The Department for Science, Innovation and Technology (DSIT) has published guidance for public sector organisations in using multi-region software-as-a-service (SaaS) and public cloud services.
It has recommended a multi-region approach and highlighted three key considerations around legal issues, data protection and security.
The guidance has been produced in response to the now widespread use of SaaS and public cloud services, which can be based in different parts of the world and often involve sending data between regions.
“We recommend that organisations adopt a multi-region approach, in which they make controlled, considered use of regions in a way which is compatible with UK law,” the document says.
This goes against sentiment in some quarters in favour of retaining citizens’ data inside the UK. The guidance points out that the distribution of public cloud within the country may not be sufficient to meet disaster response requirements, and that different regions have different resources and sustainability measures in place.
These factors add to the case to use SaaS and public cloud services spread across regions.
Key issues
The document highlights three key issues for consideration in following the approach, one being to obtain guidance from legal advisers and/or a data protection officer before doing business with a vendor of relevant services.
The others are to follow data protection legislation when storing or processing data outside the UK – with reference to guidance from the Information Commissioner’s office – and to ensure security policies are in place, including making sure that data is adequately protected from unauthorised access by parties with physical access to infrastructure.
The guidance has been prepared by the Government Digital Service, the National Cyber Security Centre, the Government Security Group, DSIT and the Department for Business and Trade.
