Notice

Cyber security incidents affecting connected products: privacy notice

Published 21 October 2026

The Department for Science, Innovation and Technology (DSIT), Research into cyber incidents, vulnerabilities and impacts affecting connected products since 2022.

Please note that this research was originally commissioned by the former Department for Science, Innovation and Technology (DSIT). In July 2026, the parts of DSIT responsible for cyber security policy moved to the Department for Digital, Culture, Media and Sport (DCMS).

This privacy notice explains who we are, the personal data we collect, how we use it, who we share it with, and what your legal rights are.

DSIT has asked Ipsos UK, an independent research organisation, to carry out research to strengthen the available evidence in relation to cybersecurity incidents that affect connected products. The research focuses on five groups of connected products: Internet of Things (IoT) devices, operational technology (OT), computing devices, networking equipment and software.

DSIT is the data controller for this research. Ipsos UK is acting as a data processor on behalf of DSIT to conduct this research.

Your participation will help DSIT build a better understanding of how cyber incidents affect organisations in practice, the vulnerabilities involved, and the impacts experienced across different types of connected products. The findings will contribute to the evidence base used to inform future policy development and improve the security and resilience of connected products in the UK.

About Ipsos UK

Ipsos UK Limited and Ipsos (market research) Limited are a specialist research agency, commonly known as Ipsos and referred to in this privacy notice as “Ipsos UK”. Ipsos UK is part of the Ipsos worldwide group of companies, and a member of the Market Research Society.  As such we abide by the Market Research Society Code of Conduct and associated regulations and guidelines.

Your data

Ipsos UK will process the following personal data for the purposes of inviting you to take part in a survey:

• Name
• Company name
• Email address
• Telephone number

We have obtained this data from various commercial databases and publicly available information, such as your organisation’s website.

If you consent to taking part in this research project, we will process the following data:

• Your survey responses

We will use this data to identify evidence that will support DSIT to improve the cyber security and resilience of connected products in the UK.

We will also ask you if you agree to be recontacted for follow up research. If you agree to recontact, we will ask you to provide your name, email address and telephone number for this purpose only.

Legal basis for processing your data

The legal basis for processing your personal data under Article 6 UK GDPR is:

Article 6(1)(e) Public Task - processing is necessary for the performance of a task carried out in the public interest. The research is being undertaken to support evidence gathering and future policy development relating to the cyber security and resilience of connected products.

However, sharing information with Ipsos UK as part of this study is voluntary. Ipsos UK will ask for your agreement to take part in the research. If you wish to withdraw  from the research at any time, please contact Ipsos UK using the contact details below.

How will any personal data you provide be used?

Ipsos will treat the information you provide in the strictest confidence in accordance with the UK General Data Protection Regulation (UK GDPR).

Anonymised findings from the survey will be shared with DSIT for research and policy development purposes. Any survey findings will be reported in aggregate, and you will not be identifiable in any reporting.

Ipsos UK will use your personal data and responses solely for research and analysis purposes. Only the Ipsos research team will have access to the personal data that you share with Ipsos, and this will be stored securely in a protected electronic folder that only the immediate research team have access to.

Where you have agreed to be recontacted for follow-up research, your contact details will be stored securely and only used for the purpose of recontacting you for follow-up research.

How will your personal information be kept secure?

Ipsos UK takes its information security responsibilities seriously and applies various precautions to ensure your information is protected from loss, theft or misuse.  Security precautions include appropriate physical security of offices and controlled and limited access to computer systems.

Ipsos UK has regular internal and external audits of its information security controls and working practices and is accredited to the International Standard for Information Security, ISO 27001.

How long will your personal data and identifiable responses be retained?

Ipsos UK will only retain your data in a way that can identify you for as long as is necessary to support the research project and findings. 

Your personal details used to invite you take part in this research, including any contact details provided for follow-up interviews as part of this project, will be securely deleted from Ipsos UK systems once the research and any quality control checks are complete; this is usually carried out within three months of project closure. For this project, Ipsos UK will securely remove your personal data from its systems by June 2027.

Where will your personal data be held & processed?

All of your personal data used and collected for this research, including interview recordings and transcripts, will be stored and processed in the United Kingdom and the European Union. We can provide further information on data storage arrangements on request.

Where your data is processed in the EU or EEA, we rely on UK Adequacy Regulations to safeguard the transfer of your personal data for processing.

Your rights

You have the right to request information about how your personal data are processed, and to access your personal data within the limited period that Ipsos UK holds it.

You also have the right to rectify any incorrect or out-of-date personal data about you which we may hold.

You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.

You also have the right to request from us the deletion or erasure of the personal information we hold about you.

You have the right to object to the processing of your personal data.

Responding to this research is entirely voluntary. You have the right to withdraw from the research at any time until we anonymise the findings and begin drafting the final report, which is expected to be in January 2027.

If you want to exercise your rights, please contact DSIT using the contact details provided below

How can you contact DSIT or Ipsos UK about this research and/or your personal data?

The data controller for your personal data is the Department for Science. Innovation and Technology (DSIT). You can contact the DSIT Data Protection Officer at:

DSIT Data Protection Officer
Department for Science, Innovation & Technology
22-26 Whitehall
London
SW1A 2EG

Email: dataprotection@dsit.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details above.

If you remain unhappy, you have the right to lodge a complaint with the UK’s Information Commission’s Office (ICO) if you have concerns on how we have processed your personal data. You can find details about how to contact the Information Commission’s Office at Make a complaint ICO.

Contact Ipsos UK

If you wish to contact Ipsos UK about this research or to withdraw from the research, please use the details below:

Email: Reece.Decastro@ipsos.com and Nathan.Bransden@ipsos.com with “26-056528-01 Cybersecurity Incidents” in the email subject line

Post:                  

26-056528-01 Cybersecurity Incidents
Data Protection Officer, Compliance Department
Ipsos (market research) Limited and Ipsos UK Limited
3 Thomas More Square, London E1W 1YW
United Kingdom

Changes to this privacy policy

We keep our privacy notice under regular review. This policy was created on 20th October 2026.