Skip to main content
Research and analysis

Cyber security skills and sectoral analysis research 2027: privacy notice

Published 12 October 2026

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/cyber-security-skills-and-sectoral-analysis-2027-privacy-notice/cyber-security-skills-and-sectoral-analysis-research-2027-privacy-notice

This privacy notice explains who we are, the personal data we collect, how we use it, who we share it with, and what your legal rights are. 

1. About this research 

The Department for Science, Innovation and Technology (DSIT) is the data controller for this research and has appointed Ipsos UK and Perspective Economics to conduct research on the cyber security labour market and sector on its behalf. Ipsos UK and Perspective Economics act as the data processors.  

This research involves talking to the individuals responsible for cyber security in UK businesses, public sector organisations and charities, as well as the individuals running UK cyber sector businesses, recruitment agents, cyber security training providers and investors in the sector. 

Ipsos UK will be collecting data for this study in the following ways: 

  • a telephone and online survey of UK businesses (including cyber sector businesses), public sector organisations and charities 

  • follow-up qualitative interviews with those taking part in the survey 

  • additional qualitative interviews with individuals who did not take part in the survey, including those in cyber security roles, recruitment agents, cyber security training providers and investors in the cyber security sector. 

This privacy notice explains how DSIT uses your personal data for this research. 

Participation in this research is voluntary – you are free to decide not to take part and may stop participating at any time. 

2. What personal data do we collect for this research? 

On behalf of DSIT, Ipsos UK collects personal data relating to your business contacts: 

  • Private sector businesses – Ipsos has taken a random sample of UK businesses (England, Wales, Scotland and Northern Ireland) and their contact details from the Market Location business database, to invite them to take part in the survey and follow-up qualitative interviews. Information on how Market Location collects this data can be found on their website. 

  • Public sector organisations – Ipsos has taken a random sample of public sector organisations from the Inter-Departmental Business Register (IDBR) held by the Office for National Statistics (ONS). Information on how ONS collects this data can be found on their website. 

  • Charities – Ipsos has taken a random sample of charities from the publicly available database for charities in England and Wales, and database for charities in Northern Ireland. Separately, it has obtained a random sample of Scotland charities from the Office of the Scottish Charity Regulator (OSCR). Information on how OSCR collects this data can be found on their website. 

  • Cyber sector businesses – as part of this research, Ipsos and its partner, Perspective Economics, have generated a sample of cyber sector businesses, using sources such as the Bureau van Dijk Fame database, the Orbis database, the Beauhurst database, a Department for Science, Innovation and Technology (DSIT) list of businesses involved in various cyber security start-up initiatives, and business websites. 

In some cases, we have supplemented the above organisation details with contact details sourced from business websites and publicly available LinkedIn data, via our research partners, Market Location, as well as Ipsos’ own desk research. Market Location act as a data processor to Ipsos UK. Information on how Market Location collects this data can be found on their website. 

The data (including personal data) Ipsos has received from these sources includes: 

  • organisation registered and trading names 

  • organisation address and postcode 

  • organisation telephone number 

  • contact name within the business where available – for an individual likely to be responsible for major finance, legal or compliance matters 

  • contact email within the business where available. 

DSIT may already hold your contact details if you have previously participated in our cyber security research and opted to be recontacted. If you choose to be recontacted through this research, DSIT will collect and retain your contact details for the purpose of contacting you about future cyber security research. This will include: 

  • Name 

  • Job title 

  • Email 

  • Phone number 

3. What is DSIT’s lawful basis for processing your personal data? 

DSIT, as data controller, must have a lawful basis to process your personal data. For this research, DSIT relies on the public task lawful basis under Article 6(1)(e) UK GDPR because the processing is necessary for DSIT to carry out its functions to inform future national strategy on cyber security and provisions for cyber security skills in the UK workforce.  

4. How will we use any personal data including interview responses you provide? 

Participating in this research is voluntary. 

Ipsos UK will keep your personal data and responses private and secure and will process them only in accordance with DSIT’s documented instructions and this privacy notice. You will not be identifiable in any published results. 

Ipsos UK will only share recorded material(s) from any qualitative interviews with the Project Team; the Project Team is the Ipsos UK project team, and any supplier organisations contracted by Ipsos to support its work on this project such as TakeNote Transcription services. 

Ipsos UK will use your personal data and answers solely for research purposes, to produce anonymous research findings for DSIT, which may be shared with relevant governmental organisations (such as the Department for Digital, Culture, Media and Sport), but the data shared would not include any personal or identifiable data. 

This will include the following files delivered to DSIT: 

  • A de-identified data file of survey responses for them to carry out their own analysis and quality assurance of the results. Your survey will be combined with answers from hundreds of other respondents. Your personal data (including any contact information) will not be included in this data file. 

  • This de-identified data file will be deposited onto the UK Data Archive (UKDA) in an anonymous format. There is no information in the data that can be used to identify you. Any analysis is done on the whole sample, and results will be quoted in terms of specific percentages of people, and are not reported as individual answers. The collected survey responses are made available, through the UKDA Service, to academic researchers who must register with UKDA to be able to use the data. 

  • Ipsos UK will share anonymised extracts of qualitative interviews with DSIT. This includes anonymised verbatim quotes. Any details that could identify you or someone in your business will be removed. 

  • Where you have agreed to be recontacted for future cyber security research, your contact details will be stored securely and only used for the purpose of recontacting you for relevant future research. 

5. Who will we share your data with? 

Ipsos UK will be using certain supplier organisations to assist it with running the qualitative research and they will need to disclose your personal data to these supplier organisations for that purpose. These supplier organisations are contracted by Ipsos and may only process your personal data on their instructions. These supplier organisations include: 

  • Paton Williamson Consultancy – this is to set up follow-up interviews with the individuals and organisations that have given their consent for this within the survey. 

  • TakeNote Limited – this is to transcribe interviews (where necessary) to extract quotes and carry out further analysis. 

  • Large Language Models (Artificial Intelligence, e.g. Open AI) using a secure Ipsos-dedicated environment. 

6. How will we ensure your personal information is secure? 

Ipsos UK takes its information security responsibilities seriously and applies various precautions to ensure your information is protected from loss, theft or misuse. Security precautions include appropriate physical security of offices and controlled and limited access to computer systems. 

Ipsos UK has regular internal and external audits of its information security controls and working practices and is accredited to the International Standard for Information Security, ISO 27001. 

7. How long will we retain your personal data and identifiable responses? 

  • Ipsos UK will only retain any personal data and identifiable answers for as long as is necessary to support this research. In practice, this means that once they have reported the final anonymous research findings to DSIT they will securely remove any personal data from their systems. 

  • For this project, they will securely remove your personal data from their systems within three months of project closure (expected to be August 2027). 

  • If you agree to be recontacted, your contact details will be stored by DSIT for 18-24 months. This data may be used by DSIT or its appointed research provider for future research. Recontact will only occur for future research on the same topic as this survey (cyber skills and the cyber security sector). 

8. Your rights 

This section sets out your rights in relation to the personal data processed for this research. DSIT is responsible for responding to requests to exercise your rights as the data controller. Ipsos UK and Perspective Economics may assist DSIT in responding to requests as the data processors. 

  • You have the right to access your personal data within the limited period that DSIT holds it.  

  • Providing responses to this survey is entirely voluntary and is done with your agreement. You have the right to withdraw from the research at any time whilst we hold your personal data at an identifiable level. 

  • You also have the right to request from us the deletion or erasure of the personal information we hold about you. 

  • You also have the right to rectify any incorrect or out-of-date personal data about you which we may hold.  

If you want to exercise your rights, please contact us using the details below. 

If you have any complaints, we will appreciate if you give us an opportunity to resolve any issue first, by contacting us as set out below. You have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO), if you have concerns on how we have processed your personal data. Visit to the ICO website to find details on how to contact the Information Commissioner’s Office and make a complaint. 

9. Where will my personal data be held and processed? 

All of your personal data used and collected for this research will be stored by Ipsos UK in data centres and servers within the United Kingdom. Where you have agreed to be recontacted for future research, DSIT will securely store your contact details on DSIT IT infrastructure in the UK on systems provided by DSIT data processors - Microsoft and Amazon Web Services. 

If you participate via MS Teams, to be able to invite you to take part in the Microsoft Teams camera call and screen presenting, your email address and interview responses will be processed and stored on Microsoft servers located in the European Economic Area (EEA). Where your data is processed in the EU or EEA, we rely on UK Adequacy Regulations to safeguard the transfer of your personal data for processing. 

10. How can I contact DSIT or Ipsos UK?  

The data controller for your personal data is DSIT. You can contact DSIT using the details below.  

By email to dataprotection@dsit.gov.uk using 26-019138-01 Cyber Skills & Sector Research (2027) as the subject line. 

Ref: 26-019138-01
Cyber Skills & Sector Research (2027) 
DSIT Data Protection Officer 
Department for Science, Innovation and Technology 
22-26 Whitehall 
London 
SW1A 2EG 

Privacy queries should primarily be directed to DSIT, as data controller, but if you wish to contact Ipsos about this research, you can contact the Ipsos Compliance Department by email at compliance@ipsos.com, using 26-019138-01 Cyber Skills & Sector Research (2027) as the subject line. 

Or by letter sent to: 

Ref: 26-019138-01
Cyber Skills & Sector Research (2027) – Compliance Department 
Ipsos 
3 Thomas More Square 
London 
E1W 1YW 
United Kingdom 

11. Changes to this privacy policy 

We keep our privacy policy under regular review. This policy was created on 7th October 2026. 

Back to top