A 2017 UK assessment warned that police data on Microsoft Azure could face foreign access risks. The risks may still exist.
A Guardian investigation has surfaced a 2017 document signed off by then City of London police commissioner Ian Dyson, who also held the title of senior information risk owner for the entire country. That document reviewed 15 risks tied to moving police data onto Microsoft Azure. The files in question include criminal records, victim statements, internal emails, information from more than 40 UK police forces, and some material exceeding standard “official” classification, meaning it may sit at “secret” or “top secret” level.
The core weakness is control-plane trust: encryption at rest offers limited protection if the cloud provider controls keys or privileged access paths.
For police-grade data, inadequate tenant-visible logging creates a critical detection gap—unauthorized provider-level access could occur without reliable customer attribution or alerting.