← More explainers

Policy explainer · UK Commons Defence Committee · HC 69

The UK Afghan data breach report: what Parliament found

A factual breakdown of the Defence Committee report on the MOD data breach, the two-year superinjunction, and the UK schemes both reshaped.

Last updated July 30, 2026

Type
Parliamentary oversight report
Body
House of Commons Defence Committee
Published
July 30, 2026 · HC 69
Effect on cases
None. UK response pending
Breach: February 2022 Superinjunction: Sept 2023 to July 2025 18,500+ applications exposed 884 Triples decisions overturned 30 recommendations

Read this first

This report does not change anyone's case, in the United Kingdom or the United States.

It is a parliamentary oversight report. It reopens no scheme, alters no eligibility criteria, and has no effect on U.S. programs. What happens next depends on the UK government's response.

Bottom line up front

A preventable spreadsheet error, then two years of secrecy

On July 30, 2026, the House of Commons Defence Committee published "Shifting heaven and earth? The Afghan data breach and resettlement schemes" (First Report of Session 2026-27, HC 69). The report examines how a February 2022 Ministry of Defence data breach affecting Afghan relocation applicants became, in the Committee's words, a wider failure of governance, accountability, and public trust.

The breach itself was a spreadsheet. An MOD official sent an Excel file to a trusted third party outside government. On its face the file appeared to hold data on about 150 applicants to the Afghan Relocations and Assistance Policy (ARAP). It in fact contained detailed personal information relating to more than 18,500 applications. The breach was not discovered until August 2023, when part of the dataset was posted anonymously in a Facebook group.

What followed was more consequential than the original error. From September 2023, the UK government obtained and maintained an unprecedented superinjunction that barred public reporting of both the breach and the response to it. For nearly two years, major policy and spending decisions affecting thousands of Afghans were taken in secret. The injunction was lifted on July 15, 2025, the same day affected individuals were notified.

The report does not create, restore, or reopen any resettlement route. It does not change eligibility for ARAP, the now-closed Afghan Response Route, or any U.S. program. It is a parliamentary oversight report with conclusions and recommendations, and until the UK government responds, nothing in it alters an individual's case.

At a glance

The numbers that define the report

18,500+Afghan applications exposed in the February 2022 MOD spreadsheet breach
~2 yearsof secrecy under a superinjunction, September 2023 to July 2025
884previously refused Triples decisions later overturned
30conclusions and recommendations to the UK government
~7,000eligible people still to relocate to the UK, as of June 9, 2026
~3,700of them believed to be still inside Afghanistan

Key takeaways

  • What the report does. It establishes on the parliamentary record that the February 2022 MOD breach was a foreseeable systemic failure, that nearly two years of secrecy displaced democratic and audit scrutiny, that 884 Triples decisions were wrongly refused and later overturned, and that the current self-move policy has an unresolved gap for the most vulnerable eligible Afghans.
  • What it changes immediately. Nothing in an individual case. It is an oversight report with 30 conclusions and recommendations, and the UK government's response is pending.
  • What it does not do. It does not reopen ARAP, ACRS, or the Afghan Response Route. It does not alter eligibility for any scheme. It does not affect U.S. programs, SIV cases, or Enduring Welcome. It does not resolve whether the leaked dataset was used by the Taliban to target individuals, and the Committee expressly declined to treat the Rimmer Review as the final word on risk.
  • The number to watch. Around 7,000 eligible people remained to relocate to the UK as at June 9, 2026, including around 3,700 believed to be still inside Afghanistan, under a policy that expects them to reach a third country on their own within twelve months.

Background

A promise to "shift heaven and earth"

The United Kingdom maintained a military presence in Afghanistan from October 2001 to August 2021. ARAP was announced in December 2020 by then Defence Secretary Ben Wallace and opened to applications in April 2021. It was designed to relocate Afghans whose work with or for the UK placed them at risk, including interpreters and other locally employed staff.

In August 2021, as Operation PITTING drew to a close, then Prime Minister Boris Johnson said the UK would "shift heaven and earth" to help those left behind. Op PITTING evacuated more than 15,000 people, roughly 5,000 British nationals and roughly 8,000 Afghans. The Committee took that promise as the frame for its inquiry, and the report's title puts a question mark after it.

ARAP was built with two stages. The MOD assessed eligibility, whether an applicant met the scheme criteria. The Home Office assessed suitability, whether the applicant was an appropriate person to settle in the UK. Ben Wallace told the Committee he had deliberately kept the eligibility assessment separate from the Home Office. That choice put high-volume, highly sensitive immigration casework inside a department whose core business is not immigration administration.

What happened

How a spreadsheet exposed more than 18,500 applications

The file

An Excel file with hidden data

In February 2022, an MOD official sent an Excel spreadsheet to a trusted third party outside government. The MOD says sending the data was considered necessary to establish individuals' eligibility, given the UK's lack of presence in Afghanistan and the loss of access to Afghan employment records. The file appeared to contain around 150 applicants. Hidden from a casual viewer, it also contained detailed personal information relating to more than 18,500 other applications. The report states the sender was unaware the additional data was included, and apparently unaware that spreadsheet files can carry hidden data of that kind.

Eighteen months undetected

Discovered only when it surfaced on Facebook

Once the file left government systems, the MOD no longer controlled who could access or share it. The breach was discovered in August 2023, when part of the dataset was posted anonymously in a Facebook group along with a claim that the poster held 33,000 lines of ARAP data. A person who assists Afghans with resettlement applications, identified in the report as Person A, was among the first to escalate it. She told the Committee she initially received no substantive response in the UK, and was told by caseworkers in Pakistan that there was "no cause for concern."

The risk assessment

Treated as potentially life-threatening

The government treated the incident as potentially life-threatening, based on an assessment that the Taliban would seek to target people identified in the compromised dataset who remained in Afghanistan.

Causation

Why the Committee called the breach foreseeable

The Committee's central finding on causation is that this was a systemic failure rather than an isolated lapse. The evidence it cites includes the following.

  • The MOD's initial ARAP case management was described by David Williams, then Permanent Secretary, as "essentially a combination of the ad hoc use of spreadsheets on SharePoint sites." A purpose-built system, the Defence Afghan Caseworking System, was implemented in May 2022, three months after the breach.
  • Guidance on the risks of hidden data in spreadsheets was long established and publicly available. The Information Commissioner's Office had published guidance since at least 2015, and central government guidance from June 2021 required checks for hidden tabs, columns, and rows before sharing spreadsheets. The MOD had issued its own local guidance on the same point.
  • The MOD reported "high turnover of personnel and limited continuity or corporate memory" on the team, a lack of adequate training, and "insufficient emphasis on accountability for data protection responsibilities."
  • The February 2022 breach was not the first warning. In September 2021, a separate ARAP data incident exposed the email addresses of 245 applicants. The ICO subsequently fined the MOD 350,000 pounds over that incident and related breaches.
  • Eighteen further personal data security incidents were reported within the Defence Afghan Relocation and Resettlement team between February 2022 and the end of November 2023.
  • No individual appears to have been held personally accountable for the February 2022 breach. David Williams accepted it was a "serious departmental failing" and said it was a factor, though not the principal reason, in his decision to step down.

Secrecy

The superinjunction and two years of silence

A short injunction became an unprecedented superinjunction that ran from September 2023 until July 2025, barring public reporting of both the breach and the response to it.

The government sought what was initially intended to be a short injunction to enforce secrecy by law while it assessed who was affected and what protection could be offered. The High Court ruled in May 2024 that the superinjunction should be lifted. The Court of Appeal overturned that decision on June 26, 2024 and upheld the order. The general election followed on July 4, 2024.

The Committee's conclusion is that a short period of secrecy may have been justified to reduce immediate risk, but that secrecy endured far longer than originally envisaged. Over time, it found, the injunction displaced normal democratic, audit, and public scrutiny, limited controlled external challenge, and imposed serious costs on accountability and on trust among affected Afghans and the UK public. The Committee recommends that future governments treat this case as exceptional and not as a precedent.

The response and its cost

The Afghan Response Route, built in secret

Because relocation became the principal means of mitigating the breach, ministers moved from revisiting a small number of ARAP decisions to creating a secret scheme, the Afghan Response Route (ARR), for people in the compromised dataset who were not eligible under ARAP but were judged to be at highest risk.

The scheme grew substantially while it was secret. A December 2023 Cabinet decision established a first iteration covering around 200 principal applicants plus families, roughly 1,600 people. By March 2024 the offer had widened to around 2,300 principals and their families. By October 2024 the cohort had grown to around 3,000 principals, or around 24,000 relocations in total.

On cost, the report relies on the National Audit Office. The NAO recorded that 7,355 people were estimated to be eligible for resettlement through the ARR as a direct result of the breach, and that the MOD estimated the historic and future cost of resettling people through the ARR at around 850 million pounds, of which around 400 million had been spent by July 2025. The NAO reported that it had not been given sufficient evidence to have confidence in the completeness and accuracy of the 850 million pound estimate, because ARR costs had not been separately recorded. The NAO's March 2026 report put the estimated total cost of Afghan resettlement activity at 5.7 billion pounds between 2021-22 and 2032-33, of which 3.1 billion had been spent by December 2025.

  • The Committee found the government did not maintain adequate cost visibility over the direct financial consequences of the breach response.
  • It found that government did not consistently distinguish between the marginal cost of the breach response, the cost of the ARR, the cost of prioritised ARAP relocations, and the wider cost of Afghan resettlement.
  • It found that prioritising breach-exposed people, while understandable, created trade-offs within an already strained system, and that some other eligible or potentially eligible Afghans experienced delay as a result.

The Triples

884 overturned decisions

The Triples are former members of Afghan specialist units Commando Force 333 and Afghan Task Force 444, who worked closely with UK Special Forces. They were widely identified in evidence to the Committee as one of the most at-risk but least well-served cohorts in the resettlement system.

Concerns about inconsistent handling of Triples cases crystallised by October 2023. The Triples Review was announced in February 2024. Phase One covered approximately 2,000 cases previously found ineligible, and around 30 percent of those decisions were overturned, with a further 300 people found eligible under the ARR. Phase Two examined payment records that had not previously been considered. When the Review closed in March 2026, the government stated that 884 decisions had been overturned across both phases.

The report identifies specific defects in the original process. Decision-makers did not have access to relevant UK government payment records. Eligibility criteria were applied narrowly. In a series of 2023 "sprints" designed to clear a backlog, 1,585 cases were referred to UK Special Forces and it appears none were found eligible. The High Court found that DARR caseworkers were overly reliant on UKSF personnel and in practical terms implemented UKSF decisions, and that one liaison officer treated silence from UKSF units as confirmation they held no relevant information.

James Heappey, the minister who announced the Review, told the Committee he had repeatedly challenged the department's position that the Triples lacked a qualifying employment relationship, and that "it is a source of huge regret that, frankly, I was told the wrong thing." The Committee accepts the government's position that the evidence does not establish a formal UKSF veto, bias, or a deliberate policy of exclusion. Its concern is that the process gave UKSF input determinative weight without adequate independence, records, assurance, or caseworker ownership. It also concluded that the "no comment" approach to Special Forces is inappropriate for questions of administrative decision-making, data handling, and accountability for resettlement casework.

Notification

What affected Afghans were, and were not, told

Affected individuals were notified on July 15, 2025, the same day the injunction was lifted and two weeks after ARAP had been closed to new principal applications. For many, discovery of the breach, disclosure that government had known for nearly two years, and news that safe and legal routes had just closed all arrived at once.

The notification was issued in English, Dari, and Pashto, and the government estimates it reached 96 percent of affected individuals. The Committee's concerns were not about reach. They were about content, actionability, and follow-up. Affected individuals were not told which of their personal details had been compromised, whether family members' details were included, or what concrete steps to take. An online self-checker was the main mechanism offered. A staffed phone line operated in English only, could not verify callers' identities, could not tell callers whether they were affected, and largely directed them back to automated tools. In survey evidence submitted by Refugee Legal Support, among 231 respondents who had been told their data was compromised, 38 percent found the security advice helpful and 63 percent considered it had taken too long to inform them.

Person A described receiving over 5,000 text and WhatsApp messages on the day the injunction was lifted. Rafi Hottak, a former interpreter for British forces, wrote that "panic spread through our community," with some people selling everything to flee to neighbouring countries. The Committee's conclusion is that the government approached notification primarily as a communications exercise rather than as a safeguarding intervention, and that break-glass planning should have been built around the needs of the people receiving the news.

The human toll, in their words. Refugee Legal Support, with Professors Victoria Canning and Sara de Jong, documented the lived impact of the breach and its handling in "I am not a case number, I am a human being", built on the testimony of affected Afghans.

The reassessment of risk

The Rimmer Review

Paul Rimmer, a former senior civil servant, was commissioned to reassess the policy response and the continuing justification for the superinjunction. His review was conducted in the first half of 2025. Its central conclusion was that possession of the dataset was unlikely to "profoundly change the existing risk profile of individuals," and that current threat or resistance to the Taliban was likely to be a more persuasive targeting factor than former affiliations. The High Court gave the Review decisive weight, finding that it fundamentally undermined the evidential basis for continuing the superinjunction. The ARR was discontinued and the injunction was lifted.

The Committee found the Review coherent, independent, and a fair reflection of the evidence it received, and said a similar reassessment should have happened much sooner. It also noted that because the Review was conducted in secret, the range of evidence that could be gathered and tested was constrained. Only one source the reviewer spoke to presented a materially different threat picture, while the Committee itself received a wider range of contrary evidence describing continuing or increasing targeting of Afghans associated with the UK. The Committee concluded the Review should not be treated as the final word on risk.

The state of play

Where UK resettlement stands now

ARAP and the Afghan Citizens Resettlement Scheme closed to new applications on July 1, 2025. The ARR is closed. The government intends to complete decisions on the remaining ARAP caseload and relocate those found eligible by the end of 2028, save for exceptional circumstances.

The MOD told the Committee that as at June 1, 2026 the caseload had fallen to around 14,000, compared with around 25,000 in July 2025, and that monthly decisions rose from 1,288 in February 2026 to 2,000 in May. Its delivery plan is for principal applicant decisions to be complete by August 2026 and all cases, including additional family members, to be cleared by March 2027, supported by around 150 staff including around 120 caseworkers. As at June 9, 2026, around 7,000 eligible people remained to relocate to the UK, including around 4,800 in the relocation pipeline, of whom around 3,700, over 75 percent, were believed to be in Afghanistan.

The self-move policy

A twelve-month deadline to reach a third country

In April 2026 the Minister announced that the MOD had decided to end in-country assistance for movements out of Afghanistan. Eligible Afghans would need to make their own way to a third country when able to do so, and save for exceptional circumstances this would need to occur within twelve months. The UK requires time in a third country with a British consular presence so that Home Office suitability, identity, biometric, and health checks can be completed.

The Committee concluded that the government has not adequately explained how it will protect eligible Afghans who cannot safely, lawfully, or affordably self-move. It recorded evidence that some families had incurred very large debts for transit and visas, that others were being charged inflated prices or subject to extortion, and that particular concern was raised about former Triples, torture survivors, women and girls who may need a male companion in order to travel, and families who had already waited years. When asked what should happen to people who cannot safely self-move, the Minister did not identify a separate route or support package and referred to keeping the policy under review. The Committee's conclusion is that without such a policy, the twelve-month deadline risks becoming, in practice, an exclusion mechanism for eligible people who are too poor, too vulnerable, or too exposed to travel independently.

On life after arrival, the Committee found that resettlement has brought many Afghans safety and relief, citing research finding that 90 percent of surveyed Afghans resettled in England reported feeling safe in their local area. It also found that unresolved cases involving close family members remain a significant source of anxiety, that extended stays in hotels and other temporary accommodation have delayed integration, and that successful resettlement cannot be measured by arrival numbers alone.

The recommendations

What the Committee asked the government to do

The report contains 30 conclusions and recommendations. The principal ones are as follows.

  • Publish a single action plan covering lessons from the breach and the resettlement response, with a named owner, timetable, intended outcome, and reporting method for each action, and report progress to the Committee every six months.
  • Mandate and enforce minimum standards for skills, process, tools, controls, independent assurance, and testing for any dataset where compromise could plausibly risk life.
  • Explain who held senior official responsibility for data-protection risk in ARAP before the February 2022 breach, and whether any disciplinary or performance-management processes followed.
  • Publish clear principles governing when government may exceptionally seek an injunction preventing disclosure of a matter of widespread public interest, including periodic reassessment, controlled external challenge at the earliest safe stage, and minimum expectations for parliamentary notification.
  • Establish formal interdepartmental governance from the outset where policy must be designed or implemented in secret, including documented ministerial decision points and explicit cost-assurance arrangements.
  • Establish and publish a process for periodic reassessment of the risks faced by ARAP applicants, former applicants, and their families who remain in Afghanistan or third countries, and report at least annually on how those reassessments affect eligibility, safeguarding, relocation, and self-move policy.
  • Treat disclosure and notification in future risk-to-life cases as a safeguarding intervention, with specific information on the data compromised, tailored guidance by risk level and location, accessible multilingual support channels, and routes for case-specific enquiries.
  • Treat the remaining work for former Triples as a corrective exercise rather than routine casework, and report regularly to Parliament until it is complete.
  • Publish, by the time the government responds to the report, a clear policy for eligible Afghans who cannot safely, lawfully, or affordably self-move to a third country.
  • Stop allowing departments to lead high-risk protection or resettlement casework by default where that work falls outside their core expertise.

For Afghan allies

What this means for you

Eligible and awaiting UK relocation

Your eligibility and place in the pipeline do not change

The report does not change your eligibility or your place in the pipeline. It does document that the UK government has set a twelve-month expectation for self-moving to a third country, that around 3,700 people in the relocation pipeline were believed to be inside Afghanistan as at June 2026, and that the Committee has asked the government to publish a policy for people who cannot self-move safely, lawfully, or affordably. Any change on that point will come from the government's response, not from the report itself.

A former Triple with a refused application

The Review is closed, but the Committee did not treat it as settled

The Triples Review closed in March 2026 with 884 decisions overturned across both phases. The minister told the Committee he was confident that, following completion of the Review, all those who should have been found eligible have now been offered relocation under ARAP. The Committee did not treat that as settled, and recommended the remaining work be handled as a corrective exercise with regular reporting to Parliament. If you believe your case was affected by the failings the Review identified, seek qualified UK legal advice about your options.

Notified that your data was compromised

The notification did not tell people what was exposed

The Committee found the July 2025 notification did not tell people which of their details had been exposed, whether family members were included, or what steps to take. If you need to pursue that, the Information Commissioner's Office is the UK regulator for personal data and individuals can raise data protection complaints with it. Questions about legal remedies or compensation are case-specific and require a qualified UK solicitor. The report itself does not address compensation.

Already resettled in the UK

Arrival has not ended uncertainty for many families

The Committee found that arrival has not ended uncertainty for many families, particularly where Additional Family Member applications remain undecided or relatives are still in Afghanistan or a third country. It recommended that relocated Afghans in transitional accommodation get timely casework updates, welcomed the MOD's stated intention to improve information and to consider a dedicated escalation route for time-sensitive family cases, and recommended the government publish outcome measures covering settled accommodation, early support, casework resolution for close family, English language provision, employment, health, and community integration.

If you want to act on this in the UK

The practical levers are parliamentary

The Committee has asked the government to publish a single action plan with named owners and timetables, and to report progress every six months, which creates recurring points at which specific cases and failures can be raised. Constituency MPs remain the standard route for individual casework and for pressing ministers on the self-move policy. Several organisations that gave evidence to this inquiry work directly with affected Afghans, including the Sulha Alliance, Refugee Legal Support, and the Afghan Solidarity Coalition.

If your case is with the U.S. government

This report has no effect on it

This report concerns UK schemes, UK ministers, and UK data. It does not change U.S. eligibility criteria, U.S. processing, or the status of any U.S. application. For the current state of U.S. pathways, see the AfghanEvac explainers on SIV and Enduring Welcome.

Wherever your case sits. Keep your own records. Preserve copies of applications, correspondence, reference numbers, payment records, and any evidence of service alongside UK or U.S. forces, and keep them somewhere you can reach from more than one device. Do not rely on a government system to hold the only copy. For case-specific questions, consult a qualified immigration lawyer or accredited representative. Be alert to fraud, which reliably follows reporting of this kind.

The structural lessons, in the UK and beyond

Five questions any government running a relocation program should be able to answer

The Committee frames its findings as lessons for future high-risk, secret, or rapidly scaled operations rather than as a verdict on one department. The UK and the United States carried parallel obligations out of the same twenty-year war, and built parallel machinery to meet them, so the failures documented here are worth reading in both capitals.

  • Sensitive casework in a department that does not do casework. The MOD carried responsibility for high-volume, life-endangering immigration casework without the specialist capability, systems, or controls to run it safely. The department with the moral or policy interest is not automatically the one best placed to run the casework operation.
  • Fragmented delivery raises cost and slows everything. Eligibility sat with one department, suitability and visas with another, third-country movement with a third, and housing with local government, with the department holding the strongest incentive to act holding the fewest levers. One former minister described departments "bidding up on each other" for accommodation, which increased both delay and price.
  • Self-move policies shift risk onto the people least able to carry it. A deadline for independent travel to a third country, without an identified alternative for those who cannot travel safely or afford it, functions in practice as an exclusion mechanism. It is a test of the most vulnerable cases rather than the average one.
  • Notification is a safeguarding operation, not a press release. Reaching 96 percent of affected people meant little when the message could not tell them what had been exposed, what it meant for their family, or what to do next. Governments should resource for the demand for individual answers before the news breaks, not after.
  • Secrecy has a compounding cost. Emergency secrecy is not never justified, but here it removed the challenge that would have improved the response, and lasted long enough for the ministers responsible to leave office before scrutiny was possible. The recommendation to publish principles for exceptional injunctions is a constitutional point, not an Afghan one.

Common questions

Frequently asked questions

Does this report reopen ARAP or the Afghan Response Route?

No. Both are closed to new applications, ARAP since July 1, 2025. A select committee report makes conclusions and recommendations. It does not change policy, and it cannot reopen a scheme.

Does it affect U.S. programs, SIV cases, or Enduring Welcome?

No. This is a UK report about UK schemes and UK government decisions. It has no legal or administrative effect on any U.S. process.

Does the report say the Taliban used the leaked data to target people?

Not directly. The government initially treated the breach as potentially life-threatening, based on an assessment that the Taliban would seek to target people in the dataset who remained in Afghanistan. The 2025 Rimmer Review later concluded that possession of the dataset was unlikely to profoundly change individuals' existing risk profile. The Committee said it is not an intelligence review body and is not well placed to judge whether that assessment was correct. It also received evidence describing continuing targeting of Afghans associated with the UK, and concluded the Review should not be treated as the final word on risk.

Were 18,500 people exposed, or 33,000?

The report says the file contained detailed personal information relating to more than 18,500 applications. The 33,000 figure comes from a claim made by the anonymous Facebook poster in August 2023 about how many lines of data they held. The two numbers are not the same kind of measure, and applications can cover more than one person.

Did the breach cost 7 billion pounds?

No figure that high is attributed to the breach itself. Journalists told the Committee that court material at times described the response in terms of numbers around 7 billion pounds. The published estimates are narrower. The National Audit Office recorded an MOD estimate of around 850 million pounds for ARR resettlement, a figure the NAO said it could not verify with normal audit confidence, and separately put total Afghan resettlement cost across all schemes at 5.7 billion pounds from 2021-22 to 2032-33. The Committee's finding is that government did not consistently distinguish between these different figures.

Has anyone been held accountable?

The report states that no individual appears to have been held personally accountable for the February 2022 breach. The then Permanent Secretary accepted it was a serious departmental failing and said it was a factor in his decision to step down, though not the principal reason. The Committee found that the injunction made ordinary ministerial accountability largely impossible for nearly two years, and that by the time public scrutiny was possible the ministers responsible for earlier decisions had left office. It has asked the government to explain who held senior official responsibility and whether any disciplinary processes followed.

Does the report say the Triples were deliberately excluded?

No. The Committee accepts the government's position that the evidence does not establish a formal UK Special Forces veto, bias, hidden motives, or a deliberate policy of exclusion. Its finding is that the process gave UKSF input determinative weight in practice, without adequate independence, records, assurance, or caseworker ownership, and that this produced wrong decisions on a significant scale.

Is the twelve-month self-move deadline now cancelled?

No. It remains UK government policy as of July 30, 2026. The Committee has recommended that the government publish, by the time it responds to this report, a clear policy for people who cannot safely, lawfully, or affordably self-move. Whether the deadline changes depends on that response.

Does the Committee call for a full public inquiry?

It stops short of that. The Committee notes it is not a public inquiry, that its access to evidence was constrained, and that the constraints imposed on it diminished the completeness of democratic scrutiny of an episode involving risks to life, substantial expenditure, and prolonged secrecy. It then says it is for others to judge whether a further inquiry with more extensive powers and access would be valuable.

Can affected people complain to the ICO or claim compensation?

The Information Commissioner's Office is the UK regulator for personal data and individuals can raise data protection complaints with it. The ICO has already acted against the MOD once in this area, issuing a 350,000 pound fine over the September 2021 ARAP incident and related breaches. This report does not address compensation, and questions about legal remedies are case-specific and need a qualified UK solicitor.

Status

Where things stand now

July 15, 2025
The superinjunction was lifted and replaced with a narrower order restricting publication of sensitive information within the dataset. Affected individuals were notified the same day.
July 14, 2026
The report was ordered to be printed.
July 30, 2026
The report was published as HC 69, First Report of Session 2026-27. ARAP, ACRS, and the Afghan Response Route are all closed to new applications.

AfghanEvac's position

The commitments made to Afghan wartime allies must be honored in substance and not merely in process, and that obligation does not lessen because a government finds it inconvenient, expensive, or embarrassing. A government that compromises the safety of the people who stood with it owes them accuracy, urgency, and a route out, not a deadline they cannot meet. We are committed to helping the public understand these developments accurately, in every country that made a promise.

Bottom line. A preventable spreadsheet error put more than 18,500 Afghan applications at risk, and the response to it, conducted in secret for nearly two years, reshaped the UK's entire resettlement effort. Parliament's Defence Committee has now documented that record and made 30 recommendations. The report changes no one's case today. What it does is establish the facts, name the accountability gaps, and put one unresolved question in front of the UK government, which is what happens to eligible Afghans who cannot get themselves out.

About this explainer

Prepared by AfghanEvac and updated July 30, 2026. This is a factual breakdown of the House of Commons Defence Committee report, HC 69. It concerns UK schemes and UK government decisions and has no effect on U.S. programs. We will update this page as the UK government responds.

Educational reference only, not legal advice. This explainer is provided for general informational purposes and reflects the report as published. Nothing here creates a solicitor-client or attorney-client relationship. UK and U.S. immigration law are complex and change without warning. For case-specific questions, consult a qualified immigration lawyer or accredited representative in the relevant country, or contact AfghanEvac.