Cloud Security Bristol Aztec West — multi-cloud

Data residency

No general statutory requirement to host personal data in the UK. UK GDPR restricts international transfers (IDTA or the UK Addendum to EU SCCs where no adequacy applies), and the European Commission renewed its UK adequacy decisions on 19 December 2025 with a sunset in December 2031, so EEA-to-UK flows continue without additional safeguards. UK-only or adequate-country-only hosting is more often imposed by contract in public-sector and NHS agreements than by statute.

What shapes cloud procurement here

Public-sector cloud buying is heavily framework-mediated: Crown Commercial Service catalogues (G-Cloud, with G-Cloud 15 the first iteration under the Procurement Act 2023 and scheduled to run from September 2026) plus assurance expectations such as Cyber Essentials effectively gate access, so being listed matters as much as the technical fit. In financial services, FCA/PRA outsourcing and operational-resilience rules drive detailed exit-plan, sub-processor and concentration-risk questions, and since 13 July 2026 the Bank of England, PRA and FCA have overseen HM Treasury-designated critical third parties (the first designations covered AWS, Google Cloud, Microsoft and Oracle entities), which pushes those questions further into contract negotiation. Delivery is in English, all three major hyperscalers plus OCI have in-country regions so residency is rarely a blocker, and engineering hiring is concentrated in London with significant secondary markets in Manchester, Edinburgh, Leeds, Bristol and Cambridge.

Sector regulators