Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, pursuant to the Answer of 1 July 2025 to Question 60619 on NHS: Databases, how many external contractors have been granted elevated access permissions within the Federated Data Platform, broken down by organisation.

There are currently three contractors with elevated administrative permissions within the National Data Integration Tenant (NDIT) Platform and three contractors within the national instance of the NHS Federated Data Platform (NHS FDP) with elevated administrative permissions. This total has been limited to three or four external contractors historically and all actions are logged and are auditable. The external consultants are provided under the NHS Federated Data Platform and Associated Services Contract (NHS FDP-AS) by Palantir UK and are subject to government security clearance and approval by a member of NHS England staff at director level or above.

Controlled administrative access is provided for defined platform functions, such as system administration, operational support, maintenance, and resilience, including out-of-hours support, acting under the instruction of National Health Service organisations as data controllers.

These administrative roles are designed to support system configuration, maintenance and operation, and do not provide unrestricted or routine access to identifiable patient data. Administrative access is:

• strictly role‑based and limited to defined responsibilities;

• purpose‑specific and approved in advance;

• time‑limited where appropriate; and

• fully audited, with all activity logged and subject to monitoring.

All access, including by administrative users, is governed by strong safeguards including encryption, role‑based access controls, and comprehensive audit trails.