Question to the Cabinet Office:

To ask His Majesty's Government when they intend to publish the mandatory Data Protection Impact Assessment for the gov.uk One Login programme.

It is not a mandatory requirement to publish a Data Protection Impact Assessment (DPIA). We do have an obligation to let citizens know how we are processing their data, which we do via a privacy notice published on GOV.UK. We continually develop our DPIA to take into account the new identity verification journeys, such as the no photo ID route. Nevertheless, we are working on a publishable version of our DPIA which will be easy to digest for the public. The One Login programme meets with the Information Commissioners’ Office (ICO) on a monthly basis, engaging openly on programme developments, including iterations of the DPIA, and has been doing so since 2022.