Afghanistan Response Route (ARR)

Public Accounts Committee Open Inquiry
Opened: 13 Oct 2025 Parliament page
The Afghanistan Response Route (ARR) was set up by the Ministry of Defence to mitigate the security risks arising from a data protection breach and the unauthorised disclosure of personal information about Afghan citizens which occurred in February 2022. The National Audit Office (NAO) has published a report on the … Read more
26 Conclusions
1 Report
4 Letters
Activity timeline 6 events
14 May
2026
Correspondence
20 Apr
2026
Correspondence
19 Jan
2026
Report published
14 Nov
2025
Report published
16 Oct
2025
Correspondence
3 Sep
2025
Correspondence
Title HC No. Published Items Response
54th Report - Afghanistan Response Route HC 1391 14 Nov 2025 26 Responded
Recommendations & Conclusions
6 results
Clear
2 Conclusion Accepted
54th Report - Afghanistan Response…
Require assurance that new casework system prevents recurrence of Afghan resettlement data breaches
The Department did not have appropriate systems and controls in place at the time of the February 2022 breach to manage personal data in a high-risk environment. The Department did not use a caseworking system designed to hold and process … Read more
Government Response
The government confirmed the Defence Afghan Relocations Assistance Policy Casework System (DACS) was implemented in May 2022, addressing vulnerabilities with stricter controls, audit logs, and secure data sharing protocols, and undergoes regular maintenance to prevent future data breaches.
HM Treasury
View details
3 Conclusion Accepted
54th Report - Afghanistan Response…
Require Department to detail data protection policies, assurance, and changes made after breaches
The Department did not do enough to learn the lessons from previous data breaches. Before the February 2022 data breach, the Department had policies in place to protect against the loss of personal information. After three separate data breaches in … Read more
Government Response
The government commissioned an independent MOD-wide Data Protection Review (McIvor Review) in 2023, the recommendations of which were implemented and detailed in a 7 October 2025 letter, and committed to providing a report on mandatory data protection training completion in a future update.
HM Treasury
View details
1 Conclusion Accepted
54th Report - Afghanistan Response…
Committee took evidence on February 2022 data breach and Afghanistan Response Route
On the basis of a report by the Comptroller and Auditor General (C&AG), we took evidence from the Ministry of Defence (the Department) on the circumstances surrounding the February 2022 data breach and the Department’s subsequent response, including setting up … Read more
Government Response
The government agreed to the conclusion, stating it will signpost to Home Office's quarterly immigration statistics on GOV.UK for Afghan Resettlement Programme data and provide broader updates on MOD's ARR relocation and resettlement activity where possible.
HM Treasury
View details
11 Conclusion Accepted
54th Report - Afghanistan Response…
February 2022 data breach caused by inappropriate systems and hidden data.
We asked the Department to outline how the February 2022 data breach had occurred. The Department told us that the systems it used to manage case work for the ARAP scheme—a Sharepoint site and Excel spreadsheets—were not appropriate for handling … Read more
Government Response
The Defence Afghan Relocations Assistance Policy (ARAP) Casework System (DACS) was introduced in May 2022 which addressed many of the vulnerabilities, including stricter access controls, audit logs, and protocols to limit data sharing outside secure systems and new software introduced in January 2025 enhances their ability to securely share data.
HM Treasury
View details
12 Conclusion Accepted
54th Report - Afghanistan Response…
New casework system DACS implemented with enhanced controls to protect information.
The Department told us that it has since implemented a new system which has embedded controls to allow the Department to protect information more effectively, and that this meant that it is no longer using embedded or hidden data in … Read more
Government Response
The government states that it implemented the Defence Afghan Relocations Assistance Policy (ARAP) Casework System (DACS) in May 2022, which addressed vulnerabilities such as stricter access controls and audit logs.
HM Treasury
View details
22 Conclusion Accepted
54th Report - Afghanistan Response…
Department and C&AG discuss future protocol, but parliamentary oversight committee progress is too slow.
The Department and the C&AG have discussed whether they might develop a protocol for use in similar circumstances in future. The Department told us that a super-injunction was so unprecedented it was hard to think of circumstances in which it … Read more
Government Response
The department will continue to work with the Committee and The Treasury will issue guidance on principles and practicalities of sharing information in the event of a super-injunction. Target implementation date: Spring 2026
HM Treasury
View details
Government Response AI assessment · 17 of 0 classified
Accepted 6
Acknowledged 3
Deferred 5
Not Addressed 2
Rejected 1
Total 0 recs + 26 conclusions
Correspondence 4 letters
14 May 2026 To committee Letter from the Permanent Secretary at the Ministry of Defence relating to Afghanistan Resettlement Programme Update, 28 April 2026
Parliament page
20 Apr 2026 To committee Letter from the Permanent Secretary at the Ministry of Defence to the Chair of the Public Accounts Committee Chair relating to Afghanistan Response Route, 2 April 2026
Parliament page
16 Oct 2025 To committee Letter from the Permanent Secretary of the Ministry of Defence relating to the February 2022 Afghan Data Incident follow up information, 07 October 2025
Parliament page
3 Sep 2025 To committee Letter from the Treasury Officer of Accounts at HM Treasury relating to the spending incurred following the Afghan data leak and in relation to expenditure on the Afghan Response Route, 26 August 2025
Parliament page