In responding to this report, the government should publish a single action plan covering lessons from the breach and the resettlement response, with each action assigned a named owner, timetable for completion, intended outcome and means of reporting progress. After this initial response it should report progress against each of these actions to us every six months. (Recommendation, Paragraph 25) Part One: The data breach