MoD Admits 49 Data Breaches in Afghan Relocation Scheme

The UK Ministry of Defence (MoD) has disclosed 49 data breaches over the past four years within the Afghan Relocations and Assistance Policy (ARAP), a scheme designed to assist Afghans who worked with British forces in relocating to the UK. This revelation follows a significant 2022 incident where a spreadsheet containing details of nearly 19,000 applicants was inadvertently leaked.

The Information Commissioner's Office (ICO) fined the MoD £350,000 in December 2023 for disclosing personal information of 265 individuals seeking relocation shortly after the Taliban's takeover in 2021. The ICO described the breach as an "egregious" failure that "let down those to whom our country owes so much."

In response to these breaches, the MoD has implemented several reforms, including commissioning audits to inform remediation plans and introducing a new casework management system within the Defence Afghan Relocation and Resettlement (DARR) team that prioritizes data protection.

The Afghan Response Route (ARR), a secret UK government immigration scheme operated from 2023 to 2025, was established in response to the 2022 data breach. The scheme aimed to relocate affected Afghans at risk due to the exposure of their personal information.

The MoD has stated its commitment to data security and is cooperating with the ICO to ensure necessary improvements are made. An MoD spokesperson said, "We take data security extremely seriously and are committed to ensuring that any incidents are dealt with properly, and that we follow our legal duties."

The MoD has also indicated that it will "robustly defend" any legal action or bid for compensation from those affected by the data breaches, adding that these are "hypothetical claims."

The ARAP scheme, established in April 2021, was closed in July 2025. The MoD has outlined a series of reforms introduced in response to the data breaches, emphasizing the importance of reinforcing data handling practices.