Parliamentary Search

Written question asked by Martin Wrigley (Liberal Democrat) on Tuesday, 7 July 2026, in the House of Commons. It was due for an answer on Monday, 13 July 2026 (named day). A holding answer was provided on Tuesday, 14 July 2026. A substantive answer was provided by Preet Kaur Gill (Labour) on Tuesday, 14 July 2026 on behalf of the Department of Health and Social Care.

NHS: Data Protection

Question

To ask the Secretary of State for Health and Social Care, who has custody over the encryption keys used to protect data held within the NHS Federated Data Platform and the Privacy Enhancing Technologies.

Answer

NHS England owns the keys. The Privacy Enhancing Technology (PET) software generates, controls, and stores the key values securely, so they are not accessible to human users.

The use of encryption keys is strictly controlled by NHS England for the NHS Federated Data Platform (NHS FDP) tenant and by the data owners of local tenants.

Both the NHS FDP and PET contracts are based on Government Legal Department terms and conditions, aligning to best practice in respect of cyber security and security management, which is reflected in the redacted versions of the agreements available on Contracts Finder.

The contract terms reflect and support the management of encryption keys as set out above, where specific requirements relate to encryption keys this would be included in the specifications of the contracts. Both agreements have terms which ensure enforcement of United Kingdom legislation and regulatory requirements in relation to data processing. For reference, the NHS FDP contract can be found at the following link:

https://www.contractsfinder.service.gov.uk/Notice/0f8a65b5-23a2-4294-abb1-a7fd8efb3ad0

In addition, the NHS England PET contract can be found at the following:

https://www.contractsfinder.service.gov.uk/Notice/2fa49293-bc01-4e0f-a017-f01cb0195212

Secondary information

Type
Written question
Reference
16702
Session
2026-27
Subjects
Data protection NHS Cryptography
Link
View this Written question on www.parliament.uk