Question

To ask the Secretary of State for Digital, Culture, Media and Sport, following the cyber attack on Manchester Airports Group, what steps her Department is taking to strengthen the protection of personal data held by organisations.

UK GDPR and Cyber Assessment Framework principles already require organisations to implement appropriate measures to ensure the security and resilience of personal data, and all organisations have responsibilities under UK GDPR to keep personal data secure and design their processing activities with privacy and security in mind. This includes a requirement to report any personal data breach that poses a risk to people to the Information Commission without undue delay, and where feasible within 72 hours of becoming aware of it.

The Information Commission also has a range of enforcement powers at its disposal to protect personal data, such as requiring organisations to address non-compliance or imposing fines of up to £17.5 million or 4% of an organisation’s global turnover (whichever is higher) for the most serious infringements. Under the Data (Use and Access) Act 2025, the Commission can now require organisations to provide technical reports about an alleged breach and compel witnesses to attend interviews.

The Cyber Security and Resilience (Network and Information Systems) Bill will enable the government, after appropriate consultation, introduce new security and resilience requirements that regulated entities must meet, including transport networks. The proposals to be consulted on will cover personal and non-personal data that underpin the provision of regulated services, including securing critical data and minimising unnecessary data collection. We propose that these requirements should focus on the security and resilience of critical data assets and complement existing principles.