A topic I have been banging on about for years from a data sharing and access perspective is the UK’s growing dependence on large American technology companies.

More importantly, when did the UK public agree to it?

The point is not whether the contracts were legally procured, whether somebody completed a Data Protection Impact Assessment or even whether the supplier met the technical requirements.

When were the British public actually asked whether some of our most important national data infrastructure should be operated using technology supplied by companies such as Palantir and Amazon? Even more importantly the size of the contracts procured is obscene.

The Palantir contracts

Since December 2020, the published award values for Palantir’s NHS England contracts total approximately £206 million: £23.5 million awarded in December 2020 for continued work on the COVID-19 data store,[13] and £182,242,760 for the Federated Data Platform in November 2023.[4] A £1.5 million trial contract preceded them in June 2020,[14] and a reported extension in January 2023 sits between them.

A note on all the figures that follow. Published award values, procurement notice estimates and announced ceilings are three different measures and they are not directly comparable, so every total in this piece is approximate.

The relationship with the NHS began during COVID-19. What followed was a succession of contracts and extensions before NHS England launched the procurement for its Federated Data Platform, or FDP.

On 1 April 2022, NHS England published its Prior Information Notice for the proposed platform.[1]

The FDP was intended to connect data across NHS organisations and initially support five areas:

  • population health and person insight;

  • care coordination;

  • elective recovery;

  • vaccines and immunisation; and

  • supply chain.[1]

Before procuring it, NHS England conducted a consultation, but who was explicitly invited?

The notice states that NHS England was issuing a Request for Information and holding a briefing session for suppliers.[1] A subsequent notice on 13 April 2022 was clearer:

“Interested suppliers are invited to participate in NHS England’s pre-market consultation.”[2]

The estimated total value was later corrected to £360 million in an amended notice on 25 July 2022.[3] So there was certainly consultation before procurement, just seemingly not with the general public.

Palantir won

On 22 November 2023, NHS England awarded the Federated Data Platform and Associated Services contract to Palantir Technologies UK Ltd.[4]. The primary award record gives the contract value as: £182,242,760.

The initial contractual period runs to 15 February 2027.[4]

NHS England explains that the maximum arrangement can run for seven years, but only the first three-year period is committed, followed by potential extensions of two years, then one year, then another year.[5]

The frequently quoted £330 million figure is the ceiling of that wider seven-year arrangement, and it is not the same measure as the £360 million estimate carried in the procurement notice. On the day of the award the Secretary of State for Health and Social Care told Parliament that first-year investment was expected to be at least £25.6 million.[15] It is not the amount handed to Palantir on the day the contract was signed, but neither is £182 million an experimental technology trial. This is substantial national infrastructure.

What does the platform actually do?

NHS England describes the FDP as an NHS-controlled platform connecting health information across the NHS.[5] Palantir is contractually a data processor, rather than the data controller. According to NHS England, Palantir cannot commercialise or market NHS data, use it for another purpose, create products from it, or train AI models using NHS data.[5] The contract also requires data to be stored, processed and accessed within the UK, with restrictions on access by supplier personnel outside the country.[5]

Those are important protections and should be acknowledged. However there is a larger governance question here.

Who decided that this was an acceptable architecture in the first place?

Where were the public in the decision making process?

NHS England says that it “consulted and engaged widely” on the FDP requirements, including with organisations such as the Patients’ Association, National Voices and the Royal Colleges.[6] That is engagement. It is not quite the same thing as asking the population whether it accepts the underlying decision, and the timing is interesting.

On 29 September 2023, NHS England announced a major programme in which members of the public would be asked to help shape how their health data was used.[7] The FDP was specifically named as one of the programmes to be discussed.

But the planned public events were to begin the following year and continue until March 2025.[7] The Palantir contract was awarded on 22 November 2023.[4]

So just to be clear:

  • Public engagement announcement: 29 September 2023.

  • Palantir contract award: 22 November 2023.

  • Major public engagement events: starting in 2024.[7]

By May 2024, NHS England’s own FDP Check and Challenge Group was still reviewing the proposed approach to public engagement. The minutes record that the programme intended to undertake nationally representative deliberative engagement, including face-to-face and virtual sessions.[8]

In other words, substantial public engagement about the FDP continued after the contract had already been awarded. That does not mean there was no public or patient involvement before the decision. There was engagement with representative organisations and panels, but I have found no primary record of a national public consultation before the award that asked the more fundamental question:

Should this infrastructure be procured and operated this way at all?

That is a very different question from asking people how an already-procured system should operate.

Amazon Web Services

The NHS is not an isolated example of UK public infrastructure becoming dependent on American technology. Companies House provides another fascinating case. Companies House itself documented the migration and the service was already running on Amazon Web Services by 2017.[9]

Initially the system ran in AWS’s Dublin region. Following concerns about where the data could legally be hosted after Brexit, Companies House moved the service to AWS’s London region on 26 March 2019.[9] This was not simply the public-facing website.

Companies House described what was moved:

  • 40 terabytes of document images.

  • Approximately 180 million images.

  • Approximately 300 million database rows.

  • Around 300GB of database data.

  • More than 30 Amazon S3 storage buckets.[9]

That is an extraordinary amount of British corporate information sitting on infrastructure supplied by Amazon. Again, that statement needs precision. AWS providing the infrastructure does not mean Amazon owns Companies House data. Nor have I found primary evidence showing that AWS has been granted a right to commercialise, sell or independently exploit Companies House register data. Infrastructure provider and data owner are not the same thing. It just seems that the direction of travel is clear and a dependency is still a dependency.

The direction of travel is revealing

Companies House’s own commercial pipeline shows that cloud infrastructure was not regarded as incidental IT. In January 2024 it published details of anticipated major outsourcing and procurement activity, including cloud hosting.[10] Companies House is therefore not merely renting somewhere to put a website.

Its digital services increasingly depend upon cloud infrastructure, which raises the same question as Palantir, although the technical relationship is different. At what point does a technology supplier stop being a vendor and become part of the operational fabric of the state? Because once that happens, changing supplier becomes considerably more difficult than changing a procurement spreadsheet.

There is a distinction here that needs to be made crystal clear:

  • Government can consult suppliers.

  • It can run competitive procurements.

  • It can establish advisory groups.

  • It can consult representative organisations.

  • It can comply with data protection legislation.

  • It can publish privacy notices.

  • It can conduct public engagement.

All of those things may be entirely legitimate, but none automatically answers the question:

Did the public consent to the strategic direction?

Perhaps we need to stop pretending procurement and democratic legitimacy are interchangeable. They are not.

The NHS example makes the distinction particularly stark because the chronology is visible in the Government’s own documents.

  • Suppliers were explicitly invited to consultation in April 2022.[1][2]

  • Palantir was awarded the contract in November 2023.[4]

  • The nationally representative public engagement programme followed.[7][8]

By March 2025, NHS England’s own Public Engagement Portal had received feedback explicitly raising “consultation concerns”, alongside concerns about privacy, consent, trust, value and cost.[11]

In June 2026, the National Data Guardian reported that members of the public were contacting her office with concerns about external contractors accessing identifiable patient information through the FDP and its associated data environment.[12]

The public clearly has views, but the burning issue is they were only solicited after architecture was decided?

This is bigger than Palantir or Amazon

This is not an article about whether Palantir is good or bad. Nor is it an argument that AWS should never host government systems. It is about how infrastructure decisions accumulate.

If a platform begins as a response to an emergency, and then:

  • A cloud service solves an immediate technical problem.

  • A pilot becomes a contract.

  • The contract becomes a platform.

  • The platform connects more organisations.

  • More processes become dependent upon it.

  • Eventually replacing it is no longer simply a purchasing decision.

  • It becomes an operational risk.

Somewhere during that sequence of individual decisions, we discover that parts of the machinery of the British state now depend upon a handful of enormous technology companies. Every individual step may have been defensible, but the outcome still deserves scrutiny, because governance is not merely about whether the paperwork exists.

It is also about who gets to make the decision, when they make it, who can challenge it, and whether that challenge happens before or after the decision becomes expensive to reverse. So the question remains.

When did you and I agree to this?

Sources

[1] NHS England, NHS Federated Data Platform, Prior Information Notice 2022/S 000-008755, 1 April 2022. Verified live 15 August 2026. https://www.find-tender.service.gov.uk/Notice/008755-2022

[2] NHS England, NHS Federated Data Platform, Notice for changes or additional information 2022/S 000-009960, 13 April 2022. The notice expressly invited “interested suppliers” to the pre-market consultation. Verified live 15 August 2026. https://www.find-tender.service.gov.uk/Notice/009960-2022

[3] NHS England, NHS Federated Data Platform, Notice for changes or additional information 2022/S 000-020196, 25 July 2022. Corrects the estimated total value to £360,000,000.00. Verified live 15 August 2026. https://www.find-tender.service.gov.uk/Notice/020196-2022

[4] NHS England, Federated Data Platform and Associated Services, Contracts Finder, current award notice published 21 March 2024. Awarded to Palantir Technologies UK Ltd on 22 November 2023; total value of contract £182,242,760; contract end date 15 February 2027; procedure type competitive dialogue. The notice states that the contract value is not a committed amount and that consumption-based pricing could take it to a forecast £330 million, which is also not committed. Verified live 15 August 2026. https://www.contractsfinder.service.gov.uk/Notice/0f8a65b5-23a2-4294-abb1-a7fd8efb3ad0 (Superseded earlier notice, published 22 December 2023, carrying the three-part redacted contract PDFs: https://www.contractsfinder.service.gov.uk/Notice/2e8c61c0-faab-4f99-ae69-b00df6bae165)

[5] NHS England, NHS Federated Data Platform: frequently asked questions and contract explainer. Sets out contractual term, processing relationship, data-location requirements, restrictions on commercialisation and AI training, and provisions intended to mitigate supplier lock-in. Verified live 15 August 2026. https://www.england.nhs.uk/digitaltechnology/nhs-federated-data-platform/fdp-faqs/

[6] NHS England, Federated Data Platform update, board paper, agenda item 7 (public session), report by Ming Tang, Chief Data and Analytics Officer, 7 December 2023. Paragraph 14 states that NHS England has “consulted and engaged widely” on the FDP requirements, including with patient and professional representative bodies such as the Royal Colleges, the Patients’ Association and National Voices, and that ongoing public engagement is planned throughout the period of the contract. Paragraph 15 records the Check and Challenge Group being set up. Verified live 15 August 2026. https://www.england.nhs.uk/long-read/federated-data-platform-update/

[7] NHS England, Public asked to shape future use of health data by the NHS, 29 September 2023. Announces public engagement events beginning in the new year and continuing to March 2025, expressly including the FDP. Verified live 15 August 2026. https://www.england.nhs.uk/2023/09/public-asked-to-shape-future-use-of-health-data-by-the-nhs/

[8] NHS England, Federated Data Platform Check and Challenge Group: minutes and action notes, 17 May 2024 (published 4 September 2024). The FDP public engagement proposal was presented to Check and Challenge members for review and feedback, with an action for members to review it and respond by 14 June 2024. The minutes record that engagement will be deliberative, will be a mix of face-to-face and virtual sessions, and will be nationally representative. They also record that procurement for the engagement work was due to take place in June 2024, with delivery planned from August to October 2024. Verified live 15 August 2026. https://www.england.nhs.uk/long-read/federated-data-platform-check-and-challenge-group-minutes-and-action-notes-17-may-2024/

[9] Companies House, Making the best use of cloud capabilities, Companies House official blog, 2 July 2019. Companies House’s own account of its AWS infrastructure and migration from AWS Dublin to London on 26 March 2019. All five data figures confirmed against the source. Verified live 15 August 2026. https://companieshouse.blog.gov.uk/2019/07/02/making-the-best-use-of-cloud-capabilities/

[10] Companies House, Companies House commercial pipeline at January 2024, published 15 January 2024. A forward look at anticipated outsourcing activity over the following 18 months, covering major projects and anticipated procurements valued at £2 million or more. The published CSV includes reference CH-1222, Cloud Hosting Services, a re-procurement of the same scope with an estimated contract value of £3,500,000. Verified live 15 August 2026. https://www.gov.uk/government/publications/companies-house-commercial-pipeline-at-january-2024

[11] NHS England, Federated Data Platform Check and Challenge Group: minutes and action notes, 21 March 2025. Records 255 expressions of interest, 116 questions and 38 pieces of feedback through the portal; themes included privacy and consent, value and cost, trust and “consultation concerns”. Verified live 15 August 2026. https://www.england.nhs.uk/long-read/federated-data-platform-check-and-challenge-group-minutes-and-action-notes-21-march-2025/

[12] National Data Guardian, Statement on NHS Federated Data Platform data access, in response to the Not With My NHS Data campaign, 3 June 2026. Records concerns received from members of the public regarding external contractors’ access to identifiable patient information. Verified live 15 August 2026. https://www.gov.uk/government/news/national-data-guardian-statement-on-nhs-federated-data-platform-data-access-in-response-to-the-not-with-my-nhs-data-campaign

[13] Contracts Finder, award to Palantir Technologies UK Ltd, awarded 11 December 2020, contract dates 12 December 2020 to 11 December 2022, total value £23,500,000. Verified live 15 August 2026. https://www.contractsfinder.service.gov.uk/Notice/9233a767-bd2b-49eb-9c57-310bb2e259e0

[14] Contracts Finder, purchase of Palantir Foundry Data Management Platform under G-Cloud 11 for the COVID-19 response, awarded 12 June 2020, total value £1,500,000. Verified live 15 August 2026. https://www.contractsfinder.service.gov.uk/Notice/c66036ee-a63e-4452-bafe-2410e9b51587

[15] Written statement HCWS57, NHS England Update, made 21 November 2023 by Victoria Atkins, Secretary of State for Health and Social Care, Department of Health and Social Care. States that first-year investment is expected to be at least £25.6 million and that up to £330 million will be invested over the total seven-year contractual period. Also made in the House of Lords as HLWS54. Verified live 15 August 2026. https://questions-statements.parliament.uk/written-statements/detail/2023-11-21/hcws57