Select committee: Public Accounts Committee
Conclusion 15
54th Report - Afghanistan Response Route
Published 14 Nov 2025
Addressed to HM Treasury
Public Accounts Committee Afghanistan Response Route (ARR) All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
We asked the Department about its response to a data breach which occurred in September 2021 relating to the ARAP scheme.31 The Department told us that it had engaged with the ICO in the autumn of 2021 follow multiple data breaches.32 The Department disclosed three data breaches which occurred in September and October 2021 in its 2021–22 Annual Report and Accounts.33 The Department said that its response was specific to the nature of those data breaches. This included requiring a second person to check emails which were sent outside the Department’s IT systems, and a system alert if the sender tried to email more than a certain 27 Information Commissioner’s Office, Record of ICO [Information Commissioner’s Office] involvement in the data breach announced by the MoD [Ministry of Defence] on 15 July 2025, para 16cii4a, July 2025 28 Letter from Ministry of Defence, 7 October 2025 29 C&AG’s Report, para 12 30 C&AG’s Report, para 16 31 Q 2 32 Q 9 33 Ministry of Defence, Annual Report and Accounts 2021–22, page 68, July 2022 11 number of addressees.34 The Department said that, once it discovered the February 2022 data breach, it carried out a much more fundamental review of its data protection and information handling policies, training and systems.35 In correspondence received after our evidence session the Department said that, since 2023, it had implemented further software improvements, alongside reviewing its processes and polices. In addition, it noted that that all staff are mandated to undertake various data and e-learning courses that offer awareness of good data management practices, and that it has produced bespoke training and educational materials to assist staff in putting their learning into practice.36
From: Public Accounts Committee, 54th Report - Afghanistan Response Route (HC 1391), 14 November 2025
Government response
Latest Treasury Minutes progress report to the Committee of Public Accounts on the Fifty-fourth Report of Session 2024-26
The government responded to the whole report on 4 June 2026 (deadline 14 January 2026).
Treasury minutes: Government response to the Committee of Public Accounts on the Fifty-fourth report from Session 2024-26
Published 19 January 2026.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government agrees with four of the Committee's recommendations, including six-monthly updates on ARR resettlement from March 2026, and disagrees with the recommendation on separately capturing ARR costs.
- On updates, the government agrees to write to the Committee every six months from March 2026 until the ARR is complete, though it "may not always be possible to provide a precise breakdown by scheme".
- On the case working system, it agrees, stating the recommendation is implemented and that DACS (introduced in May 2022) addressed "many of the vulnerabilities", with the department "equipped with the right tools to minimise the risk" of a recurrence.
- On scrutiny, it agrees and gives a target date of Spring 2026. The Treasury will issue a Dear Accounting Officer letter on sharing information with the Comptroller and Auditor General in the event of a super-injunction.
- It disagrees on separate ARR costing, saying this would be "disproportionately complex and resource intensive", and instead offers an indicative cost allocation at the end of each financial year, included with the six-monthly updates.