Kulpa Platforms Ltd

​​​Request ​795241378

Please provide the following information held by your organisation in relation to the product known as “Kulpa”, “Kulpa app”, “Kulpa Police Platform” or “kPP”, supplied by Kulpa Platforms Ltd (or any predecessor or related entity): 

1. Confirmation of whether your organisation has entered into any contracts, trial agreements, memoranda of understanding, data-sharing agreements, or service orders relating to this product at any time from 1 January 2020 to the present. 

2. For each such agreement, the start date, end date, and total contract value (or total amount paid). 

3. The pricing model applied (e.g. fixed annual force-wide licence, per-user licence, per-case or per-incident pricing), and the number of user licences where this information is held. 

4. Whether your organisation holds any business cases, Data Protection Impact Assessments (DPIAs), internal evaluations, or review reports relating to the adoption or use of Kulpa, and if so, copies of those documents with any necessary redactions applied. If any part of this request is refused, please provide the statutory basis for refusal and disclose any information that can reasonably be provided within the scope of the Act

Response

1. States of Jersey Police (SoJP) confirm that a contract, service level agreement, and data sharing/processing agreements are in place with Kulpa Platforms Ltd.

2. All agreements cover a trial period of 12 months, starting from September 2025. There is no cost to SoJP, although there is a financial arrangement between Kulpa and Digital Jersey. SoJP decline to provide the value of the contract between Kulpa and Digital Jersey, and Article 33 (commercial interests) of the Freedom of Information (Jersey) Law 2011 (FOI) applies.

3. SoJP decline to provide details of the pricing model and Article 33 FOI exemption applies. 121 police officers are currently licensed to use the Kulpa portal.

4. SoJP confirm that it holds a business case, a DPIA, and a draft review report. The business case and DPIA are attached to this response. Disclosure of certain information that could lead to the identity of individuals has been redacted in order to protect their privacy and Article 25(2) (personal data) FOI exemption has been applied. Where applicable, Article 33 (commercial interests) and Article 42(a-c) (law enforcement) has also been applied. The draft review report is exempt from disclosure and Article 35 (Formulation and development of policies) FOI applies.

DPIA KULPA 05.03.26 FOI.pdf​

Kulpa Business Case.pdf

Articles applied

Article 25(2) - Personal data

(2) Information is absolutely exempt information if –

(a) it constitutes personal data of which the applicant is not the data subject as defined in the Data Protection (Jersey) Law 2018; and

(b) its supply to a member of the public would contravene any of the data protection principles, as defined in that Law.

Article 33 - Commercial interests

Information is qualified exempt information if –

(a) it constitutes a trade secret; or

(b) its disclosure would, or would be likely to, prejudice the commercial interests of a person (including the scheduled public authority holding the information).

As Article 33 is a qualified exemption, it has been necessary to conduct both a prejudice and public interest test.

Prejudice test

Disclosure of contract values and related pricing information would be likely to prejudice the commercial interests of SoJP and its suppliers. Releasing this information would signal suppliers’ pricing strategies and margins, anchor expectations in upcoming negotiations, and reduce competitive tension, thereby limiting SoJP’s ability to secure favourable terms. It would also undermine supplier confidence in our handling of sensitive commercial information, negatively affecting ongoing and future relationships and ultimately diminishing value for money.

Public interest test

Factors favouring disclosure:

Transparency over how public funds are spent and whether value for money is obtained.

Public reassurance that the police operate efficiently, ethically, and deliver value for money.

Revealing contract values helps demonstrate that procurement decisions are responsible and competitive, ensuring efficient spending of public money.

Factors against disclosure:

Maintaining trust and confidence of suppliers supports open, constructive dialogue, enabling the authority to secure favourable terms and best value.

If suppliers lose confidence in SoJP’s ability to protect commercially sensitive information, this could harm ongoing and future relationships, ultimately undermining competitive procurement and value for money.

On balance, the factors against disclosure are considered to outweigh those in favour.

Article 35 Formulation and development of policies

As Article 35 is a qualified exemption, it has been necessary to conduct a public interest test.

The requested record is a draft review report produced to inform options and internal advice for a proposed policy on whether, and on what terms, SoJP should enter into/continue a long‑term relationship with Kulpa. It contains draft analyses and provisional findings that are still being tested and refined.

Public interest test

Factors favouring disclosure:

Transparency and accountability around the evidence base informing a potential long‑term adoption of a digital evidence platform by SoJP and any associated public expenditure. Disclosure promotes understanding of the case for change and supports informed public debate.

Factors against disclosure:

Preserving the “safe space” during live policy development. Premature disclosure of unfinished analysis and provisional findings is likely to chill frank internal discussion, constrain options appraisal, and reduce the quality of advice to decision‑makers while the policy is still being shaped.

Risk of misinformed or distorted debate. The draft contains findings under validation and estimates that may change; disclosure now, risks misleading public debate and diverting resources to address misconceptions, thereby hampering orderly policy‑making.

On balance, the factors against disclosure are considered to outweigh those in favour.

Article 42 – Law enforcement

Information is qualified exempt information if its disclosure would, or would be likely to, prejudice –

(a) the prevention, detection or investigation of crime, whether in Jersey or elsewhere;

(b) the apprehension or prosecution of offenders, whether in respect of offences committed in Jersey or elsewhere;

(c) the administration of justice, whether in Jersey or elsewhere;

As Article 42 is a qualified exemption, it is necessary to conduct both a prejudice and a public interest test.

Prejudice test

The withheld information comprises technical and operational details of the police‑facing Kulpa portal used to receive digital evidence. Disclosing these details would be likely to prejudice the prevention, detection and investigation of crime and the apprehension or prosecution of offenders, or the administration of justice. In particular, release of configuration specifics, security architecture, whitelisting/diagnostics patterns and audit

behaviours would materially increase the risk of targeted cyber‑attacks or evasion of evidential safeguards, undermining policing activity and evidential integrity. SoJP is satisfied the prejudice is real, non‑trivial and causally linked to disclosure; it arises at least to the “would be likely to prejudice” standard and, for some items, to “would prejudice”.

Public interest test

Factors in Favour of Disclosure

There is a legitimate public interest in transparency about how digital evidence is received, processed and safeguarded by law‑enforcement systems.

Openness can enhance public confidence that appropriate controls, governance and assurance standards are in place.

Some of this interest is addressed through the high‑level information already available in the unredacted sections of the DPIA, including system purpose, data flows and assurance measures.

Factors Against Disclosure

Releasing technical configuration details, security architecture, diagnostic behaviours or whitelisting patterns presents a real risk of facilitating cyber‑attacks, exploitation or evasion of evidential safeguards.

Such disclosure could materially undermine the effectiveness of law‑enforcement operations and compromise the integrity and admissibility of digital evidence.

Protecting policing capabilities and preventing the circumvention of security controls carries significant public interest weight.

The public interest in transparency is substantially met by disclosure of general information that does not expose operational vulnerabilities.

On balance, the public interest in safeguarding effective law‑enforcement operations, protecting evidential integrity and preventing cyber‑enabled interference outweighs the interest in further disclosure of material that could be exploited to compromise policing systems or evade controls.​