The National Data Guardian has told ministers that public and professional trust must carry substantial weight in deciding what happens next to the NHS Federated Data Platform, the Palantir-supplied system facing a February 2027 break clause. Her letter turns a political row into a governance lesson for every organisation that hands sensitive data to a third party.
What happened
Dr Nicola Byrne, the National Data Guardian for Health and Social Care, wrote to James Frith MP, Minister for Health Innovation at the Department of Health and Social Care, in a letter dated 9 October 2026. The letter was published on GOV.UK on 12 October and reported by Computer Weekly the following day. It concerns the NHS Federated Data Platform (FDP), the national data integration programme whose contract was awarded to a Palantir-led consortium in November 2023.
Byrne does not recommend a particular contract outcome, and she says plainly that she supports the programme’s ambition to use data to improve care. Her core message is that trust deserves heavy weighting, both when choosing the supplier and when deciding how the platform is run and how its results are explained. She sets out three recommendations: weight public and professional trust heavily when evaluating any supplier of a system handling health and care data; ground decisions in objective evidence of what the platform does and does not deliver, shared openly; and tackle lock-in, interoperability and sovereignty risks, with open standards and open-source options on the table.
The timing matters. The government is weighing whether to use the February 2027 break clause, and Byrne notes that the independent evaluation by Imperial College London and a National Audit Office study of patient data integration will not finish in time to inform that choice.
The detail
The eight-page letter carries an annex of evidence, and it is a blunt read. Byrne understands that over 80% of secondary and tertiary NHS providers have signed up to the FDP, and some trusts report real benefits. Yet Byrne records that many local organisations are reluctant to adopt it actively, pointing to unease about the supplier, the effort of fielding local objections and a liking for alternative tools. Over 100 NHS data and digital staff have signed a letter objecting to the contract continuing, and she describes the resulting staff time spent answering public concerns as a largely hidden cost.
She is also clear that technical, legal and contractual safeguards have not settled public concern, which she says has grown since the programme began. Research commissioned by Understanding Patient Data found that 84% of 243 media articles on Palantir and the FDP were negative, often framed around sovereignty and US jurisdiction. A YouGov survey for Eko of 2,097 UK adults found 76% considered it unacceptable for American tech companies to process NHS patient records.
The most practical warning concerns the National Data Opt-Out. Byrne notes distinct rises in May and June 2026 after a stable 2025, coinciding with a surge in coverage. Causation cannot be proved because reasons for opting out are not recorded, but she warns that even small increases accumulate and can bias national datasets used for planning and research.
Transparency problems run through the annex. Earlier this year NHS England admitted that its data protection impact assessment (DPIA) for the platform’s National Data Integration Tenant had wrongly described supplier access, failing to make clear that some Palantir staff could view identifiable data, as The Register reported in July. The Office for Statistics Regulation has also reviewed how NHS England presented the platform’s benefit figures, and NHS England has committed to improve how it communicates them.
Why it matters for UK organisations
Formally this is advice on one contract, but the principles travel well beyond the NHS. The National Data Guardian is the custodian of the Caldicott Principles, and her argument is essentially that a supplier can pass every technical and contractual test and still fail as a risk decision if the people whose data is involved, and the staff who must use the system, do not accept it.
For UK controllers that is a familiar idea in data protection law. UK GDPR’s accountability and transparency duties, the expectation that DPIAs describe processing accurately, and the reasonable-expectations test behind lawful processing all reward organisations that avoid surprises. The DPIA error is a reminder that a document which misstates who can access data creates regulatory exposure as well as reputational damage.
The sovereignty point also reaches the private sector. Boards in financial services, critical national infrastructure and the public sector are increasingly asked where data sits, which jurisdictions can reach it and how hard it would be to leave a supplier. The Science, Innovation and Technology Committee went further in June, recommending a strategy to end public sector lock-in.
Expert view
In my experience, supplier assessments in UK organisations are still dominated by questionnaires, certifications and contract clauses. Those matter, but this letter shows their limits. Trust behaves like a security control: when it fails, people route around the system, keep shadow copies, opt out or refuse to adopt it, and the risk you thought you had managed reappears elsewhere.
The DPIA episode is the part I would put in front of any data protection officer. When we test third-party access in client environments, the gap between documented access and actual access is one of the most common findings: support accounts, engineering break-glass routes and contractor roles that never made it into the paperwork. Here that gap became national news and helped erode confidence in the whole programme.
Byrne’s emphasis on lock-in is also sound risk management rather than politics. An exit plan that has never been costed or tested is an assumption, not a control. Whatever ministers decide in February, the organisations that come through such decisions well are those that can show where their data is, who touches it and how they would move it.
What to do now
- Reconcile documented and real supplier access. Compare DPIAs, privacy notices and contracts against actual accounts and roles held by suppliers, including support and administrative access. This maps directly to the Cyber Essentials user access control requirements.
- Add trust and acceptability to supplier risk scoring. Alongside technical and legal criteria, assess stakeholder, staff and customer acceptance, and record how it was weighed.
- Write and test an exit plan. Confirm data portability, open formats and the effort to migrate before signing, and review it at each renewal or break clause.
- Record jurisdiction and sovereignty risk. Document where data is stored and processed, which legal regimes could reach it and the mitigations in place.
- Be honest about benefits. Publish evidence with its limitations, and make sure governance minutes reflect dissent accurately.
- Watch leading indicators. Opt-out rates, complaints and adoption levels are early signals that trust is weakening; track and report them to the board.
Bottom line
The National Data Guardian has not told ministers to drop Palantir, but she has said that commercial muscle and technical capability cannot override trust. Her letter is a useful reference for any UK organisation outsourcing sensitive data: accurate documentation, a credible exit route and honest evidence are governance controls, and without them a technically sound system can still fail.
Sources
- GOV.UK: NDG advises minister on public and professional trust in the FDP
- National Data Guardian: The Federated Data Platform: Public and professional trust (letter, PDF)
- Computer Weekly: FDP programme must command trust to succeed, says data guardian
- The Register: NHS England rapped over inaccurate Palantir patient data disclosure
- Healthcare Management: Regulator considers concerns over presentation of FDP-related data
