In its response to this report, the government should set out how it intends to measure departmental and public body efforts to bring about difficult but necessary cultural changes in relation to data protection. It should name the departments and public bodies that have yet to adopt basic data hygiene practices, such as the use of Microsoft 365’s information protection labelling system, and state when this will be remedied. (Recommendation, Paragraph 49)