Microservices Architecture for UK GovTech — GDS Service Standard Built In

GDS Service Standard and Microservices Design

GDS Service Standard Point 16 (Make your technology choices): government microservices must use technologies with large talent pools (Node.js, Python — not niche), be deployable on GOV.UK PaaS or AWS (GDS-preferred platforms), and have a documented run-book for each service. GDS architectural principles: loosely coupled services (each microservice independently deployable), event-driven communication (SNS/SQS — no synchronous service-to-service calls for non-critical paths), and common platform components (GOV.UK Pay, GOV.UK Notify, GOV.UK One Login — reuse rather than rebuild). ClickMasters GovTech microservices: each service is independently deployable, has its own CI/CD pipeline, and publishes to GOV.UK One Login or GOV.UK Pay rather than implementing authentication or payments from scratch.

GDPR Data Minimisation in Government Microservices

UK GDPR Article 5 (data minimisation): government microservices collect only the data necessary for the specific function. Microservices design for GDPR: (1) personal data stays in the service that owns it (Citizen Service owns citizen personal data — other services receive only a citizen reference ID, not personal data), (2) no personal data in event messages (SQS/SNS events carry only reference IDs — recipient service queries Citizen Service for personal data if needed), (3) personal data classification (each microservice documents which personal data fields it processes — in the Article 30 ROPA), (4) DSAR automation (DSAR request → each microservice queried for subject data → aggregated response within 30 days). GDS service assessment: DPIA reviewed at Beta assessment.

GOV.UK Common Components in Microservices

GOV.UK common components: (1) GOV.UK One Login (authentication — centralise identity, no custom auth in microservices), (2) GOV.UK Pay (payment processing — Payment Service wraps GOV.UK Pay, no direct card integration in other services), (3) GOV.UK Notify (communications — Notification Service wraps GOV.UK Notify, no direct Notify calls from individual services), (4) GOV.UK Design System React components (UI library — consistent cross-service UI). Microservices benefit: each common component consumed via a thin wrapper service — if GOV.UK Pay changes API, only Payment Service needs updating, not every microservice. GDS architecture principle: "use common government platforms."

NCSC Cloud Security Principles for GovTech Microservices

NCSC 14 Cloud Security Principles: government microservices must demonstrate compliance with NCSC Principles 1–14. Key principles for microservices: Principle 3 (Separation between users — each microservice has its own IAM role, no shared credentials), Principle 6 (Personnel security — access to each microservices production environment requires separate IAM permission grant), Principle 8 (Audit trail — CloudTrail per microservice), Principle 10 (Incident management — each microservice has an incident runbook referencing GOV.UK incident management process), Principle 13 (Audit information provision — each microservice exports CloudWatch logs to central SIEM for NCSC-required audit trail). ClickMasters produces NCSC Principle compliance statement for each GovTech microservice.

GDS Service Standard

UK GDPR

NCSC

Cyber Essentials Plus

PSBAR

GOV.UK Pay

GOV.UK Notify