Question to the Department of Health and Social Care:

To ask His Majesty's Government why a significant change allowing Palantir contractors access to identifiable NHS patient data remained undisclosed until it was exposed by external pressure.

The NHS Federated Data Platform (NHS FDP) safely connects information from different systems across the National Health Service into a single, secure environment. This allows staff to co-ordinate care better to improve outcomes for patients.

The NHS FDP is delivering for the NHS, helping people get the care they need quicker and more efficiently. Since March 2024, more than 100,000 additional patients have been supported to undergo procedures in theatres partly by increasing theatre utilisation. Nearly 94,000 people have been supported on their cancer journey, with 7% seeing a reduction in the time it took to diagnose their cancer. There has been a 14% decrease in delays discharging patients staying in hospital for more than seven days, freeing up beds for those who need them most. NHS England publishes quarterly information on the benefits realised from the NHS FDP, which is available at the NHS.UK website.

To date, 24 integrated care board clusters and 168 NHS trusts have signed up to the NHS FDP.

NHS England has been transparent that suppliers such as Palantir Technologies UK Ltd act as data processors under its instructions, and that access to data is governed by strict contractual, technical, and organisational controls.

A small number of supplier personnel have limited access to identifiable data where necessary to support essential platform administration and maintenance functions. This access is tightly controlled, and subject to approval and audit.

NHS England has identified that aspects of the published National Data Integration Tenant (NDIT) Data Protection Impact Assessment (DPIA) did not fully reflect these operational arrangements, including wording that referred to NHS staff rather than authorised users and support staff more broadly.

NHS England is updating the NDIT DPIA and associated documentation to ensure full alignment with current practice, alongside strengthening permissions, audit controls, and governance processes.

This did not represent a change in access arrangements, but a need to clarify and improve how these arrangements were described in public documentation.