Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, with reference to the 10-Year Health Plan, what safeguards will be put in place to prevent hostile actors from accessing genomic data held by the NHS.

All organisations that have access to National Health Service patient data and systems must use the Data Security and Protection Toolkit (DSPT) to provide assurance on an annual basis that they are practising good data security and that personal information is handled correctly. In September 2025, we introduced the Cyber Assessment Framework (CAF) to aligned DSPTs in order to raise DSPT requirements for genomics organisations as suggested by the Department. The CAF is the National Cyber Security Centre’s framework and focuses on outcomes and principles to guide good decision-making, and the CAF-aligned DSPT return is supported by an independent audit to the mandated framework.

National cyber teams are tackling the changing cyber risk head-on through their ambitious Cyber Improvement Programme, expanding protection and services to better protect the health and care system, backed up with over £338 million of investment since 2017.

Patients who are offered whole genome sequencing through the NHS can consent to having their genomic data stored in the National Genomic Research Library (NGRL) which is run by Genomics England. Data stored in the NGRL is de-identified and access to it is carefully controlled, including through an independent Access Review Committee, which ensures that only approved individuals from approved institutions have access to the data. Approved researchers can only access the data within a Secure Research Environment for health research purposes and are not allowed to extract data from the library.