Separate the questions before choosing a supplier
A location label answers only part of a procurement decision. Ask where records are stored, where processing occurs and who can access them for support. Then ask which organisation contracts with you and what legal duties may apply to that provider.
We recommend reviewing the actual data and contract rather than deciding that all overseas providers are unsuitable or all UK-labelled storage is sufficient. Sensitive legal or medical records may need a more detailed review with your data protection adviser.
A comparison for an owner
| Question | Residency focus | Sovereignty and legal-access focus |
|---|---|---|
| Where is it? | Storage and processing locations | Which laws and legal processes may apply? |
| Who can reach it? | Support and subprocessor locations | Authority for access and disclosure |
| What proves it? | Contractual location commitments | Contract, provider structure and legal advice |
| What can we change? | Region and processing choices | Data scope, encryption, keys and supplier choice |
Read reported cases in their context
The Register reported that a Microsoft France executive told a French Senate hearing in 2025 that he could not guarantee protection from a legally justified US disclosure demand, while saying the situation described had not happened. Read The Register's 25 July 2025 report.
The Register also reported Microsoft's account of examining requests, resisting unfounded demands and seeking to notify affected customers. Read The Register's 25 July 2025 report.
Those are reported statements at a particular hearing. They do not establish that a particular small business has been targeted or that an ordinary subscription is unlawful. They do show why a storage location should not be presented as an absolute promise about legal access.
Keep transfer rules distinct from legal requests
The UK Government's Data Access Agreement factsheet describes direct cross-border law-enforcement requests for the prevention, detection, investigation and prosecution of serious crime. Read UK Government Data Access Agreement factsheet.
That agreement concerns law enforcement. Do not use it as a general explanation of why a commercial transfer of personal information is permitted. It addresses a different question from the safeguards and responsibilities in your own processing arrangements.
The ICO's international transfers guidance says a restricted transfer must be covered by adequacy regulations, appropriate safeguards or an applicable exception. Read ICO international transfers guidance.
Map the information you share, the organisations involved and the reason for each transfer. Ask an adviser to check the applicable route and any assessment needed for your circumstances. A sales assurance is not a substitute for that work.
Make a practical purchasing decision
List the records whose sensitivity warrants special treatment. Compare the current arrangement with a proposed alternative on features, cost, access, export options and the ability to recover. Moving providers can still leave you dependent on the same administrator, connection or sign-in.
For particularly sensitive records, assess encryption with keys under your control. Include key recovery and the impact on search and ordinary work. A system nobody can recover is not a sound fallback. Keep independent backup and a documented exit route alongside the legal review.
This guide is general information, not legal advice. Speak to your data protection adviser about your own obligations.
What we can do for you
We help you agree priorities, document workarounds and check the recovery arrangements. Continuity planning is quoted as a fixed fee after a free 30 minute call. The technical fallbacks use our standard prices.
| Technical fallback | From per month, plus VAT |
|---|---|
| Independent Microsoft 365 backup | £2.50 per user, included as standard in support agreements |
| Email filtering | £1.50 per user, not needed as an additional filter with Microsoft 365 Premium |
| Server backup with cloud failover | £35 per server |
| Desktop and laptop backup | £10 per device |
| Business phone system | £11 per user |
Monthly starting prices exclude VAT and use a 3 year term billed monthly. Shorter terms cost a little more. Your price and the actual fallback arrangements are confirmed in a written quote.
Questions about this service
Does a backup keep every service running?
No. Backup provides a recovery copy. Alternative access, replacement equipment, staff instructions and decisions are separate parts of a continuity plan.
Will you guarantee a recovery time?
We agree targets after reviewing the systems, dependencies and test results. A planning target or example is not a contractual recovery guarantee.
Is security monitoring an out-of-hours helpdesk?
No. Our security partner's analysts provide the contracted 24x7 account monitoring. Normal support hours are Monday to Friday, 08:30 to 17:30, excluding UK bank holidays.
Where should we start?
Call 01494 866668 for a free 30 minute planning conversation. Describe the activity you could least afford to lose and the arrangements already in place.
Continuity tools
- Free business continuity plan template for small businesses
- How much does an hour of IT downtime cost your business?
- Find your single points of failure
Use these planning aids to prepare a conversation. Do not put passwords or confidential records in a worksheet.
Related information
Talk to us about your business
Prefer us to contact you? Request a call back.