Select committee: Public Accounts Committee
Conclusion 16
54th Report - Afghanistan Response Route
Published 14 Nov 2025
Addressed to HM Treasury
Public Accounts Committee Afghanistan Response Route (ARR) All items in this report Report on parliament.uk ↗ Inquiry on parliament.uk ↗
Conclusion (the committee's words)
We asked the Department about the reported 49 data breaches, which included seven which met the threshold for reporting to the ICO, and whether there were ongoing investigations relating to these. The Department said that five incidents related to the use in emails of the ‘to’ field instead of the ‘bcc’ field; one related to an incorrect link to an online portal; and one was the February 2022 data breach.37 We also asked the Department whether there were any further incidents which were not in the public domain. The Department told us that there are no further incidents which would meet the threshold for notification to the ICO, but that it is a feature of running a complex and large organisation that there will be accidental data breaches.38 In correspondence received after our evidence session the Department provided details of the 49 breaches, including clarifying that some of the incidents had been combined such that the seven incidents which met the threshold for reporting to ICO were being shown as five incidents on its list.39 34 Q 2 35 Q 3 36 Letter from Ministry of Defence, 7 October 2025 37 Qq 22–23 38 Qq 64–65 39 Letter from Ministry of Defence, 7 October 2025 12 Enabling effective scrutiny of the Afghanistan Response Route The Department’s approach to notifying Parliament
From: Public Accounts Committee, 54th Report - Afghanistan Response Route (HC 1391), 14 November 2025
Government response
Latest Treasury Minutes progress report to the Committee of Public Accounts on the Fifty-fourth Report of Session 2024-26
The government responded to the whole report on 4 June 2026 (deadline 14 January 2026).
Treasury minutes: Government response to the Committee of Public Accounts on the Fifty-fourth report from Session 2024-26
Published 19 January 2026.
Summary written by Accountability Index from the government's response. It is not the government's own words.The government agrees with four of the Committee's recommendations, including six-monthly updates on ARR resettlement from March 2026, and disagrees with the recommendation on separately capturing ARR costs.
- On updates, the government agrees to write to the Committee every six months from March 2026 until the ARR is complete, though it "may not always be possible to provide a precise breakdown by scheme".
- On the case working system, it agrees, stating the recommendation is implemented and that DACS (introduced in May 2022) addressed "many of the vulnerabilities", with the department "equipped with the right tools to minimise the risk" of a recurrence.
- On scrutiny, it agrees and gives a target date of Spring 2026. The Treasury will issue a Dear Accounting Officer letter on sharing information with the Comptroller and Auditor General in the event of a super-injunction.
- It disagrees on separate ARR costing, saying this would be "disproportionately complex and resource intensive", and instead offers an indicative cost allocation at the end of each financial year, included with the six-monthly updates.