On the basis of the clarifications that have been provided by the Deputy’s Office to my Department’s officials, I wish to confirm that my Department does not currently use cloud based commercial services for storing personal data in relation to members of the public.
In general, Government Departments, as Data Controllers, are required to have binding contracts in place with service providers who process personal data on their behalf. The content of these contracts are set out in Article 28 of the General Data Protection Regulation. My Department has a number of these contracts in place in with service providers in areas such as ICT support, market research and research consultancy. All new contracts with such data processors include provisions for data processing. Some older contracts are currently being updated to include these provisions.