44,000 NHS Data Objections Put the Palantir Deal Under Pressure

More than 44,000 people have filed formal legal objections to their health data being shared with, stored in or used by the nationwide NHS Federated Data Platform built with Palantir's AI technology, according to reporting by The Guardian.

The figure was reported on 30 September 2026. The objections invoke Article 21 of the UK General Data Protection Regulation, the UK privacy law that gives people the right to object to how their personal data is processed. The coordinated filing was organised by the not-for-profit campaign group 38 Degrees.

The contract at issue is valued at £330 million. It is a seven-year deal for the Federated Data Platform that comes into force in February 2027. That start date gives ministers, NHS England and the supplier a fixed deadline on buying and oversight decisions.

Two House of Commons select committees have called for Labour to exercise a break clause, a contract term that allows an early exit, in the NHS-Palantir deal. Andy Burnham will be required to make a decision to back or axe Palantir within months.

The Federated Data Platform is a data infrastructure layer, the underlying plumbing that lets different NHS computer systems work together. It is designed to connect the NHS to itself by bringing together operational data scattered across disconnected systems, as described by Palantir in April 2026 reporting (Palantir Blog). In practical terms, it is software that enables NHS organisations to bring together different sources of information so staff can access vital data stored in separate places.

NHS materials state that the service uses Palantir Foundry, Palantir's software for organising and analysing data, to make better use of data to improve patients' lives. Multiverse and Palantir have also partnered to launch apprenticeship programmes supporting NHS data and AI transformation tied to the platform (Palantir Investors).

The objections arrive after months of contested disclosures around access controls. In May 2026, NHS England agreed to create an "admin" role granting non-staff "unlimited access" to identifiable patient data, according to Reuters. The NHS was separately told to prepare for the possibility of Palantir being removed as the supplier of the platform. Campaigners have argued the platform could make sensitive NHS data easier to combine, access and repurpose in ways patients cannot easily see or control, an argument laid out in April 2026 commentary (Reuters BreakingViews).

Palantir has stated that patient data in the platform is handled only according to the NHS's instructions and remains in the UK. That position presents Palantir as a data processor acting under NHS control, rather than a data controller that decides why and how data is used.

Looking at what this means for decision-makers, the 44,000 Article 21 objections test two practical problems at once. The first is handling objections at national scale. A system that copes with hundreds of requests can struggle when tens of thousands of legally framed requests arrive together, each needing assessment and a reply. The second is procurement continuity. A seven-year contract starting in February 2027 leaves limited room to rework access rules, renegotiate terms, or change supplier without disrupting trusts that have built work routines around the system.

The broader context here is control over federated infrastructure. Federation keeps data where it is while allowing searches across boundaries. For health managers, that model offers joined-up working without moving all records into one central store. For privacy advocates, the same ability raises questions about secondary use, audit trails and effective patient control, particularly where admin roles and cross-organisation access are involved.

In my view, the next phase will turn less on headline numbers than on administrative handling. How NHS bodies log, assess and answer Article 21 objections, what access and audit safeguards are documented for non-staff roles, and whether assurances on UK storage and instruction-based processing are written into enforceable contract terms will shape both legal risk and political room for manoeuvre before February 2027.