The Department did not put in place a mechanism to accurately identify and account for the costs of resettling individuals who were at high risk due to the data breach. The Department accounted for the costs of the ARR within its total spending on Afghan resettlement schemes, rather than identifying them separately, arguing that this was necessary to avoid breaching the terms of super-injunction. The Department now acknowledges that it could, in anticipation of the super-injunction being lifted and the resulting parliamentary scrutiny, have accounted for the costs of the ARR separately. Many elements of the ARR and the pre-existing ARAP, such as flights and accommodation, were the same and so it should have been perfectly possible for the Department to determine the costs of each scheme. The Department estimates that the ARR scheme—the additional programme put in place as a direct result of the data breach—will cost around £850 million in total, with around £400 million spent by July 2025. This estimate does not include legal costs, or the potential cost of future compensation claims against the Department from affected individuals. The Department has so far been unable to provided sufficient evidence to give the NAO confidence in its estimate. The Department anticipates being able to give the NAO more detailed information on costs as part of its next report on the Afghanistan resettlement schemes overall. 5 recommendation In its Treasury Minute response to this report, the Department should explain how it is ensuring that the resettlement costs related to the ARR are now being captured separately and accurately in its accounting system. 6 Managing personal information and the risk of a data breach Introduction