for international data transfers under Part 3 of the Data Protection Act 2018, which governs how law enforcement agencies handle personal data. When asked for detailed risk assessments covering data transfers to non-adequate jurisdictions, Microsoft cited commercial confidentiality. Concerns have been raised that encryption keys held by Microsoft and its partners could enable compelled discl...