Guidance

Board and leadership diversity survey 2026: privacy notice

Published 29 September 2026

This privacy notice explains how the Department for Business, Innovation, Science and Trade (BIST), as a ‘data controller’, processes personal data for the board and leadership diversity survey for the Parker Review and the Women Business Leaders Review.

This notice is supplemented by our main privacy notice which provides further information on how BIST processes personal data, and sets out your rights in respect of that personal data.

Personal data BIST collects

BIST collects information about boards of the top UK listed (defined as the FTSE 350) and the largest private UK companies.

BIST collects the following categories of personal data:

• name
• gender
• contact details (personal and/or business)
• job title
• racial or ethnic origin

As part of the survey, we wish to collect voluntarily from FTSE 350 companies the following “special category” information to assess whether the Parker Review targets have been met:

a) Data on ethnicity using the high level Office for National Statistics categories used in the UK census. These are:

• Asian
• Black
• mixed
• other non-White
• White

The review will categorise directors in the Asian, Black, mixed or other non-White categories as “Directors of Colour.” For further information on what specific ethnic groups fall under these high-level classifications is detailed in Annex 1.

b) For those directors identifying as White, we are only collecting data on the number of White directors on the board.

c) For those directors identifying as a member of the Asian, Black, mixed or other non-White ethnic group, we are collecting the following information (for the reasons set out):

• full name – to avoid double counting
• function on board – to understand the level of seniority of their role
• gender – to avoid double counting
• nationality – to assess the success of UK nationals “of colour” in securing board membership
• whether the director sits on any other FTSE 350 Board – to understand whether directors have any other board positions

We will also request contact details in the survey of an individual who can answer follow up questions related to the Parker Review and the Women Business Leaders Review. This information will be kept confidential and stored securely, where only the data controller will have access to the information.

Why BIST asks for this information and what happens if it is not provided

BIST collects this information in order to better understand the degree of ethnic diversity and gender balance on the boards of the top UK listed and private companies.

Providing this data is voluntary. If companies choose not to provide it, their information will not be included in our analysis of leadership diversity, which may reduce the completeness and accuracy of our diversity monitoring and reporting.

This government seeks to ensure that all - regardless of socio-economic background, gender, race, or sexual orientation - have an equal opportunity to make the most of their potential and are able to progress to the highest levels in their business careers. This will allow us to tap into the talents and skills of the whole UK workforce.

This is why the government is supporting the business-led Parker Review and Women Business Leaders Review and supports their work towards meeting and maintaining the recommendations, namely:

• FTSE 100 (ongoing – since Dec 2021) and FTSE 250 (ongoing – since Dec 2024) companies to have at least one ethnic minority director on their board
• top-50 private companies to have at least one ethnic minority director on their board by December 2027
• for all 400 companies (FTSE 350 and top-50 private companies), their senior management team located within the UK should have a similar proportion of people from an ethnic minority as the areas in which they operate
• a balance of 40% to 60% of either gender on boards
• a balance of 40% to 60% of either gender in leadership teams
• development of balanced pipelines to chief executive officer (CEO) and chief financial officer (CFO) roles, supported by data collection on commercial and functional leadership positions
• at least one woman in the Chair or Senior Independent Director role on the board, or one woman in the CEO or Finance Director role
• participation expanded from 50 to the 100 largest private businesses to promote gender-balanced boards and leadership

Each year, for the duration of the Parker Review and Women Business Leaders Review, we will be carrying out a survey to assess the progress in ethnic and gender diversity in the boardroom. In each year, we will collect data from the FTSE 350 and a selection of the UK’s largest private companies. The survey will support the business-led reviews in assessing whether the targets have been met.

As mentioned earlier in this notice, BIST is responsible for collecting and processing the data provided through this survey, covering all in-scope companies, to better understand the degree of ethnic and gender diversity among the boards and senior management of the top UK listed and private companies.

The legal basis for processing your personal data

The primary legal bases we rely on for processing the personal data we collect about you.

For personal data

Processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller under Article 6(1) UK General Data Protection Regulation (GDPR).

For special category data or criminal conviction data

For special category data (personal data revealing racial or ethnic origin) the processing condition at Article 9 UK GDPR is section 2, sub-section g: Substantial public interest condition.

How BIST processes personal data it receives

Once received your data will be:

• stored within BIST’s internal database on Sharepoint which is managed by the Company Law and Governance (CLG) team in BIST with oversight by the BIST Knowledge and Information Management (KIM) team
• analysed by BIST and subsequently it will be shared in anonymised and aggregated form with the Chair of the Parker Review and the Chair of the FTSE Women Business Leaders Review
• included in results published in early 2027 for the current review cycle. Results will be aggregated and data anonymised so that no individuals are directly identified. Individual companies will be identified as ‘meeting the target’, ‘failing to meet the target’, ‘unknown’ or ‘did not respond’. However, individuals may still be identifiable by combining survey findings about whether a company has met the target with publicly available company information online

We will only process your personal data for purposes which are compatible with those specified in this privacy notice. This may include archiving in the public interest, or scientific, historical or statistical research, in accordance with Article 89 UK GDPR. Where your data is further used for research purposes, appropriate safeguards (including anonymisation, pseudonymisation and data minimisation techniques) will be used to ensure that your personal data is only processed where it is necessary for us to do so, and that it is processed lawfully and securely. 

Compatible research purposes may include analysis to further BIST policy development, or to analyse public consultation responses or in responding to similar requests for information from the public.

Third-party processors

As your personal data will be stored on our IT infrastructure, by default it will also be shared with our data processors Microsoft and Amazon Web Services.

Access to the data will be restricted to a limited number of BIST researchers and policy colleagues working on this project. We will be using this data for research purposes only. The survey will be administered using the Qualtrics Experience Management Platform (Qualtrics). Qualtrics is ISO27001 certified and fully compliant with the internationally recognised standard for information security management systems (ISMS). Certification to ISO27001 demonstrates that the necessary controls are in place for our information to be stored securely.

Information sharing

We may share personal data you provide:

• with other government departments, public authorities, law enforcement agencies and regulators
• with other third parties where we consider it necessary in order to further our functions as a government department
• in response to information requests, for example, under freedom of information (FOI) law or the Environmental Information Regulations (EIR)
• to a court, tribunal or party where the disclosure is necessary in order to exercise, establish or defend a legal claim
• where we are ordered to do so or where we are otherwise required to do so by law
• with third party data processors as governed by contract

You can find out more detailed information about how we share data and further processing in the main BIST privacy notice.

How long will BIST hold your data for

BIST will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Your data will be held for no longer than one year.

If we decide that it is necessary to process your personal data for a reason which is incompatible with the purposes for which it was collected, we will contact you to explain why we are doing so and the lawful basis on which this is being done.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

You have a number of rights available to you under UK data protection legislation, including:

• the right to request copies of the personal data we hold about you
• the right to request that we rectify information about you which you think is inaccurate or incomplete
• the right to request that we restrict your data from further processing (in certain circumstances)
• the right to object to the processing of your data (in certain circumstances)
• the right to data portability (in certain circumstances)
• the right to request that we erasure your data (in certain circumstances)
• the right not to be subject to a decision based on solely automated data processing

Contacts

Contacting BIST

You can contact BIST’s Data Protection Officer for further information about how your data has been processed by the department or to make a complaint about how your data has been used.

Data Protection Officer

Department for Business, Innovation, Science and Trade
Old Admiralty Building
Admiralty Place
London
SW1A 2DY

Email data.protection@businessandtrade.gov.uk

Contacting Information Commissioner’s Office (ICO)

You can also submit a complaint to the ICO at:

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Email casework@ico.org.uk

Telephone 0303 123 1113

Textphone 01625 545860

Lines are open from Monday to Friday 9am to 4:30pm.

Annex 1: ethnicity categories

High-level ethnic group	Ethnic group (detailed)
Asian	- Indian - Pakistani - Bangladeshi - Chinese - any other Asian background, please describe
Black	- African - Caribbean - any other Black / African / Caribbean background, please describe
Mixed or multiple ethnic groups	- White and Black Caribbean - White and Black African - White and Asian - any other mixed or multiple ethnic background, please describe
Other ethnic group	- Arab - any other ethnic group, please describe
White	- English or Welsh or Scottish or Northern Irish or British - Irish - Gypsy or Irish Traveller - any other White background, and describe