Defence Committee launches inquiry into MoD Afghan data breach

The Defence Committee has launched a new inquiry into the 2022 personal data breach and the related Afghan resettlement schemes. The inquiry follows the lifting of an unprecedented superinjunction in July 2025 that had suppressed information since September 2023 about the breach involving thousands of Afghan applicants and their families.

According to the Committee's chair, Tan Dhesi MP, the inquiry aims to understand how the "colossal data breach" was allowed to happen and whether the government's decisions, made under the cover of the injunction, were "well-informed and sensible." The Committee will also investigate the unprecedented use of a superinjunction to prevent public debate. A key focus will be whether it was right for the government to suppress information for so long and if it should continue to argue that some information should not be released.

The inquiry will broadly examine the successes and failures of the Afghan resettlement programme, along with the implications of the injunction on parliamentary scrutiny and data protection.

Concerning the data protection implications, the inquiry will investigate the systemic, cultural, and other factors that contributed to the breach, as well as its impact on trust in the government, both in the UK and internationally. The inquiry also aims to determine how confident we can be that such a serious data breach will not happen again.

The Committee is also seeking to understand the implications of the legal injunction that suppressed information about the breach, including its effect on public and parliamentary scrutiny and data protection regulation. In addition, the Committee will examine the risks that remain to individuals in the dataset who have not yet been resettled, as well as the risks to UK citizens whose data was also part of the breach.

Finally, the inquiry will focus on the financial and logistical aspects of the government's response. This includes whether decisions on resettlement were reasonable and timely, the total cost of the data breach to the public, and what, if anything, is not being funded as a result. 

The deadline for submitting written evidence is 14 October 2025.

In related news, a new report by the National Audit Office (NAO) reveals that the Ministry of Defence (MoD) cannot determine the exact cost of the resettlement schemes for Afghan nationals related to the data breach. The MoD has estimated the total cost of resettling these individuals to be around £850mn, with approximately £400mn already spent as of July. However, the NAO found that the department could not provide sufficient evidence to support this estimate.

The NAO report indicates that the MoD's accounting system did not "separately identify the costs" and were instead included within its total spending on Afghan resettlement. The MoD stated that this was done to comply with the terms of the superinjunction. The report notes that 3,383 people had arrived under the scheme by June 2025, with an estimated 7,355 eligible for relocation in total. The potential cost of compensation claims from data breach victims remains unknown. Meanwhile, the NAO confirmed that the government has already spent £ 2.5 million in legal fees related to the superinjunction proceedings.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.