The hidden cost of legacy data systems in UK public services

Executive summary

Legacy technology is no longer a background concern for UK public sector organisations. It is front and centre in a major parliamentary inquiry, a formal government roadmap with named departmental targets, and a growing body of evidence linking outdated infrastructure to service failure, data breaches, and blocked AI ambitions.

The House of Commons Science, Innovation and Technology Committee published Rewiring the State in June 2026, concluding that legacy systems represent 'huge efficiency, cost and security risks', with a warning that the government still does not know the full scale of the problem. The State of Digital Government Review (January 2025) also found that 28% of central government IT is classified as legacy, that 22% of those systems are red-rated for imminent failure, and that the public sector invests around 30% less on technology than international benchmarks.

For organisations managing national-scale, citizen, or mission-critical data, this is not an abstract policy problem. It shapes how services are delivered today, how securely data is held, and how much of the substantial investment now flowing into AI and cloud platforms will actually deliver value.

This whitepaper by Butterfly Data sets out the scale of the challenge, the compounding costs of inaction, what good migration looks like in practice, and how we help organisations move from risk to future-ready - safely and without unnecessary disruption.

These are not targets set by technologists for technologists. They are commitments made by departments to the government as part of a formal roadmap with political accountability. For the organisations in scope, and for those in adjacent or dependent sectors, they represent both a directive and a window of opportunity.

1.2 Parliamentary scrutiny: Rewiring the state

In June 2026, the House of Commons Science, Innovation and Technology Committee published Rewiring the State: Delivering Digital Government. This landmark report draws on two years of evidence-gathering and its conclusions on legacy systems are unambiguous.

"Legacy systems present huge efficiency, cost and security risks, and it is therefore deeply concerning that government still does not know the full scale of the problem. If legacy systems are not remediated, the government's digital transformation ambitions will struggle to succeed."House of Commons Science, Innovation and Technology Committee, Rewiring the State (June 2026)

The Committee recommended that GDS set up a Legacy Systems Taskforce with a remit to drive progress in remediating legacy systems across the public sector. It welcomed GDS's commitment to work with HM Treasury to ringfence funding for legacy remediation. And it was direct about what inaction means: the digitisation agenda, the AI ambitions, the planned digital ID - none of them can succeed on a foundation of legacy infrastructure.

1.3 The state of digital government review

The State of Digital Government Review published by DSIT in January 2025 provides the most comprehensive picture yet of the challenge. Key findings relevant to legacy migration:

• On average 28% of central government IT estates are classified as legacy - up from 26% in 2023, moving in the wrong direction.
• 22% of legacy systems are red-rated, indicating known security vulnerabilities, lack of vendor support, or inability to meet current requirements.
• Legacy estates run from 10% to 70% across police forces, and 10% to 50% across NHS trusts - with around 15% of organisations unable to estimate their legacy estate at all.
• Maintaining legacy systems typically costs three to four times more than maintaining modern alternatives.
• In 2024, 25% of surveyed organisations suffered critical outages - with 123 in NHS England alone. Some of these outages were linked directly to patient harm.
• At least 228 legacy IT systems were identified across government departments as of March 2024 (National Audit Office / NCSC).
• The government spends approximately 30% less on technology than international benchmark comparisons - a structural underfunding that has allowed legacy to accumulate for decades.

2. The compounding cost of delay

The case for delay always sounds reasonable at budget time. Legacy systems are still working. Teams are busy. The investment required looks large relative to the uncertain benefit. So another cycle passes, technical debt quietly compounds, and the eventual migration becomes both more expensive and more complex than it would have been.

Delay makes things progressively worse in four ways - all of which are compounding, not linear.

2.1 The cost spiral

McKinsey's research on technical debt estimates that CIOs put technical debt at 20–40% of the total value of their entire technology estate. More immediately, 10–20% of the technology budget nominally allocated to new products is diverted to servicing existing debt. High-debt organisations are 40% more likely to have incomplete or cancelled modernisation projects.

The parliamentary committee's evidence base reinforced this at a public sector scale: legacy maintenance costs three to four times more than maintaining modern equivalents, and there is a structural bias towards capital spend on new projects at the expense of maintaining existing systems. The result is that underfunding of legacy maintenance drives faster accumulation of legacy risk - a compounding dynamic rather than a stable steady state.

2.2 The security risk

The National Cyber Security Centre has stated that having a strategy to address technical legacy is 'a foundational precursor to engineering resilience'. That assessment has been tested repeatedly in recent years.

The NCSC managed 430 cyber incidents between September 2023 and August 2024, with 89 classified as nationally significant. The Government Cyber Resilience Report identified legacy systems as a prominent feature of security vulnerability. Of the 228 identified legacy systems across departments, many carry known vulnerabilities that cannot be patched because the vendor no longer supports the platform.

The data breach risk is not hypothetical. A 2023 Information Security Review - whose existence was kept secret until the SIT Committee's intervention - examined ten public sector data breaches and found common themes: insufficient controls over data exports, wrong-recipient email releases, and hidden personal data in published spreadsheets. The Rewiring the State report concluded that 'major cultural transformation is required to prevent mass data breaches from happening in the future' - and that modernised infrastructure is a prerequisite.

2.3 The knowledge concentration risk

This risk does not appear in most migration business cases. It should be the first item on the register.

Anyone who has read The Phoenix Project, the IT operations novel by Gene Kim, Kevin Behr and George Spafford, will remember Brent Geller, the lead engineer through whom almost every fix, change and outage has to pass, because so much of how the systems really work exists only in his head. Most legacy environments have a Brent, and often more than one. In public sector organisations it is common to find that the operational knowledge of a critical platform, such as its undocumented logic, its workarounds and its integration quirks, resides with two or three individuals who have worked with it for a decade or more. When those individuals retire or move on, organisations frequently discover that the documentation does not describe how the system actually works in practice.

The window in which experienced staff can support a structured migration and knowledge transfer is finite. Every year of delay narrows it. This is particularly acute in the public sector, where salary constraints mean that specialist technical staff are disproportionately likely to leave for better-paid private sector roles.

2.4 The blocked opportunity cost

Perhaps the least visible cost of legacy is what it prevents. The UK Government's ambition to deploy AI across public services, improve data sharing, and deliver joined-up digital services all assume data that is accessible, well-governed, and in modern formats. None of that is compatible with data trapped in legacy proprietary formats, undocumented schemas, and siloed systems that were never designed for integration.

The SIT Committee was explicit: "Failure to address [legacy] siloization will hamper delivery of the government's vision and put citizens' data increasingly at risk." The consequence in practice is that AI and analytics projects built on legacy foundations are almost always more expensive, slower, and ultimately deliver less than they should.

As part of the Central Government, DWP operates some of the UK's most consequential data systems - supporting pension payments, welfare assessments, and benefits administration for millions of citizens. The June 2025 commitment to modernise priority legacy benefits services is significant because it represents the first time DWP has set out a phased plan with public milestones rather than a general aspiration.

The situation across departments is highly uneven. The review found that legacy estates range from 10% to 60% of the technology estate across central government organisations. A number of departments could not estimate their legacy exposure at all. The eVisa system, which is based on over 90 separate systems, many of them legacy, was described in parliamentary evidence as producing an 'unacceptably high number of errors' despite eight years of operation.

The Police National Computer - the central database underpinning UK law enforcement - was one of the highest-profile legacy migration commitments in the roadmap, with the Home Office beginning the transition to the Law Enforcement Data Service in September 2025. The PNC migration is significant not just for policing but as a proof point for large-scale public sector migration: it involves highly sensitive personal data, real-time operational dependency, and access requirements for dozens of forces and agencies simultaneously.

Across police forces more broadly, the SIT Committee's evidence base found legacy dependency ranging from 10–70%. Some forces have modernised substantially; others remain heavily dependent on systems that are decades old.

The NHS presents perhaps the most complex legacy landscape of any sector. 123 major system failures were recorded in NHS England in 2024 alone, with some of these linked to patient harm. Cloud adoption across NHS trusts ranges from around 5% to over 90% of the estate.

The NHS Federated Data Platform, the Single Patient Record, and other major NHS data infrastructure projects all depend on the same prerequisite: a modernised, accessible, well-governed data estate. The parliamentary committee's concern about vendor lock-in in NHS data infrastructure, particularly regarding proprietary platform dependencies, adds an additional dimension to the migration challenge.

The State of Digital Government Review found that a large proportion of local government workloads and data remain on-premise. Only 39% of councils have dedicated budgets for new digital systems. The review noted that cloud adoption is inconsistent, with Crown Hosting Data Centres - the Cabinet Office joint venture specifically designed to support public sector bodies migrating from on-premises facilities - being underutilised.

4. Security, compliance and sovereignty

The parliamentary committee's Rewiring the State report addressed legacy migration not just as an efficiency or cost issue but as a strategic security and sovereignty concern. These dimensions are increasingly important for organisations considering their migration approach.

4.1 Data security and GDPR

Legacy systems create data security risk in ways that are difficult to fully mitigate without migration. Known vulnerabilities cannot be patched on unsupported platforms. Access controls cannot be brought into line with modern zero-trust principles. And data cannot always be classified and protected in accordance with the Government Security Classifications without fundamental architectural change.

Organisations processing personal data are required to conduct Data Protection Impact Assessments when undertaking migration. The ICO's guidance on UK GDPR is clear that legacy environments which cannot meet current data protection standards represent an ongoing compliance risk, not a deferred one.

4.2 Vendor lock-in as a migration risk

The SIT Committee devoted substantial attention to vendor lock-in and identified it as a major barrier to the government's digital transformation agenda. AWS and Microsoft together hold an estimated 60–80% of the UK cloud infrastructure market. The Competition and Markets Authority opened an investigation in March 2026 into Microsoft's use of software licensing practices reducing competition in the cloud.

For organisations planning migration, this is directly relevant. A migration that moves data from one legacy lock-in to a different proprietary lock-in has not solved the underlying structural problem. The parliamentary committee's recommendation to prioritise open-source tools and technology, and to develop sovereign alternatives to incumbent providers, reflects a shift in how the government is thinking about the migration destination - not just the journey.

The good news is that cloud platforms including AWS, Azure and Google Cloud all support open-standards approaches when properly architected. The difference lies in how landing zones are designed, how data is structured, and whether migration processes create new dependencies or eliminate existing ones.

4.3 Security-cleared delivery

For organisations handling data at SC, DV or NPPV3 classification levels, including central government departments, policing, intelligence and defence, delivery team vetting is not optional. The UK Government Cloud Security Principles and the NCSC's security guidance both require that access to classified systems and data is limited to appropriately cleared personnel.

This means that the discovery phase of any migration, which requires access to the systems, documentation, and data necessary to understand the full scope, must be staffed accordingly. Butterfly Data's team of consultants is vetted and has operated within classified environments across HMRC, the Home Office, DWP, FCDO and policing for more than two decades.