Questions Before ConcreteData centres in England and Wales
Cymraeg · Read in your language

Home › The issues › Who controls the data

The issues · Who controls the data

Stored here, but whose law applies?

A data centre in Wales may be run by a company based in another country. Storing information here does not, on its own, settle who can make that company hand it over, or whether a nation that depends on foreign providers has quietly given away part of its sovereignty.

Why it matters

Our health, tax, policing and personal records increasingly sit in commercial clouds run by a handful of global companies.

A company must obey the law of the country where it is based, wherever its servers are. That can conflict with UK data protection law.

Key points

  • Asked under oath in 2025 whether he could guarantee French citizens' data would not be passed to a foreign government, a senior cloud-company representative said he could not, adding that it had never happened.[1]
  • UK law says foreign court orders for personal data count only if backed by an international agreement, but that binds the company here, not the foreign state.[2]
  • After sanctions in 2025, an international court's chief prosecutor was cut off from his email; the provider later corrected what it had told a UK parliamentary committee about its role.[3]
  • In June 2026 a cross-party committee of MPs said Palantir's growing role in the UK public sector, including the NHS data platform, is 'an unacceptable point of weakness', and that relying on a few US-based providers is 'a strategic and economic vulnerability'.[4]
  • In the United States, the government admitted in court in 2026 that staff given wide access to Social Security records had shared data on a third-party server, and that it did not know what had been shared. Holding data at home did not prevent that.[5]
  • France requires its most sensitive public-sector cloud services to be protected against non-European laws. We have found nothing comparable in the UK.[6]
  • AI Growth Zones get faster planning, grid priority and cheaper power, but the UK gets no right to use the computing capacity in an emergency or to know what it is used for.[7]
  • In June 2026 a US government directive switched off two AI models for every user outside the US, wherever the data centre was.[8]

Questions you can ask

Drafted in full so you can copy, adapt and send them. See the questions tracker for all of them, with a downloadable version.

Ask: the Welsh Government minister responsible for digital and data policy, and in parallel Kanishka Narayan MP, Minister for Artificial Intelligence (Cabinet Office and Department for Business, Innovation, Science and Trade)

“What assessment has the Government made of the risk that data held for public bodies, businesses and citizens in Wales [the United Kingdom] by companies headquartered in another state could be accessed, copied or withheld as a result of that state's laws, sanctions or financial pressure on those companies, rather than under Welsh or UK law; and what safeguards, for example requirements comparable to France's SecNumCloud qualification, are in place or under consideration for public-sector data, including data held at facilities such as Bro Tathan?”

Follow-up: Not yet asked, so far as we know. A freedom of information request via WhatDoTheyKnow to the Welsh Government and Digital Health and Care Wales, for any assessment of foreign-law exposure in their main cloud contracts, would be a useful parallel step.

Ask: the UK Government and the Welsh Government

“Should certain categories of public-sector data (health, justice, policing and tax records) be subject to sovereignty protections beyond storage within the UK, and will public bodies disclose where backup copies of such data are held?”

Follow-up: A freedom of information request via WhatDoTheyKnow for the data-residency terms in a major public-sector cloud contract would test current practice.

2 more question(s) on the in-depth page.

Ask: Kanishka Narayan MP, Minister for Artificial Intelligence (Cabinet Office and Department for Business, Innovation, Science and Trade)

“What does the Government mean by sovereign AI capability in practice, and will it attach enforceable conditions to the planning, grid and energy advantages given to AI Growth Zones, including a right for the United Kingdom to reserve capacity in an emergency, a requirement that operators do not give another government's directions priority over their contracts with UK public bodies, disclosure to the Government of customer nationality and workload categories, and notification or prohibition of foreign military and intelligence workloads?”

Follow-up: Letter drafted October 2026. A request via WhatDoTheyKnow to the Department for Business, Innovation, Science and Trade for any agreements or heads of terms with AI Growth Zone operators would show whether any such terms exist.

Ask: Kanishka Narayan MP, Minister for Artificial Intelligence (Cabinet Office and Department for Business, Innovation, Science and Trade)

“Following the United States directive of June 2026 that removed access to two AI models for all non-US nationals, what assessment has the Government made of the exposure of UK public services and businesses to foreign export-control and similar decisions affecting AI services and computing capacity, and what contingency arrangements are in place?”

Follow-up: Letter drafted October 2026. A request via WhatDoTheyKnow for any such assessment could follow, although national-security exemptions may well be claimed.

Ask: the Welsh Government Cabinet Secretary responsible for the economy, as landowner at Bro Tathan

“Does the lease to Vantage Data Centers at Bro Tathan, or any related agreement, give the Welsh or UK Government any right to reserve computing capacity in an emergency, or any information about, or control over, the customers served and the work carried out on the site?”

Follow-up: Letter drafted October 2026. A request via WhatDoTheyKnow for the lease and related agreements could follow; commercial confidentiality is likely to be argued, but the public-interest test applies.

What you can do

  • Find the application on your council's planning website, and check what the documents say on this issue, or whether they are silent. See Start here.
  • Send the questions on this page in writing and keep copies.
  • If information is missing, ask for it through WhatDoTheyKnow.
  • Ask your town or community council to raise the issue in its response.
  • List your group in the campaigns directory so others can find you.

Read this issue in depth

Sources

  1. The Register, 'Microsoft admits it cannot guarantee data sovereignty' (25 July 2025), reporting the evidence of Anton Carniaux, Microsoft France's director of public and legal affairs, to a French Senate inquiry on 18 June 2025, in the context of the United States CLOUD Act. https://www.theregister.com/2025/07/25/microsoft_admits_it_cannot_guarantee/
  2. UK GDPR, Article 48 ('Transfers or disclosures not authorised by domestic law'), under which a judgment or decision of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforced if based on an international agreement in force between that country and the United Kingdom. The equivalent EU provision is at the second link. ; https://www.legislation.gov.uk/eur/2016/679/article/48
  3. The Register, 'Microsoft throws spox under the bus in ICC email flap' (18 February 2026), reporting Microsoft's apology to the House of Commons Business and Trade Committee and its request that the record be corrected; see also Computer Weekly, 'Microsoft's ICC email block reignites European data sovereignty concerns' (23 May 2025). ; https://www.theregister.com/2026/02/18/microsoft_asks_uk_parliament_to_correct_record/
  4. House of Commons Science, Innovation and Technology Committee, 'Rewiring the state: Delivering digital government' (report, 3 June 2026), conclusions and recommendations on Palantir, technological sovereignty and the CLOUD Act; see also the Committee's press notice of the same date. ; https://publications.parliament.uk/pa/cm5902/cmselect/cmsctech/61/report.html
  5. Government Executive, 'DOGE officials face Hatch Act referrals for work with org aiming to "overturn election results"' (January 2026), reporting the Justice Department's court filing of January 2026. https://www.govexec.com/management/2026/01/doge-officials-face-hatch-act-referrals-work-org-aiming-overturn-election-results/410825
  6. BSA | The Software Alliance, comments to ANSSI on SecNumCloud version 3.2 (15 November 2021), objecting to its 'immunity to extraterritorial legislation' requirements; for a summary of the requirements, including limits of 24% individually and 39% collectively on non-EU shareholdings, see Scalingo, 'SecNumCloud qualification (ANSSI): complete guide' (a cloud provider's guide, not an official source). ; https://www.bsa.org/policy-filings/france-bsas-comments-to-anssi-on-secnumcloud-version-32a
  7. Department for Science, Innovation and Technology, 'Delivering AI Growth Zones' (13 November 2025). https://www.gov.uk/government/publications/delivering-ai-growth-zones/delivering-ai-growth-zones
  8. Anthropic, 'Statement on the directive to suspend Fable 5 access' (12 June 2026). https://www.anthropic.com/news/fable-mythos-access