Eight pages to a minister: what the data guardian says trust is worth
What happened
On 12 October 2026, the government published a letter about who should be trusted with NHS patient data. It was written by Dr Nicola Byrne, the National Data Guardian for Health and Social Care in England, and sent to James Frith MP, the Minister for Health Innovation at the Department of Health and Social Care. It runs to eight pages. The subject is the NHS Federated Data Platform, usually shortened to the FDP. This is the large software system the NHS in England uses to bring together data from different hospitals and services, so that managers and clinicians can see things like waiting lists, bed numbers and operation schedules in one place. The letter is advice about decisions on the platform's future. The National Data Guardian makes three main points. First, when the NHS assesses suppliers for systems that handle health and care data, public and professional trust should carry significant weight – not be treated as a soft extra. Second, decisions should rest on clear, objective evidence of both the benefits and the limits of a system. That evidence should be communicated openly, inside a culture that welcomes challenge rather than resenting it. Third, the practical technology questions need addressing: how well systems work with each other, the risk of being locked in to one supplier, and where data actually sits. The letter says open standards and open-source technology should be considered. The letter is careful about what it is not doing. The National Data Guardian "strongly supports the ambitions of the FDP programme" to improve care through better use of data, and does not recommend any particular contract outcome.
Why this matters
Almost everyone reading this has an NHS record. You did not choose the software it sits in. That is why the trust point is not woolly. If people lose confidence in how their health data is handled, some of them opt out. When enough people opt out, the data becomes patchier, and the research and planning that data was meant to support get worse. Mistrust has a cost measured in worse care, not just in bad headlines. The same applies to staff. Nurses, GPs and pharmacists are the people who have to tell patients that a system is safe. If they are not convinced, that conversation does not go well. There is also a more ordinary reason this matters now. Big NHS technology contracts come up for review. The letter is addressed to a minister at a moment when decisions about the platform's future are live. Advice that arrives before a decision is worth more than advice that arrives after it. And the letter's three points are, in truth, good tests for any organisation that holds your health information – including a pharmacy, a GP surgery or a delivery service. Can you explain plainly what you do with the data? Can you show evidence, including the bits that look bad? Can someone else check your work?
What the evidence actually says
The background to this letter is a specific, documented problem, and it is worth getting right. In June 2026, the National Data Guardian published a statement responding to public concern raised through a campaign called Not With My NHS Data. The concern was about staff from outside the NHS being able to see information that could identify individual patients. The statement explains what happened. A Data Protection Impact Assessment – the formal document that sets out how a system handles personal data – said that access to identifiable patient information would be limited to NHS staff with a legitimate need. The National Data Guardian says she was not aware that some external contractor staff also had access, and wrote to the programme to seek clarification. NHS England has accepted that the assessment was inaccurate, apologised and committed to correcting it. Its published response confirms that some external supplier staff supporting the platform can see identifiable patient information for specific technical purposes, working under NHS England's direction. NHS England says that access is technically necessary. In an update on 28 July 2026, the National Data Guardian was careful to add that she is not in a position to verify that claim independently, because her office is not involved in running the platform. That last sentence matters for reading all of this fairly. The National Data Guardian is an independent statutory adviser, not a regulator. The office has no investigatory or enforcement powers. It can advise, question and publish. It cannot audit or fine. The statement also contains a line worth keeping: "public confidence, transparency and accountability are what determine whether a programme ultimately succeeds". What the published material does not tell us is how the minister will respond, or what happens to the contract. The letter deliberately avoids recommending an answer. Anyone claiming to know the outcome is guessing.
Qurexa perspective
We handle patient information every working day. A prescription delivery cannot happen without a name, an address and, often, the knowledge that someone takes a particular medicine. So we read a letter like this as being partly about us, and about every pharmacy and delivery service in the country. The three tests in it are ones we think any organisation should be able to pass. Can you say plainly what data you hold and why? Can you show evidence rather than assurances? Will you welcome being challenged, including by the people whose data it is? We will not pretend we are the subject of this story – we are not. But we would rather say out loud that the standards being asked of a national platform are the right standards for a small Lincolnshire company too, than stay quiet and hope nobody asks. If you ever want to know what we hold about you, or want it corrected or deleted where we are allowed to, you are entitled to ask. That is not a favour. It is your right under data protection law, and it applies to your GP surgery and your pharmacy as much as to us.
Practical advice
If this story has made you think about your own records, here is what you can actually do. You can ask any organisation what personal data it holds about you. This is called a subject access request. It can be a simple email, it is free, and the organisation normally has one month to reply. You can set a National Data Opt-out if you do not want your confidential patient information used for research and planning, beyond your own care. You can do this on the NHS website or by calling the NHS. It does not affect the treatment you receive. Before you opt out, read what the opt-out does and does not cover. It does not apply to data used for your own direct care, and it does not apply to some legally required uses, such as certain public health work. Deciding from the actual rules beats deciding from a headline. If you think an organisation has mishandled your data, complain to the organisation first, then to the Information Commissioner's Office, which is the regulator with real powers. And if a company holding your health data cannot explain in plain English what it does with it, treat that as information in itself.
What to know
England's National Data Guardian, Dr Nicola Byrne, has written an eight-page letter to health minister James Frith MP advising on public and professional trust in the NHS Federated Data Platform. It was published on 12 October 2026. The advice has three parts: trust should carry significant weight when assessing suppliers; decisions should rest on clear evidence of benefits and limits, communicated openly; and interoperability, supplier lock-in and data sovereignty need addressing, with open standards and open-source technology considered. The letter supports the programme's ambitions and does not recommend a particular contract outcome. The background is a documented error. A data protection assessment said only NHS staff with a legitimate need could see identifiable patient data. NHS England has accepted that some external supplier staff can, for technical purposes, apologised, and said it will correct the document. The National Data Guardian says she cannot independently verify NHS England's claim that this access is technically necessary. The National Data Guardian is an independent adviser, not a regulator, and has no enforcement powers. You can ask any organisation what it holds about you, and you can set a National Data Opt-out through the NHS if you do not want your confidential patient information used beyond your own care. Sources: National Data Guardian for Health and Social Care, "NDG advises minister on public and professional trust in the FDP", GOV.UK, 12 October 2026, https://www.gov.uk/government/publications/ndg-advises-minister-on-public-and-professional-trust-in-the-fdp; National Data Guardian, "National Data Guardian statement on NHS Federated Data Platform data access, in response to the Not With My NHS Data campaign", GOV.UK, first published 3 June 2026, updated 28 July 2026, https://www.gov.uk/government/news/national-data-guardian-statement-on-nhs-federated-data-platform-data-access-in-response-to-the-not-with-my-nhs-data-campaign; Digital Health, "Data guardian seeks clarification on Palantir patient data access", June 2026, https://www.digitalhealth.net/2026/06/data-guardian-seeks-clarification-on-palantir-patient-data-access/. This article is for general information and does not replace advice from a doctor, pharmacist or other qualified healthcare professional.
Related articles
Six hours, not never: the ICU filter notice the MHRA issued today
The UK's medicines and devices regulator has issued a new safety notice to hospitals, and it is about timing. On 13 October 2026 the Medicines and Healthcare p…
Update: the tests came back, and it was not plague
This is a follow-up to a story we covered on 5 October, when nearly 200 people were being monitored after the death of a laboratory worker in Siberia. There has…
Twenty-four hours to spot an outbreak: the target set in Berlin on Monday
On Monday 12 October 2026, the World Health Organization launched a new five-year plan for the way it watches for outbreaks. The launch took place in Berlin, at…