Treasury sets new UK Budget info security rules 2026

On Monday 9 February 2026, HM Treasury published its Budget Information Security Review. If you remember last autumn’s Budget drama, this is the official plan to stop sensitive material circulating before Parliament hears it. The Treasury says it will tighten controls across teams and systems, and implement every recommendation in full. We’ve read the documents so you don’t have to-and pulled out what changes for 2026 and how to read pre‑Budget stories with care. (gov.uk)

Here’s what actually went wrong in 2025. The Office for Budget Responsibility (OBR) hosts its big forecasting report-the Economic and fiscal outlook, or EFO-online. Because of a configuration error in the publishing set‑up, the November 2025 EFO became accessible at 11:35, nearly an hour before the Chancellor spoke. With fuller logs, the National Cyber Security Centre (NCSC) now says the document was then downloaded at least 24,701 times; in March 2025 there were 16 early accesses too. Investigators are clear this was not a hostile cyber attack. (assets.publishing.service.gov.uk)

Why does this matter? The EFO frames the tax and spending choices MPs are about to debate. If markets or lobby groups can read it first, they can move first. In the House of Lords on 1 December 2025, ministers acknowledged serious reputational damage for the OBR and disruption on Budget day; the OBR has published its own investigation and related correspondence to explain what happened. When trust wobbles around an event that can shift gilt yields and the pound, everyone-from students of economics to long‑term savers-has a stake. (hansard.parliament.uk)

So what changes now? Before Budget 2026, the Treasury will add built‑in blocks that stop Budget files being freely sent, printed or downloaded, and it will limit access to named lists of people with a clear need to know. A new sensitivity marker-BUDGET - MARKET SENSITIVE-will apply to the most sensitive material, and fewer officials will be able to see it by default. Activity will be monitored and recorded so there’s an audit trail if something looks off. (assets.publishing.service.gov.uk)

There’s also a publishing shift you’ll notice. The March 2026 EFO will appear on GOV.UK and be released by the Treasury on the OBR’s behalf, with a longer‑term move of market‑sensitive OBR publications to GOV.UK planned. The Treasury, the OBR and the Bank of England are designing a joint protocol for what to do if anything slips out early again. The NCSC specifically recommended the GOV.UK route after its analysis of the 2025 incident. (assets.publishing.service.gov.uk)

How did the early access spread so widely last November? Investigators suggest someone used automated requests, from a small cluster of internet addresses, to probe for the file. Once a link worked, it propagated through social media and messaging apps. Crucially, most successful requests came after news outlets began reporting EFO content, which explains why the download count surged even though the first access was limited. (assets.publishing.service.gov.uk)

Alongside the tech error, a separate Cabinet Office inquiry looked at a Financial Times article on Friday 13 November 2025 about income tax plans. It did not identify the source of that story, but it did set out practical ways to tighten who sees what-by shrinking access lists and firming up compartments. The government says those changes will be in place before Budget 2026. (assets.publishing.service.gov.uk)

You’ll hear a lot about the Macpherson Principles-your quick guide to what can and cannot be shared before a Budget. After an embargo breach in 2013, the Treasury’s then permanent secretary, Sir Nicholas Macpherson, set out that the core of a Budget must not be pre‑briefed: the economic and fiscal projections, the fiscal judgement, and individual tax rates, reliefs and allowances. The new Review confirms these rules still apply today. Think of them as the “exam conditions” for Budgets. (gov.uk)

What this means for your media literacy: treat any pre‑Budget story that claims to know precise tax rates, thresholds or the OBR’s headroom with caution until the statement is delivered to MPs. Ministers can discuss themes or policy goals, but market‑sensitive details are meant to land in Parliament first. If a report appears to rely on the full EFO before the event, ask how it was sourced and check back for corrections. (publications.parliament.uk)

What to watch next. As 2026 approaches, look out for the BUDGET - MARKET SENSITIVE label on internal material, a smaller circle of named officials with access, and the March 2026 EFO appearing on GOV.UK rather than the OBR’s own site. If there is ever another breach, expect a faster, joined‑up response with the Bank of England involved-and a published paper trail explaining what happened. (assets.publishing.service.gov.uk)