The Guardian reported on 18 September 2026 that sensitive UK police data is held on Microsoft Azure despite an official UK security assessment identifying risks of compromise by foreign actors and the US government. The files include criminal records, victim statements, internal emails and information held by more than 40 police forces across the UK. Some files exceeded “official” classification, according to a police document, which raised the possibility that they could be classed as “secret” or “top secret”.
The 2017 decision
British police decided in 2017 to put some of their most sensitive data on Microsoft’s cloud platform. The meeting was chaired by Ian Dyson, then police commissioner of the City of London and senior information risk owner for British policing. The assessment considered both Office 365 and the Azure cloud infrastructure behind those services.
The document listed 15 risks. It said Microsoft software “carries vulnerabilities which will be exploited by cybercriminals and other threat actors in due course”. It also said police forces could not be certain where their data would be processed or stored, and that police data and metadata could be transmitted and stored worldwide by Microsoft.
The assessment identified a specific risk from “US government insiders”. It said there was a risk of compromise of sensitive data shared by, or taken from, Microsoft by the US government and released by US government insider attackers. The document also said a significant volume of the data intended for migration exceeded “official” classification.
Mitigations and access controls
The mitigations in the assessment included prompt server repair, keeping systems up to date and using antivirus software. For the risks around US government insiders and worldwide storage, it suggested applying Microsoft’s native encryption and leaving the final decision to individual police chiefs.
Cloud specialists and Microsoft engineers said those mitigations would not prevent Microsoft employees from accessing UK police data. They also said the measures would not stop the US government obtaining British policing files. The National Police Chiefs’ Council said access to cloud data is limited to those with a genuine need and subject to strict controls.
A Microsoft engineer said the information “could be viewed by hundreds of people around the world, some of them not vetted, many of them not directly employed by Microsoft”. Microsoft said it had “strong guardrails” around engineer access to data.
Data location and legal exposure
The NPCC said UK policing as standard requires the use of UK-only datacentres. It added that Microsoft employees could access the data on occasion to provide support. A police spokesperson said that, under the contract with Microsoft, it did not expect any sharing with the US government without the express permission of the UK government.
Microsoft said it “does not provide any government with direct or unfettered access to customer data”. It also said it had “never provided UK government data in response to any US or global authority request”. In a disclosure to Police Scotland in 2023, Microsoft said data “can go outside the UK” and that it “cannot guarantee data sovereignty”.
Dave Michels, a researcher with the Cloud Legal Project at Queen Mary University of London, said there is “a deep dependency on US hyperscalers” across UK government. He said Microsoft’s cloud is a global network of datacentres, and that data location is not the only issue because engineers and subcontractors in many countries maintain the systems. Some engineers can access customer data directly as part of support, while others can see key features of what the data includes.
Douwe Korff, professor of international law at London Metropolitan University, said US law, including the Cloud Act, allows US authorities to access data held by US cloud companies, including data held abroad. He said Microsoft, Amazon and Google have said they would fight such requests, but there is “nothing that is legally binding” that would prevent them from sharing other governments’ data if US authorities demanded it.
Operational dependence
Almost every UK police force now depends on Microsoft Azure. Some forces began migrating information in 2017, while Police Scotland is still finalising its adoption. A source who has held senior policing roles said the files cover intelligence, body-worn video, digital evidence, case files and non-law-enforcement data.
The UK government spends at least GBP 1.9bn each year on Microsoft software. Up to 60% of its IT infrastructure is hosted on cloud platforms. Britain’s intelligence data is hosted on Amazon cloud services, customs data is also hosted on Amazon, and the Ministry of Defence uses Azure.
Mark Butcher, a cloud expert who advises across government, said government security departments are aware of the risks. He said senior leaders often rely on Microsoft’s assurance that disclosure to US authorities would not happen. A former senior policing source said cloud logging might not necessarily show whether there had been a problem, adding: “We really don’t know if the data has been breached or not.”
When police records, victim statements and evidence sit on Azure, the controls around support access, sovereignty claims and legal compulsion are the practical questions ECS's Security topic deals with, alongside Sentinel, Purview and DevSecOps. Sessions and workshops give attendees room to compare contractual limits, tenant controls and practitioner experience from regulated environments. Attend with the scenarios that are difficult to settle from policy documents alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.