Internal ICO report reveals its involvement in the 2022 Afghan personal data breach

An internal report from the Information Commissioner's Office (ICO) has provided new details on the regulator's involvement in a 2022 data breach that exposed the identities of thousands of Afghans seeking relocation to the UK. The report, obtained via a Freedom of Information request, was drafted from memory after a superinjunction on the case was lifted in July 2025.

The report reveals the significant constraints placed on the ICO's investigation. Much of the information was classified as Secret or Top Secret, limiting access to only five authorised staff members. The regulator was prevented from taking notes or recording any information on its own IT systems, with all briefings being conducted face-to-face at the Ministry of Defence's (MoD) London offices. The superinjunction, which was in place from September 2023 to July 2025, also legally prohibited the ICO from making any public disclosures about the breach.

This legal and security-based secrecy meant that no contemporaneous record of the ICO's actions or decision-making existed. The newly published report, therefore, serves as the first official account compiled from the personal recollections of the staff involved. It confirms that the ICO, despite the seriousness of the breach, decided to take no further action against the MoD at the time, noting that some information remains classified and could not be included in the public document.