3.1 The government agrees with the Committee’s recommendation. Recommendation implemented 3.2 In 2023, the department’s Executive Committee commissioned an independent, MOD-wide Data Protection Review in response to several high-profile and sensitive data protection incidents within the department and across government. This included the discovery of the February 2022 incident. Neil McIvor, the Chief Data Officer at the Department for Education, was appointed to lead this comprehensive review. 3.3 The resulting report, finalised in 2024, included a number of recommendations aimed at strengthening data protection practices across MOD. Requested details relating to the department’s data protection policies and processes are covered in the department’s response to the Committee set out in the letter dated 7 October 2025 which includes an update on how the recommendations in the McIvor Review have been implemented. 3.4 In addition to the McIvor Review, the department will provide a report showing the percentage of staff who have completed the mandatory data protection and information governance training within the first six-monthly update to the Committee referenced at recommendation 1.