Award

Ask AI about this notice

Summarise, research or assess it with AI

View Markdown

Share this notice

Send this contract to a colleague

Data deletion Inspections

UK Biobank Ltd

This public procurement record has 3 releases in its history.

Award

20 Oct 2026 at 15:18

UK7 - Contract Details Notice
Award

01 Sep 2026 at 11:04

UK6 - Contract Award Notice
Award

07 Aug 2026 at 16:12

UK5 - Transparency Notice
Summary of the contracting process

UK Biobank Limited commissioned independent data-deletion inspection and reporting services. The work supports its effort to close out the legacy model of downloading research data: suppliers contact research institutions that previously accessed the biomedical database, obtain evidence about deletion of UK Biobank data after research, and review and report each institution’s position. The checks cover projects involving approximately 1,000 institutions in total. The purpose is to establish the security position of participant records used in completed and ongoing research projects, following a reported incident involving purported sale of de-identified participant data. The service also forms part of UK Biobank’s response to the incident and its work to strengthen safeguards around research data. The buyer is UK Biobank Limited, based in Stockport. Delivery is across the UK.

The procurement is complete and contracts were awarded directly to KPMG LLP and BSI Standards Limited for the same data-deletion inspection service. The stated award values for the initial period are £1.25 million to KPMG and £700,000 to BSI, excluding VAT. Both awards are dated 1 September 2026. KPMG’s contract was signed on 1 September 2026 and runs from that date to 31 August 2027; BSI’s was signed on 18 September 2026 and runs to 31 August 2027, starting on 18 September. Each contract may be extended, with an outer period end date of 31 August 2028; the scope and length of any extension are uncertain. The route was direct award on grounds of extreme and unavoidable urgency, without a competitive tender. The stated reason was the need to obtain, review and report the evidence without delay.

This award shows demand for independent, evidence-based assurance of data deletion across a large research network. Suppliers well placed for similar work would be able to engage many research institutions, gather and assess documentary evidence against contractual deletion obligations, and produce clear, consistent reports that help a buyer understand its data-security position. Credibility depends on handling sensitive biomedical and personal-data contexts carefully, maintaining independence, and applying robust information-security and confidentiality practices. The two awards demonstrate that the requirement was divided between specialist external providers rather than delivered by one supplier alone. Organisations with capacity to manage substantial, distributed reviews and provide reliable reporting to a research database operator are the closest fit; the service supports the buyer’s wider responsibility to protect participant information and restore confidence in secure research access.

How relevant is this notice?

Notice Information

Notice Title

Data deletion Inspections

Notice Description

UK Biobank is a large-scale biomedical database and research resource containing genetic, lifestyle and health information from around half a million UK participants. UK Biobank's database, which includes blood samples, heart and brain scans and genetic data of the 500,000 volunteer participants, is globally accessible to approved researchers who are undertaking health-related research that's in the public interest. Protecting the confidentiality and security of participant data is UK Biobank's highest priority. Before a recent widely reported data incident, UK Biobank was undertaking a phased transition from a data download model to a more secure, platform-by-default access model through the UK Biobank Research Analysis Platform (UKB-RAP), in line with principles of a Secure Data Environment approach. The data incident has resulted in the acceleration of the delivery and implementation of technical and operational controls that were in development, principally the introduction of an automated checking system to prevent de-identified participant data being egressed from the research analysis platform. As part of addressing the legacy data download model, UK Biobank is working to complete the transition and ensure outstanding downloaded data are deleted. Affected researchers are being contacted to complete this work, and UK Biobank intends to procure services from two independent third-party organisations to report on the researchers' data deletion position. UK Biobank issued a UK5: Transparency notice - Procurement Act 2023 for this award which was published on 7 August 2026. UK Biobank intends to award the contracts directly to suppliers that are not excluded suppliers pursuant to section 41(1)(a) of the Procurement Act 2023 and on the basis of extreme and unavoidable urgency. UK Biobank has conducted a thorough investigation into a recent widely reported incident whereby de-identified data relating to UK Biobank participants was purportedly listed for sale on a consumer website in China. The purported sale was a clear breach of the contractual commitments made by approved researchers who had legitimate access to UK Biobank's biomedical database. UK Biobank provides approved researchers with access to the de-identified data contained in its database via its secure research analysis platform which was (and remains) suspended following the incident. As part of a series of measures to prevent further misuse of de-identified participant data and reassure participants that their data is safe and secure, UK Biobank is enhancing its systems including accelerating the development of an automated checking system to prevent de-identified participant data being egressed from the research analysis platform. UK Biobank intends to enter into contracts with KPMG and BSI respectively to contact the research institutions which previously accessed UK Biobank's biomedical database, obtain relevant information and evidence around the deletion of UK Biobank's data on completion of their research in line with their contractual obligations. It is necessary for reasons of extreme and unavoidable urgency that the contracts to obtain evidence, review and report on the data deletion status of (in aggregate) projects of ~1,000 relevant institutions are entered into without delay and therefore a competitive tendering exercise cannot be undertaken. This exercise will give UK Biobank a better picture of the security of participant records used in completed and ongoing projects and assist UK Biobank to resume its focus on allowing safe and secure access to researchers worldwide to conduct vital research into the diagnosis, prevention and treatment of diseases.

Procurement Information

UK Biobank has conducted a thorough investigation into a recent widely reported incident whereby de-identified data relating to UK Biobank participants was purportedly listed for sale on a consumer website in China. The purported sale was a clear breach of the contractual commitments made by approved researchers who had legitimate access to UK Biobank's biomedical database. UK Biobank provides approved researchers with access to the de-identified data contained in its database via its secure research analysis platform which was (and remains) suspended following the incident. As part of a series of measures to prevent further misuse of de-identified participant data and reassure participants that their data is safe and secure, UK Biobank is enhancing its systems including accelerating the development of an automated checking system to prevent de-identified participant data being egressed from the research analysis platform. UK Biobank entered into contracts with KPMG and BSI respectively to contact the research institutions which previously accessed UK Biobank's biomedical database, obtain relevant information and evidence around the deletion of UK Biobank's data on completion of their research in line with their contractual obligations. It is necessary for reasons of extreme and unavoidable urgency that the contracts to obtain evidence, review and report on the data deletion status of (in aggregate) projects of ~1,000 relevant institutions are entered into without delay and therefore a competitive tendering exercise cannot be undertaken. This exercise will give UK Biobank a better picture of the security of participant records used in completed and ongoing projects and assist UK Biobank to resume its focus on allowing safe and secure access to researchers worldwide to conduct vital research into the diagnosis, prevention and treatment of diseases.

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-h6vhtk-06df71
Publication Source
Find A Tender Service
Latest Notice
https://www.find-tender.service.gov.uk/Notice/099117-2026
Current Stage
Award
All Stages
Award

Procurement Classification

Notice Type
UK7 - Contract Details Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Direct
Procurement Method Details
Direct award
Tender Suitability
Not specified
Awardee Scale
Large

Common Procurement Vocabulary (CPV)

CPV Divisions

79 - Business services: law, marketing, consulting, recruitment, printing and security

CPV Codes

79313000 - Performance review services

Notice Value(s)

Tender Value
Not specified
Lots Value
Not specified
Awards Value
£1,950,000 £1M-£10M
Contracts Value
£1,950,000 £1M-£10M

Notice Dates

Publication Date
20 Oct 20261 weeks ago
Submission Deadline
Not specified
Future Notice Date
Not specified
Award Date
1 Sep 20261 months ago
Contract Period
Not specified - Not specified
Recurrence
Not specified

Notice Status

Tender Status
Complete
Lots Status
Complete
Awards Status
Active
Contracts Status
Active

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
UK Biobank Ltd
Contact Name
Available with D3 Tenders Premium →
Contact Email
Available with D3 Tenders Premium →
Contact Phone
Available with D3 Tenders Premium →

Buyer Location

Locality
STOCKPORT
Postcode
SK3 0SA
Postcode Area
Stockport
Country
England
Major Region (ITL 1)
TLD North West (England)
Basic Region (ITL 2)
TLD3 Greater Manchester
Small Region (ITL 3)
TLD35 Greater Manchester South East
Delivery Location
Not specified
Local Authority
Stockport
Electoral Ward
Davenport & Cale Green
Westminster Constituency
Stockport

Supplier Information

Number of Suppliers
2
Supplier Names

KPMG LLP

BSI Standards Limited

Further Information

Notice Documents

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

Loading OCDS record...