Afghanistan Response Route (ARR)

Public Accounts Committee Open Inquiry
Opened: 13 Oct 2025 Parliament page
The Afghanistan Response Route (ARR) was set up by the Ministry of Defence to mitigate the security risks arising from a data protection breach and the unauthorised disclosure of personal information about Afghan citizens which occurred in February 2022. The National Audit Office (NAO) has published a report on the … Read more
26 Conclusions
1 Report
4 Letters
Activity timeline 6 events
14 May
2026
Correspondence
20 Apr
2026
Correspondence
19 Jan
2026
Report published
14 Nov
2025
Report published
16 Oct
2025
Correspondence
3 Sep
2025
Correspondence
Title HC No. Published Items Response
54th Report - Afghanistan Response Route HC 1391 14 Nov 2025 26 Responded
Recommendations & Conclusions
14 results
Clear
2 Conclusion Accepted
54th Report - Afghanistan Response…
Require assurance that new casework system prevents recurrence of Afghan resettlement data breaches
The Department did not have appropriate systems and controls in place at the time of the February 2022 breach to manage personal data in a high-risk environment. The Department did not use a caseworking system designed to hold and process … Read more
Government Response
The government confirmed the Defence Afghan Relocations Assistance Policy Casework System (DACS) was implemented in May 2022, addressing vulnerabilities with stricter controls, audit logs, and secure data sharing protocols, and undergoes regular maintenance to prevent future data breaches.
HM Treasury
View details
3 Conclusion Accepted
54th Report - Afghanistan Response…
Require Department to detail data protection policies, assurance, and changes made after breaches
The Department did not do enough to learn the lessons from previous data breaches. Before the February 2022 data breach, the Department had policies in place to protect against the loss of personal information. After three separate data breaches in … Read more
Government Response
The government commissioned an independent MOD-wide Data Protection Review (McIvor Review) in 2023, the recommendations of which were implemented and detailed in a 7 October 2025 letter, and committed to providing a report on mandatory data protection training completion in a future update.
HM Treasury
View details
1 Conclusion Accepted
54th Report - Afghanistan Response…
Committee took evidence on February 2022 data breach and Afghanistan Response Route
On the basis of a report by the Comptroller and Auditor General (C&AG), we took evidence from the Ministry of Defence (the Department) on the circumstances surrounding the February 2022 data breach and the Department’s subsequent response, including setting up … Read more
Government Response
The government agreed to the conclusion, stating it will signpost to Home Office's quarterly immigration statistics on GOV.UK for Afghan Resettlement Programme data and provide broader updates on MOD's ARR relocation and resettlement activity where possible.
HM Treasury
View details
11 Conclusion Accepted
54th Report - Afghanistan Response…
February 2022 data breach caused by inappropriate systems and hidden data.
We asked the Department to outline how the February 2022 data breach had occurred. The Department told us that the systems it used to manage case work for the ARAP scheme—a Sharepoint site and Excel spreadsheets—were not appropriate for handling … Read more
Government Response
The Defence Afghan Relocations Assistance Policy (ARAP) Casework System (DACS) was introduced in May 2022 which addressed many of the vulnerabilities, including stricter access controls, audit logs, and protocols to limit data sharing outside secure systems and new software introduced in January 2025 enhances their ability to securely share data.
HM Treasury
View details
12 Conclusion Accepted
54th Report - Afghanistan Response…
New casework system DACS implemented with enhanced controls to protect information.
The Department told us that it has since implemented a new system which has embedded controls to allow the Department to protect information more effectively, and that this meant that it is no longer using embedded or hidden data in … Read more
Government Response
The government states that it implemented the Defence Afghan Relocations Assistance Policy (ARAP) Casework System (DACS) in May 2022, which addressed vulnerabilities such as stricter access controls and audit logs.
HM Treasury
View details
14 Conclusion Accepted
54th Report - Afghanistan Response…
Afghan relocation unit reported 49 data breaches between 2021 and 2025.
In August 2025, the Department reported that there had been 49 separate data breaches between 2021 and 2025 at the unit handling applications from Afghan citizens to relocate to the UK. Of these, the Department assessed that seven met the … Read more
Government Response
The government commissioned an independent MOD-wide Data Protection Review in 2023, finalized in 2024 with recommendations, and will provide a report on mandatory data protection training completion in its first six-monthly update.
HM Treasury
View details
15 Conclusion Accepted
54th Report - Afghanistan Response…
Department implemented significant data protection improvements following multiple previous breaches.
We asked the Department about its response to a data breach which occurred in September 2021 relating to the ARAP scheme.31 The Department told us that it had engaged with the ICO in the autumn of 2021 follow multiple data … Read more
Government Response
The government commissioned an independent MOD-wide Data Protection Review in 2023, finalized in 2024 with recommendations, and will provide a report on mandatory data protection training completion in its first six-monthly update.
HM Treasury
View details
16 Conclusion Accepted
54th Report - Afghanistan Response…
Department identified 49 data breaches, attributing many to common email errors.
We asked the Department about the reported 49 data breaches, which included seven which met the threshold for reporting to the ICO, and whether there were ongoing investigations relating to these. The Department said that five incidents related to the … Read more
Government Response
The government commissioned an independent MOD-wide Data Protection Review in 2023, finalized in 2024 with recommendations, and will provide a report on mandatory data protection training completion in its first six-monthly update.
HM Treasury
View details
17 Conclusion Accepted
54th Report - Afghanistan Response…
MoD failed to notify PAC about data breach after 18-month delay and obtaining super-injunction.
The Department first became aware of the data breach on 14 August 2023, 18 months after it occurred, when personal details of 10 individuals from the dataset were posted online on Facebook.40 Following its discovery of the data breach, on … Read more
Government Response
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
HM Treasury
View details
18 Conclusion Accepted
54th Report - Afghanistan Response…
Super-injunction upheld, limiting ministerial briefing on data breach to a select few.
The High Court and the Court of Appeal upheld the super-injunction in several subsequent private hearings and judgments between 2023 and 2025.43 The Department said that in September 2023, it expected that an injunction might be in place for at … Read more
Government Response
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
HM Treasury
View details
19 Conclusion Accepted
54th Report - Afghanistan Response…
Permanent Secretary chose not to inform C&AG or report data breach in MoD's annual accounts.
The data breach was also not reported in the MoD’s Annual Report and Accounts for 2023–24. The Comptroller & Auditor General, who is an officer of the House of Commons, is responsible for the audit of these accounts, which is … Read more
Government Response
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
HM Treasury
View details
20 Conclusion Accepted
54th Report - Afghanistan Response…
C&AG discovered data breach publicly in 2025, while audit director was secretly briefed but silenced.
The C&AG told us that the first he knew about the data breach was when it became publicly known in July 2025. His audit director had been briefed at the time of auditing the 2023–24 accounts, that there was a … Read more
Government Response
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
HM Treasury
View details
21 Conclusion Accepted
54th Report - Afghanistan Response…
C&AG requires full cost assessment; Permanent Secretary acknowledges "deeply uncomfortable" relationship handling.
The C&AG highlighted to us the crucial importance to the audit opinion of being able to assess whether there was adequate provision in the accounts to cover the full costs of resettlement schemes.54 We challenged the Permanent Secretary about the … Read more
Government Response
The government agrees to work with the Committee to ensure timely information sharing, committing to new guidance from the Treasury Officer of Accounts by Spring 2026 on super-injunctions and C&AG communication, and a Dear Accounting Officer letter to be incorporated into Managing Public Money.
HM Treasury
View details
22 Conclusion Accepted
54th Report - Afghanistan Response…
Department and C&AG discuss future protocol, but parliamentary oversight committee progress is too slow.
The Department and the C&AG have discussed whether they might develop a protocol for use in similar circumstances in future. The Department told us that a super-injunction was so unprecedented it was hard to think of circumstances in which it … Read more
Government Response
The department will continue to work with the Committee and The Treasury will issue guidance on principles and practicalities of sharing information in the event of a super-injunction. Target implementation date: Spring 2026
HM Treasury
View details
Government Response AI assessment · 26 of 0 classified
Accepted 14
Acknowledged 3
Deferred 5
Not Addressed 2
Rejected 2
Total 0 recs + 26 conclusions
Correspondence 4 letters
14 May 2026 To committee Letter from the Permanent Secretary at the Ministry of Defence relating to Afghanistan Resettlement Programme Update, 28 April 2026
Parliament page
20 Apr 2026 To committee Letter from the Permanent Secretary at the Ministry of Defence to the Chair of the Public Accounts Committee Chair relating to Afghanistan Response Route, 2 April 2026
Parliament page
16 Oct 2025 To committee Letter from the Permanent Secretary of the Ministry of Defence relating to the February 2022 Afghan Data Incident follow up information, 07 October 2025
Parliament page
3 Sep 2025 To committee Letter from the Treasury Officer of Accounts at HM Treasury relating to the spending incurred following the Afghan data leak and in relation to expenditure on the Afghan Response Route, 26 August 2025
Parliament page