Source · Select Committees · Public Accounts Committee
54th Report - Afghanistan Response Route
Public Accounts Committee
HC 1391
Published 14 November 2025
Conclusions (5)
2
Conclusion
Accepted
The Department did not have appropriate systems and controls in place at the time of the February 2022 breach to manage personal data in a high-risk environment. The Department did not use a caseworking system designed to hold and process high volumes of sensitive personal information relating to the government’s …
Government Response Summary
The government confirmed the Defence Afghan Relocations Assistance Policy Casework System (DACS) was implemented in May 2022, addressing vulnerabilities with stricter controls, audit logs, and secure data sharing protocols, and undergoes regular maintenance to prevent future data breaches.
3
Conclusion
Accepted
The Department did not do enough to learn the lessons from previous data breaches. Before the February 2022 data breach, the Department had policies in place to protect against the loss of personal information. After three separate data breaches in autumn 2021 relating to the ARAP, the Department reviewed its …
Government Response Summary
The government commissioned an independent MOD-wide Data Protection Review (McIvor Review) in 2023, the recommendations of which were implemented and detailed in a 7 October 2025 letter, and committed to providing a report on mandatory data protection training completion in a future update.
1
Conclusion
Accepted
On the basis of a report by the Comptroller and Auditor General (C&AG), we took evidence from the Ministry of Defence (the Department) on the circumstances surrounding the February 2022 data breach and the Department’s subsequent response, including setting up the Afghanistan Response Route (ARR) to relocate affected individuals.1 Since …
Government Response Summary
The government agreed to the conclusion, stating it will signpost to Home Office's quarterly immigration statistics on GOV.UK for Afghan Resettlement Programme data and provide broader updates on MOD's ARR relocation and resettlement activity where possible.
12
Conclusion
Accepted
The Department told us that it has since implemented a new system which has embedded controls to allow the Department to protect information more effectively, and that this meant that it is no longer using embedded or hidden data in spreadsheets.26 The Department 20 C&AG’s Report, para 11 21 C&AG’s …
Government Response Summary
The government states that it implemented the Defence Afghan Relocations Assistance Policy (ARAP) Casework System (DACS) in May 2022, which addressed vulnerabilities such as stricter access controls and audit logs.
22
Conclusion
Accepted
The Department and the C&AG have discussed whether they might develop a protocol for use in similar circumstances in future. The Department told us that a super-injunction was so unprecedented it was hard to think of circumstances in which it was likely to see one again.56 It also said that, …
Government Response Summary
The department will continue to work with the Committee and The Treasury will issue guidance on principles and practicalities of sharing information in the event of a super-injunction. Target implementation date: Spring 2026