18:00hrs Thursday 23 April 2026
The SAIL Databank is aware of reports of a data breach of UK BioBank held data. This is a matter that we take extremely seriously and we can confirm that we are working with UK BioBank and partner organisations to gather a clear picture of the timeframe and details of this data breach.
At present we can confirm that the SAIL Databank provides data twice a year to the UK Biobank on behalf of Welsh individuals who have individually consented that their data is supplied to UK Biobank for their approved research purposes. In line with SAIL’s strict security and privacy protecting processes, the data passed to UK BioBank following individual patient consent, is de-identified – meaning that no identifiable information such as the person’s name, date of birth, address or contact details are ever received or handled by the SAIL Databank. Identities are protected by an anonymisation process that includes de-identification by an NHS Trusted Third Party, and technical, physical and procedural safeguards at SAIL.
We are working closely with UK Biobank to understand more about the timeframe of the data breach, and to ascertain if any of the data provided by SAIL was included in the breach. We can confirm that we have stopped all future scheduled deposits of data to the UK BioBank. SAIL will participate fully with the Information Commissioner’s Office (ICO) or any other regulatory body’s investigation into this incident at UK Biobank if approached to do so.
About SAIL:
The SAIL Databank supports accredited researchers to link and analyse routinely collected de-identified population and health data within a safe and secure remote access environment. SAIL is built on a privacy by design model, with privacy protecting technical, physical, procedural and ethical safeguards in place at every stage of data access.
The SAIL Databank is underpinned by robust governance protocols and accreditations. The SAIL Databank is accredited under ISO 27001, an internationally recognised best practice standard for an information Security Management System (ISMS). An ISMS is a framework of policies and procedures that include all legal, physical and technical controls that an organisation has in place to secure information / data throughout its lifetime.
SAIL received UK Statistics Authority endorsement from the National Statistician and the Board of the UK Statistics Authority recognising SAIL’s role as a trusted processor for the provisioning, storing, matching, linking and anonymisation of data. SAIL’s Cyber Essentials accreditation demonstrates SAIL Databank’s commitment and robust safeguards to protect users and data providers from cyber attacks. Certification by this government-backed, National Cyber Security Centre scheme, protects against a wide range of cyber attacks.
SAIL’S Information Governance Review Panel (IGRP) provides independent guidance and advice on Information Governance policies, procedures and processes for SAIL Databank. The Panel reviews all proposals to use SAIL Databank to ensure that they are appropriate and in the public interest, and it comprises representatives from various organisations and sectors, and members of the public.
SAIL’s processes and accreditations reflect its commitment to both securing data for the safe and ethical reuse for accredited research for the public good, and the continuous improvement of the information security management system and associated controls.
