Official Statistics

UK Business Data Survey 2026

Published 18 June 2026

Executive Summary

This 2025 to 2026 report of the UK business data survey (UKBDS) describes results from businesses surveyed between October 2025 to January 2026. This is the fourth iteration of the UKBDS which was conducted for the first time in 2020 to 2021. The survey is designed to help strengthen the government’s evidence base about understanding how data is used, how to balance data privacy with growth and the importance of being able to transfer, store and share data around both domestically and internationally.

Accompanying this publication are data tables, containing most questions asked about in the survey (subject to sample size) and broken down by business size, sector and International Territorial Level (ITL) 1 statistical region.

The survey found that large businesses were more likely to report wider use of data and artificial intelligence (AI), while governance and awareness of AI were mixed across businesses overall. Large businesses were also more likely to agree the Information Commissioner’s Office (ICO) guidance was clear and easy to understand and have transferred data internationally.

Further key findings from the survey include:

General data use

• In 2025 to 2026, most UK businesses handled digitised data (86%), consistent with 2020 to 2021 (81%) and 2021 to 2022 (85%), following a dip in 2023 to 2024 (77%).

• Large businesses were more likely to use digitised data in more advanced ways, including analysing data to generate new insights (69%) and sharing data (40%), compared to all other business sizes.

Artificial intelligence

• In 2025 to 2026, Artificial Intelligence (AI) use was established but not widespread among businesses surveyed, with 41% of businesses that handled digitised data reporting use for at least 1 purpose. Uptake was higher among large businesses (82%) and in knowledge-intensive sectors.

• Businesses using AI tended to report more developed data practices, including higher rates of data collection (41%), analysis (37%) and data sharing (19%), compared with businesses that did not use AI.

• AI governance and awareness were limited, with 17% of AI-using businesses reporting no policy in place. Formal written policies were more common among large businesses (56%), and awareness of regulatory guidance was mixed (53% aware, 19% finding it clear).

Data infrastructure

• In 2025 to 2026, businesses that handled digitised data used a mix of data storage approaches, including on-premises (27%), public cloud (31%) and private cloud (19%). 29% relied entirely on external data centres.

• Reported disruption was limited, with 20% of those storing data off-premises experiencing downtime in the previous 12 months.

Data protection law and regulation

• In 2025 to 2026, 46% of businesses that handled digitised personal data agreed the ICO’s regulatory guidance is clear and easy to understand and 9% said they disagreed.

• In 2025 to 2026, 76% of businesses said it felt like the burden of complying with UK data protection law had stayed the same over the previous 12 months,19% said it had increased, 1% said it had decreased.

International data transfers

• In 2025 to 2026, 10% of businesses that handled digitised data (8% of all UK businesses) transferred (sent or received) data internationally. Large businesses (24%) and medium businesses (18%) were more likely to transfer data overseas than micro businesses (10%) and sole traders (9%).

International transfers mechanisms

• In 2025 to 2026, 16% of businesses that sent personal data overseas used International Data Transfer Agreements (IDTAs) to transfer personal data internationally. 26% used EU Standard Contractual Clauses (SCCs), and 14% used Binding Corporate Rules (BCRs). Businesses were allowed to specify more than 1 mechanism for transferring personal data.

Introduction

Code of Practice for Statistics

The UK business data survey (UKBDS) is an official statistics publication and has been produced to the standards set out in the Code of Practice for Statistics.

Responsible analyst: Berkeley Zych (DSIT)

Enquiries: ukbusinessdatasurvey@dsit.gov.uk

Background

The Department for Science, Innovation and Technology (DSIT) commissioned the UKBDS 2025 to 2026 to help the government understand the nature and importance of data use in industry, as well as its potential and realised economic impacts.

The UKBDS 2025 to 2026 fieldwork was conducted by Ipsos. The topics covered in the survey and discussed in this report include:

• the general use, acquisition, sharing and analysis of digitised data

• data infrastructure and dependencies

• awareness of regulatory guidance about data use and compliance with data protection laws

• the transfer of data internationally

• variation between businesses in different size, sector and regional categories

This report also references previous iterations of the UKBDS. Reports are named for the year in which fieldwork was completed. For example, UKBDS 2026 for 2025 to 2026 fieldwork period, UKBDS 2024 for UKBDS 2023 to 2024 fieldwork period, and so on. Deviating slightly from previous reporting, when referring to previous time periods we will explicitly reference the fieldwork years, not just the headline year on the report. This is to make comparisons clearer. For instance, we will refer to statistics in 2025 to 2026 compared to 2023 to 2024, rather than in 2026 compared to 2024. This does not reflect any changes in the underlying methodology or data, merely a naming convention.

Respondents from a total of 4,450 UK businesses took part in the mainstage of this survey between October 2025 and January 2026, with interviews conducted either via Computer Assisted Telephone Interview (CATI) or online.

These are the same methods used to interview businesses in the UKBDS 2024 and UKBDS 2022, however the UKBDS 2021 only interviewed businesses via CATI. Hence, direct comparisons between this year’s results and the 2021 report should be treated with additional caution.

The sample of businesses in this survey represents a fraction of the UK business population, meaning the numbers in this report are estimates of a figure’s ‘true’ value. Unless stated otherwise, differences between estimates of the same statistic, in different groups, are only highlighted in this report when they are statistically significant at the 5% level. See appendix B.2 for a discussion about the approach taken to comparing businesses in different groups.

Responses were weighted according to business size and sector to make the sample representative of the UK business population. See the accompanying technical report for a discussion about the weighting procedure and rationale. When breakdowns are reported by sector, these are given alongside their Standard Industrial Classification (SIC) codes:

• Manufacturing (SIC C)

• Mining, energy, water (SIC B D E)

• Construction (SIC F)

• Wholesale and retail, repair of motor vehicles (SIC G)

• Transport and storage (SIC H)

• Hotel and catering (SIC I)

• Information and communication (SIC J)

• Finance and insurance (SIC K)

• Real estate (SIC L)

• Professional, scientific, technical (SIC M)

• Administrative and support services (SIC N)

• Education (SIC P)

• Human, health and social work (SIC Q)

• Arts, entertainment and recreation (SIC R)

• Other service activities (SIC S T U)

Results for the agriculture, forestry and fishing sector (SIC A) are not included in this report due to a comparatively smaller sample size than in previous years, which reduced robustness.

Compared with previous years of the UKBDS, business size categories were relabelled for the UKBDS 2026 (comparison below). While the labels have changed, the underlying size definitions remain the same, meaning comparisons by business size can still be made across years.

UKBDS 2026 size labels:

• sole traders

• micro businesses (up to 9 employees)

• small businesses (10 to 49 employees)

• medium businesses (50 to 249 employees)

• large businesses (250 employees or more)

Please note that because of the structure of the question on number of employees (see technical report) it is possible that some businesses with more than 1 owner, but with no employees have been classified as sole traders.

Most charts in this publication include uncertainty ranges to reflect sampling variation in the survey estimates. These are typically shown as error bars, indicating the 95% confidence interval around each estimate. Further information on how confidence intervals are calculated and presented is provided in Appendix B.

1. Data handling and use

All businesses in the UKBDS 2026 were asked whether they handle any type of digitised data, to understand how common the use of digitised data is among UK businesses. We also asked if they use personal data, non-personal data, or both. Businesses with employees were asked separately if they handle any data about their employees, whether personal or non‑personal.

1.1. Handling of digitised data

Businesses that said they only handled non‑digitised data, or that they did not handle any data, are only included in this section (1.1), unless stated otherwise elsewhere in the report. For example, businesses with employees must keep some employee records, but these do not have to be in digital form.

In 2025 to 2026, 86% of UK businesses said that they handled any type of digitised data (see figure 1), with large (96%), medium (99%) and small (99%) businesses being more likely to do so compared to sole traders (83%) and micro businesses (92%). While reporting was high among large businesses, it was not universal within this business size, which may reflect misunderstanding of the question or survey fatigue across business surveys more widely. There is no statistically significant difference between the result for large businesses in 2025 to 2026 compared to previous years.

Although the 2025 to 2026 result for all UK businesses is an increase compared to the UK business data survey (2024), where 77% of UK businesses said that they handled digitised data of any type, this does bring it back in line with the UKBDS 2022 (85%) and UKBDS 2021 (81%), suggesting that results from 2024 may have been an outlier. Inter-year comparisons are explored further in section 9. These findings are also broadly consistent with the business data use and productivity study of 2025 (DUPS, wave 2) which found that 83% of UK businesses handled some form of digitised data.

Figure 1: Percentage of businesses that handled each type of digitised data, in 2025 to 2026

Base: 4,450 UK businesses

Businesses in the information and communication (SIC J), professional, scientific, technical (SIC M) and finance and insurance (SIC K) sectors (94%, 94% and 90% respectively) were more likely to handle any digitised data compared to several other sectors (see figure 2).

Figure 2: Percentage of businesses that handled digitised data of any type, by sector, in 2025 to 2026

Base: 4,450 UK businesses

In 2025 to 2026, among businesses with employees, 79% said that they handled personal or non-personal data about their employees, compared with 93% that handled any type of digitised data (including non-employee data).

• Large (95%), medium (97%), and small (95%) businesses were more likely to handle digitised employee data (personal or non-personal), compared to micro businesses (75%).

• Nearly all businesses with 10 or more employees (98%) handled personal employee data, with little variation by sector.

• Businesses with employees in the wholesale and retail, repair of motor vehicles (SIC G) sector (73%) were less likely to handle employee data, compared to several other sectors.

In 2025 to 2026, 67% of businesses handled non-employee personal data. When employee data were also considered, this rose to 72%.

• Large (83%), medium (81%), and small (76%) businesses were more likely to handle personal data (other than employee data), compared to sole traders (66%) and micro businesses (67%).

• Businesses in the human, health and social work (SIC Q) sector (86%) and finance and insurance (SIC K) sector (85%) were more likely to handle personal data (other than employee data), compared to several other sectors.

• Businesses in the manufacturing (SIC C) sector (47%) and hotel and catering (SIC I) sector (54%) reported lower levels of personal data (other than employee data) use.

In 2025 to 2026, more than half (56%) of all UK businesses said that they handled non-personal data (other than employee data).

• Large (84%), medium (73%) and small (69%) businesses were more likely to handle non-personal data, compared to sole traders (55%) and micro businesses (58%).

• Businesses in the information and communication (SIC J) sector (79%) were more likely to handle non-personal data compared to most other sectors.

• Businesses in the professional, scientific, technical (SIC M) sector (71%), finance and insurance (SIC K) sector (69%), and real estate (SIC L) sector (61%) also reported higher levels of non-personal data use.

• Businesses in the transport and storage (SIC H) sector (37%) and wholesale and retail, repair of motor vehicles (SIC G) sector (45%) reported lower levels of non-personal data use.

Figure 3 shows how businesses reported handling different types of data in 2025 to 2026. Overall, 39% of businesses that handled digitised data handled both personal and non-personal data, not including data on employees, while 27% handled only personal data and 17% handled only non-personal data.

The proportion of businesses handling both types of data increased with business size, from 38% of sole traders to 77% of large businesses. A small proportion of large businesses reported handling only 1 type of data (7% for personal data only and 7% for non-personal data only).

Figure 3: Percentage of businesses that handled personal digitised data (other than employee data) and non-personal digitised data of any type, by size, in 2025 to 2026

Base: 4,450 UK businesses
Note: Numbers reported in the figure may differ from number in the report or accompanying tables due to differences in rounding

1.2. Data collection and acquisition

This section discusses the collection and acquisition of data by businesses that handle any type of digitised data. For the UKBDS 2026, additional questions were included to review businesses understanding of the concept of data collection and acquisition, with commentary included in this section.

In 2025 to 2026, businesses that handled digitised data were first asked whether they acquire or collect data from other businesses or organisations, with 32% saying that they do so (see figure 4).

• Large businesses (59%) were more likely to acquire or collect data from other businesses or organisations compared to sole traders (29%), micro (38%) and small (45%) businesses.

• Businesses in the information and communication (SIC J) sector (49%), professional, scientific, technical (SIC M) sector (47%), finance and insurance (SIC K) sector (44%) and administrative and support services (SIC N) sector (43%) were more likely to acquire or collect data than those in the arts, entertainment and recreation (SIC R) sector (18%), other service activities (SIC S T U) sector (19%), construction (SIC F) sector (19%), and hotel and catering (SIC I) sector (21%).

Figure 4: Percentage of businesses that acquired or collected data, by size, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data

In 2025 to 2026, among businesses that handled digitised data, 20% reported purchasing data or acquiring free or open data in the 12 previous months. Among these businesses, 66% also reported acquiring or collecting data from other organisations more broadly. However, 23% of businesses that did not report purchasing or acquiring free or open data in the previous 12 months still reported acquiring or collecting data overall. This may suggest the broader measure of data acquisition captures a wider range of activities beyond purchasing or using free or open data sets.

• The proportion of businesses indicating that they purchased data (5%) was relatively consistent across business size, from 5% of sole traders to 9% of large businesses, and sector.

• 1 in 3 (33%) large businesses said that they acquired or collected any free or open data in the previous 12 months, with the proportion decreasing with businesses size down to 17% for sole traders.

• Businesses in the professional, scientific, technical (SIC M) sector (29%) were more likely to say that they acquired or collected free or open data in the previous 12 months, compared to several other sectors.

• A small proportion of businesses in the hotel and catering (SIC I) sector (5%) and the construction (SIC F) sector (7%) said that they acquired or collected free or open data (see figure 5).

Figure 5: Percentage of businesses that acquired or collected free or open data in the last 12 months, by sector, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data
Note: The x-axis runs from 0% to 50% only to improve readability

Some businesses may have interpreted these questions in different ways. Businesses that receive data through software, platforms, suppliers, or partners may have said they “collect or acquire data from other organisations”, even if they did not directly purchase data or use free or open datasets. In contrast, “purchased data” may be understood as paying for specific datasets, which is less common and may explain the low percentages seen across business size and sector. Some businesses may also use free or open data without recognising it as such, especially when it is built into other products or services.

Differences between responses to general acquisition question, and the more specific questions on purchased and open data suggest that some businesses may not interpret their activities as ‘data collection and acquisition’, indicating possibly misunderstanding of the original question and under-reporting. As a result, findings may reflect how businesses interpret these terms, as well as how they use data in practice.

1.3. Data collection using cookies and other technology

Cookies and similar technologies are used by online services to store or access information on a user’s device. Their use is regulated by the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

Information collected through cookies may include online identifiers, such as IP addresses or device identifiers. While such identifiers are not always classified as personal data on their own, but they may constitute personal data where they allow an individual to be identified, directly or indirectly, including when combined with other information. Any processing of personal data using cookies or similar technologies is also regulated by the UK GDPR and the Data Protection Act 2018.

In 2025 to 2026, among UK businesses that said that they handled digitised personal data (either of employees or others) and have a website, only 12% said that they acquired personal data using cookies, consistent with the findings of the UKBDS 2024. Business’ website use and management is explored further in section 2.

There are a few reasons why businesses that have a website and handle personal data might not acquire personal data using cookies. For instance, not all cookies contain personal data. In addition, some businesses might not need to collect any data using cookies if their website only provides information about their business to customers (and is not used to sell goods or services).

It is also possible some businesses in this survey were not aware that their website collects personal data using cookies, especially if they hired third parties for website design and development. Figure 6 shows the ways that businesses that said that they use cookies (from either a website or app-based tracking technologies) manage their website. Website management of all UK businesses is explored further in section 2. In 2025 to 2026:

• 38% said that it is managed through a mixture of in-house and external support

• 31% said that it is managed entirely in-house

• 16% said that it is managed in-house using a platform provider

• 14% said that it is managed entirely by an external web developer or platform

Taken together, these findings suggest that a lack of awareness and the use of third-party may help explain some, but not all, of the gap in reported cookie use.

Use of app-based tracking was reported by 2% of businesses handling any personal data, while 12% of businesses that both handled personal data and had a website reported using website cookies. In 2025 to 2026:

• Large businesses (40%) were more likely to use cookies, from either a website or app-based tracking technologies, compared with medium (21%), small (16%) and micro (13%) businesses, and sole traders (10%), shown in figure 6.

• Large businesses (10%) were also more likely to use app-based tracking technology to acquire or collect personal data, compared to small (3%) and micro (2%) businesses, and sole traders (2%).

• Businesses in the information and communication (SIC J) sector were more likely to use cookies or app-based tracking technology (35%) compared to all other sectors.

Figure 6: Percentage of businesses that acquired personal data using cookies or similar technology, by size, in 2025 to 2026

Base: 3,760 UK businesses that handled digitised personal data
Note: The x-axis runs from 0% to 50% only to improve readability

Businesses that said that they used either cookies or app-based tracking technology were asked why they do this (shown in figure 7). Most said that they used cookies to improve their website or service (63%) or to remember user preferences (56%), while smaller numbers used them for marketing (46%), providing online services (41%), or installing security updates (31%). Around 1 in 10 (9%) said that they did not use the data collected through cookies.

Figure 7: Percentage of businesses that acquired personal data using cookies or similar technology, for the following reasons, in 2025 to 2026

Base: 530 UK businesses that acquired personal data through cookies or similar technology
Note: responses add up to more than 100% because businesses were allowed to specify more than 1 reason

1.4. Data sharing

This section discusses data sharing by businesses. As with the acquisition and collection of data, for the UKBDS 2026, additional questions were included test businesses understanding of the concept of data sharing, with commentary included in this section.

In 2025 to 2026, among businesses that handled digitised data, 14% said that they shared data outside of their organisation.

• Large businesses (40%) were more likely to share data compared to all other business sizes: medium (19%), small (18%), and micro (15%) businesses and sole traders (14%).

• Shown in figure 8, businesses in the finance and insurance (SIC K) sector (47%) were more likely to share data compared to all other sectors, apart from the human, health and social work (SIC Q) sector (27%), possibly reflectively regulatory reporting requirements and routine data sharing with third parties in the finance and insurance sector.

Figure 8: Percentage of businesses that shared data, by sector, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data

UK businesses that handled digitised data were also asked 2 separate questions to review their interpretation of data sharing in the UKBDS 2026. In 2025 to 2026, among these businesses, virtually no businesses said that they sold data in the previous 12 months, while 11% of businesses said that they provided or shared data for free in the previous 12 months. The low level of reported data sales should be interpreted with some caution.

Businesses that have core activities involving selling data may be small in number and under-represented in the survey. Qualitative evidence from the business data use and productivity study (wave 2) suggests that many businesses so not see themselves as ‘data suppliers’, even where data or data-enabled insights form part of what they sell. This interpretation is consistent with wider evidence from the European data market (EDM) study (2024 to 2026), which estimates a relatively small population of dedicated ‘data suppliers’ in the UK, suggesting that data monetisation remains limited within the wider economy. ‘Data suppliers’ are explored further in section 2. In 2025 to 2026:

• Large businesses (29%) were more likely to say that they provided or shared data for free in the previous 12 months, compared to all other business sizes: medium (14%), small (12%), and micro (12%) businesses and sole traders (11%).

• A smaller percentage of businesses in the finance and insurance (SIC K) sector (21%) said that they provided or shared data for free in the previous 12 months, compared to the 47% of businesses in this sector that said that they shared data.

• However, businesses in the finance and insurance (SIC K) sector were still more likely to have provided or shared data for free, compared to those in the wholesale and retail, repair of motor vehicles (SIC G) sector (6%), construction (SIC F) sector (5%), transport and storage (SIC H) sector (5%), hotel and catering (SIC I) sector (5%), and mining, energy, water (SIC B D E) sector (4%).

All businesses are required to share certain information with public sector organisations, such as for tax or regulatory purposes. This type of routine reporting was not clearly excluded from the survey’s definition of data sharing, and therefore businesses may have understood “sharing data” in different ways. For example, some may have thought this meant sharing data with customers, suppliers, or other businesses as part of their commercial activities, rather than routine statutory reporting. Similarly, some businesses may have interpreted “selling data” as referring to being a data provider where the main activity is selling data or statistics, rather than sharing digital information as part of another service.

Differences in these results may therefore reflect how businesses understood these terms, as well as differences in how data is shared across different sectors and sizes of businesses.

In 2025 to 2026, businesses that said that they shared data outside of their organisation, or sold or shared data for free in the previous 12 months, were asked why they share data (shown in figure 9). Businesses most commonly shared data for:

• delivery or receipt of goods, services or products (56 %)

• communication between customers or staff (49%)

• HR, financial, or accounting purposes (48%)

• legal or regulatory reasons (43%)

A smaller proportion of businesses shared data for marketing and communications, research and development, supply chain management and logistics, and market research. These results may partly reflect differences in how businesses interpret “sharing data”, including routine reporting, with some possible overlap between legal or regulatory, and HR or financial purposes.

Figure 9: Percentage of businesses that shared or sold data for the following reasons, in 2025 to 2026

Base: 830 UK businesses that shared or sold digitised data
Note: responses add up to more than 100% because businesses were allowed to specify more than 1 reason

1.5. Data analysis

In 2025 to 2026, 25% of UK businesses that handled digitised data said that they analyse data, either of personal, non-personal or both, to generate new insights or knowledge.

• Large businesses (69%) were more likely to analyse data, compared to medium (49%), small (35%) and micro (26%) businesses, and sole traders (24%).

• Businesses in the finance and insurance (SIC K) sector (45%) were more likely to analyse data compared to several other sectors (shown in figure 10).

• Businesses in the information and communication (SIC J) sector (39%), professional scientific, technical (SIC M) sector (34%), and the human, health and social work (SIC Q) sector (33%) also reported higher levels of analysing data.

• A smaller proportion of businesses in the manufacturing (SIC C) sector (12%), construction (SIC F) sector (12%), and mining, energy, water (SIC B D E) sector (11%) reported analysing data to generate insights or knowledge.

Figure 10: Percentage of businesses that analysed data, by sector, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data

These sectoral differences may suggest that businesses in service sectors, such as finance and insurance, information and communication, and professional services, make more advanced use of data, or have a greater need to extract additional value from the data that they already hold. By contrast, businesses in physical production sectors, such as manufacturing or construction, may use data primarily to support operational activities rather than to create new insights. Large businesses were also more likely to analyse data, which may reflect greater access to time, skills and tools need to carry out data analysis.

2. The data market

2.1. Website use

A portion of the survey tried to understand and corroborate the findings from previous studies on the nature and size of the UK’s data economy. These include the UK Data Driven Market (2024) report, which aims to define and estimate the scale and distribution of “data-driven” UK companies. To support understanding of the level of digital presence and engagement within the UK’s data economy, all UK businesses were asked if they had a website and how they manage it. In 2025 to 2026, overall, 78% of businesses said that they have a website, compared to 68% in 2023 to 2024. This increase may be driven largely by micro businesses and sole traders being more likely to report that they have a website than they were in 2023 to 2024 (74% and 65%, respectively), while prevalence among larger businesses remained largely unchanged. In 2025 to 2026:

• Large (99%) and medium (97%) businesses were more likely to say that they have a website, compared to small (92%) and micro (84%) businesses, and sole traders (76%).

• Businesses in the arts, entertainment and recreation (SIC R) sector (90%) and administrative and support services (SIC N) sector (90%) were more likely to say that they have a website, compared to those in the construction (SIC F) sector (65%), transport and storage (SIC H) sector (72%), and wholesale and retail, repair of motor vehicles (SIC G) sector (76%), shown in figure 11.

Figure 11: Percentage of all UK businesses that said that they have a website, by sector, in 2025 to 2026

Base: 4,450 UK businesses

Figure 12 shows the ways that businesses that said that they managed their website. In 2025 to 2026:

• 29% of businesses said that it is managed through a mixture of in-house and external support

• 27% said that it is managed entirely in-house

• 24% said that it is managed entirely by an external web developer or platform

• 17% said that it is managed in-house using a platform provider

Figure 12: Percentage of businesses that had their website managed by the following methods, in 2025 to 2026

Base: 3,800 UK businesses that said that they have a website
Note: The x-axis runs from 0% to 50% only to improve readability

There were some differences by business size in how websites were managed, shown in table 1. For instance, sole traders appeared more likely to manage their website entirely in-house, while small and medium businesses were more likely to use a mix of internal and external support.

Table 1: Percentage of businesses that had their website managed by the following methods, by size, in 2025 to 2026

Website management	Total	Sole trader	Micro (up to 9 employees)	Small (10 to 49 employees)	Medium (50 to 249 employees)	Large (250 plus employees)
A mixture of in-house and external support	29%	27%	32%	40%	42%	36%
Managed entirely in-house	27%	29%	23%	19%	19%	25%
Managed entirely by an external web developer or platform	24%	23%	26%	26%	20%	12%
Managed in-house using a platform provider	17%	18%	16%	13%	14%	18%

Base: 3,800 UK businesses that said that they have a website

There were also some sectoral differences in the way that businesses said that they managed their website. For example, businesses in the information and communication (SIC J) sector (51%) were more likely to say that they managed their website entirely in-house compared to most other sectors, apart from those in arts, entertainment and recreation (SIC R) sector (35%), hotel and catering (SIC I) sector (30%), and transport and storage (SIC H) sector (30%).

These differences may reflect variations in organisational structure and operational needs by business size and sector, including access to internal digital resources and the availability of staff with specialist digital skills. Businesses in more digitally intensive sectors may be more likely to have in-house expertise to manage and update websites, compared with businesses in sectors where such skills are less central to day-to-day operations. In the context of measuring digital presence across the UK business population, this may also suggest differences in how businesses engage with and maintain their online presence once established.

2.2. Data suppliers

To investigate trends in data use and production by UK businesses that were reported in the European data market (EDM) study of 2024 to 2026, the UKBDS 2026 asked businesses about the nature of their role in the supply and production of data assets. Businesses that handled digitised data of any type were asked whether the delivery of data or analytics products, services, tools or technologies was a main or supporting activity of their business. The EDM study’s definition of a ‘data supplier’ includes only those businesses where the production and delivery of digital data-related products is the main activity.

To make the results of this question comparable with the EDM study, only businesses that were identified as registered companies were included in the breakdown of results in this section. In this report, classification as a ‘data supplier’ is restricted to businesses that handle digitised data and report that data-related products or services are their main activity. Responses for all businesses handling digitised data are reported in the accompanying data tables, consistent with the approach used in the EDM study. In 2025 to 2026:

• Overall, 3% of companies said that the delivery of data or analytics products, services, tools or technologies was the main activity of their business.

• A further 7% said that it was a supporting activity, rather than their main activity.

Using the European data market definition of a ‘data supplier’ (where data-related products and services are the main activity) this proportion is similar to the EDM study, which estimated that around 5% of companies acted as data supplier across Europe. In the UKBDS 2025 to 2026:

• Businesses in the information and communication (SIC J) sector (34%) were more likely to be ‘data suppliers’ compared to most other sectors, apart from the administrative and support services (SIC N) sector (18%), shown in figure 13.

These findings are consistent with the UKBDS 2024, which found that in 2023 to 2024 10% of businesses were ‘data suppliers’. However, differences in question wording and how businesses were asked to classify this activity (yes or no, compared to main or supporting activity) should be considered when interpreting these results.

Figure 13: Percentage of companies classified as ‘data suppliers’, by sector, in 2025 to 2026

Base: 3,860 UK businesses that were identified as having a Company Registration Number
Note: The x-axis runs from 0% to 50% only to improve readability

Further analysis tried to understand the behaviour of ‘data suppliers’ in other aspects of data use. It was expected self-classifying data suppliers are more likely to share data outside their organisation, and that a larger percentage of these businesses share data to sell data directly. In 2025 to 2026:

• Among companies that classified themselves as ‘data suppliers’, 35% said that they shared data outside their organisation, higher than 11% of companies that handled digitised data of any type but did not classify themselves as a data supplier.

• The sample size was too small to identify whether there was a difference between ‘data suppliers’ and ‘non-data suppliers’ in the percentage that said they sold data.

3. Artificial intelligence and data

For the UKBDS 2026, additional questions on businesses use of artificial intelligence (AI) and automated decision making (ADM) were introduced. For the purposes of this survey, AI was defined as “technologies such as generative AI models (e.g. ChatGPT, Copilot and Gemini), machine learning, computer vision and other similar systems”. All types of use of AI were in scope, along with free or paid for tools, or those developed in-house or externally sourced. ADM was defined as “tools or systems that make decisions automatically without human involvement”.

3.1. Business attitudes to artificial intelligence development

Businesses that handled digitised data were asked how their business would feel about data owned by their business being used to train external artificial intelligence (AI) models in the UKBDS 2026. This included data such as documents, images and customer interactions, used either directly or after anonymisation, to develop AI systems such as ChatGPT or Copilot.

In 2025 to 2026, 18% of these businesses said that their business would feel comfortable with its data being used to train external artificial intelligence (AI) models, while 73% said that their business would feel uncomfortable. More specifically:

• 3% said that they would feel very comfortable

• 15% said that they would feel somewhat comfortable

• 25% said that they would feel somewhat uncomfortable

• 48% said that they would feel very uncomfortable

There were limited sectoral and business size differences that were statistically significant.

To explore whether prior consideration of AI influenced responses, this question was asked at different points in the survey.

• Around half were asked this question before any other AI-related questions.

• The remainder were asked after answering questions on AI use, automated decision-making (ADM), data use to train AI or ADM, and AI integration with business systems.

The survey did not find evidence that question placement affected responses. Taken together, these findings suggest that businesses remain broadly cautious about the use of their data to train external AI models.

3.2. Use of artificial intelligence

In 2025 to 2026, of UK businesses that handled digitised data, 41% said that they used Artificial Intelligence (AI) based technologies. Estimates from other sources vary, and differences in how AI use is defined, as well as variation across tasks and roles within businesses, means that overall adoption remain difficult to measure consistently.

• Large businesses were more likely to use AI (82%), compared to all other business sizes, whilst medium (58%) and small (51%) businesses were more likely to use AI compared to micro businesses (41%) and sole traders (40%).

• Businesses in the information and communication sector (SIC J) were more likely to use AI (62%) compared to most other sectors (shown in figure 14).

• Other sectors that had higher levels of AI use were those in the professional, scientific, technical (SIC M) sector (54%), finance and insurance (SIC K) sector (48%), administrative and support services (SIC N) sector (51%), and human, health and social work (SIC Q) sector (46%).

• Businesses in London in were more likely to say that they use AI (60%) compared to those in the East of England (36%), the North West (38%) and the South East (41%).

Overall, these findings suggest an association between AI use and business size and sector, with higher reported use among larger businesses and more knowledge-intensive and service-based sectors.

Figure 14: Percentage of businesses that used artificial intelligence technologies for any purpose, by sector, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data

Businesses that use any AI technology were more likely to say that they collected (41%) and shared (19%) data, compared to those that do not use AI technologies (26% and 11%, respectively). These businesses were also more likely to say that they analyse data (37%), compared to those that do not use AI technologies (17%). Overall, these findings may suggest an association between AI use and more developed data practices, with businesses using AI also reporting more intensive data collection, sharing and analysis.

In 2025 to 2026, the most common reason businesses reported that they use AI technologies was to research information (28%, for example, in place of a traditional search engine such as Google) or to summarise or collect in-house information or draft reports or correspondence (21%).

Large businesses were more likely than other business sizes to report using AI for a range of reasons, including drafting computer code (21%), customer service chatbots (21%), researching information (56%), and analysing data or building models (32%). See table 2 below.

Table 2: Selected reasons for using artificial intelligence technologies where large businesses were more likely than other business sizes to report use, in 2025 to 2026

Reasons for AI use	Sole trader	Micro (up to 9 employees)	Small (10 to 49 employees)	Medium (50 to 249 employees)	Large (250 plus employees)
Researching information	28%	28%	36%	39%	56%
Analysing data or building models	6%	8%	13%	15%	32%
Drafting computer code	6%	7%	6%	8%	21%
Customer service chatbots	4%	4%	6%	7%	21%

Base: 4,090 UK businesses that handled digitised data

Overall, large businesses reported higher use of AI across a wider range of reasons (shown in figure 15). These results suggest that while AI use for general tasks such as researching information and summarising content is relatively common across business sizes, larger businesses may be more likely to use AI for a wider range of more specialised purposes.

Figure 15: Percentage of businesses that used artificial intelligence technologies for the following purposes, by size, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data
Note: responses add up to more than 100% because businesses were allowed to specify more than 1 reason

In 2025 to 2026, among businesses that used AI, 21% said that their AI tools are integrated into existing business systems, such as Microsoft Copilot within Microsoft 365 (for example, Word, Excel or PowerPoint), AI embedded in customer relationship management (CRM) or finance systems, or AI features within workflow or productivity platforms (shown in figure 16).

• Large businesses (57%) were more likely to say that their AI tools were integrated in existing systems, compared to all other business sizes: medium (31%), small (31%), micro (27%) businesses and sole traders (18%).

• Businesses in the information and communication (SIC J) sector (39%) were more likely to say that their AI tools were integrated, compared to those in the manufacturing (SIC C) sector (12%) and construction (SIC F) sector (14%).

These findings suggest that AI integration into business systems may be limited, with higher levels of integration reported by larger businesses or those in more digitally intensive sectors, possibly reflecting differences in capability, resources and digital maturity.

Figure 16: Percentage of businesses that used artificial intelligence technologies and have AI tools integrated with their systems, by size, in 2025 to 2026

Base: 1,870 UK businesses that use Artificial Intelligence technologies

Businesses that said that their AI tools were integrated into existing business systems were more likely to say that they analyse data (62%) and collect data (55%), compared to those that said that their AI tools are not integrated with their business systems (30% and 37%, respectively). However, they were not more likely to share data. These findings may suggest an association between AI integration and more advanced data practices, for example using AI for CRM, or finance or productivity software.

3.3. AI / ADM use and related data practices

In the UKBDS 2026, businesses that handled digitised data and use artificial intelligence-technologies were asked if their business uses any automated decision-making (ADM) tools or systems. In 2025 to 2026, just 5% of those businesses reported using ADM, ranging from 8% of large businesses to 5% of sole traders. ADM among businesses that reported using, nearly one-third (32%) said that they use data to develop, train, or improve their ADM systems.

In 2025 to 2026, 6% of businesses that handled digitised data and used AI said that they used data to develop, train, or improve either AI or ADM systems.

• Large businesses were more likely to report using data for AI training (13%) compared to sole traders (2%).

• Businesses in the information and communication (SIC J) sector were also more likely to use data for AI training (20%), compared to those in the real estate (SIC L) sector (4%), finance and insurance (SIC K) sector (2%), professional, scientific, technical (SIC M) sector (2%) and wholesale and retail, repair or motor vehicles (SIC G) sector (1%), shown in figure 17.

While businesses in the finance and insurance (SIC K) and professional, scientific, technical (SIC M) sectors report relatively high levels of data sophistication (in collecting, sharing and analysing data) as well as AI use (figure 14, section 3.2), they report lower use of data for AI training. This may suggest there are sectoral differences in how AI is deployed, such as outsourcing of AI development or constraints around the use of data for AI purposes. This is explored further in section 3.4.

Figure 17: Percentage of businesses that used data to develop either artificial intelligence or automated decision-making systems, by sector, in 2025 to 2026

Base: 1,870 UK businesses that use artificial intelligence technologies
Notes: The x-axis runs from 0% to 50% only to improve readability. Some sectors are not shown because results have been suppressed where counts are too low.

The overall low reported use of data to develop, train or improve AI and ADM systems in 2025 to 2026 may suggest that more advanced or formal uses of data for these purposes are not currently widespread among businesses. These findings are largely consistent with the UKBDS 2024 which found that in 2023 to 2024 approximately 1% of businesses that handled digitised data said that they used data for ADM purposes, ranging from 10% among large businesses to 1% among sole traders, whilst 2% said that they used data for either AI or ADM purposes.

However, changes in question wording and survey routing between the 2 iterations of the UKBDS should also be considered when interpreting differences over time. In the UKBDS 2026, questions on ADM were asked only of businesses that reported using AI, whereas the UKBDS 2024 asked these questions of all businesses handling digitised data, and therefore different patterns may be observed if all businesses were asked about ADM use regardless of their AI activities.

The low reported use of ADM systems and of data use to train ADM and AI may also reflect differences in how businesses understand this activity, with some potentially considering only formal model training or development, rather than simpler interactions or adaptive learning within AI tools.

3.4. Governance of artificial intelligence in businesses

In the UKBDS 2026, businesses that said that they use artificial intelligence (AI) were asked about their policies on AI use or development. In 2025 to 2026, 17% of businesses that use AI said that their business has a policy or guidelines regarding the use and development of artificial intelligence, with 5% saying that their business has a formal, written policy, and 12% saying that their business has an informal policy or guidance (shown in figure 18).

• Large businesses (56%) were more likely to say that they have a formal, written AI policy, compared to all other business sizes: medium (22%), small (17%), micro (8%) and sole traders (3%).

• There was no variation in business size on businesses reporting that they have an informal policy or guidance regarding the use or development of AI.

Figure 18: Percentage of businesses that use artificial intelligence technologies and had an AI policy, by size, in 2025 to 2026

Base: 1,870 UK businesses that use artificial intelligence technologies

There were also sectoral differences in businesses reporting of artificial intelligence policies or guidelines:

• Businesses in the finance and insurance (SIC K) sector (20%) were more likely to say that they have a formal written policy, compared to those in the real estate (SIC L) sector (3%), professional, scientific, technical (SIC M) sector (4%), and wholesale and retail, repair of motor vehicles (SIC G) sector (2%), shown in figure 19.

• Businesses in the information and communication (SIC J) sector (22%) and professional, scientific, technical (SIC M) sector (16%) were more likely to say that they have an informal policy or guidance regarding the use or development of AI, compared to those in the construction (SIC F) sector (3%) and wholesale and retail, repair of motor vehicles (SIC G) sector (2%).

Figure 19: Percentage of businesses that use artificial intelligence technologies and had a formal AI policy or guidelines, by sector, in 2025 to 2026

Base: 1,870 UK businesses that use artificial intelligence technologies
Note: The x-axis runs from 0% to 50% only to improve readability

These findings may suggest that formal governance of AI use is still emerging, with more formal approaches primarily seen among larger businesses and in sectors where regulatory complexity may be higher.

In 2025 to 2026, among businesses that reported having an AI policy (formal or informal) or guidelines, 62% said that it included guidance on AI access to their business’s data and files. There was no measurable variation across business size or sector.

3.5. Businesses’ understanding of artificial intelligence regulations

In the UKBDS 2026, businesses that said that they use artificial intelligence (AI) were asked about their awareness and understanding of relevant AI guidance or regulations. In 2025 to 2026, awareness of AI regulatory guidance was mixed. More than half (53%) said that they had at least heard of AI regulatory guidance. Of these businesses, 10% said that they understood what the guidance involves, whilst 46% said that they were not aware of any regulatory guidance (shown in figure 20).

• Large businesses (40%) were more likely to say that they were aware of AI regulatory guidance and understand what it involves, compared to all other business sizes.

• There was very little variation in sector on businesses reporting that they were aware of AI regulatory guidance.

Among businesses that use AI and were aware of guidance and understood what it involves, 30% said that they had a formal, written policy and 24% said that they had an informal policy or guidance, compared to businesses who said that they were not aware of regulatory guidance (1% and 6%, respectively). This may suggest a relationship between awareness of regulatory guidance and the presence of internal AI policies.

Figure 20: Percentage of businesses that use artificial intelligence technologies and their awareness of regulatory guidance, by size, in 2025 to 2026

Base: 1,870 UK businesses that use artificial intelligence technologies

In 2025 to 2026, among those that said that they are aware of AI regulatory guidance, 19% strongly or somewhat agreed that their business found the guidance “clear and easy to understand”, whilst 22% strongly or somewhat disagreed with the statement (shown in figure 21).

• Large businesses (38%) were more likely to agree (strongly or somewhat) that AI regulatory guidance is clear and easy to understand, compared to medium (16%) and micro (20%) businesses, and sole traders (17%).

• Businesses in the finance and insurance (SIC K) sector (37%) and human, health and social work (SIC Q) sector (43%) were more likely to agree that the guidance is clear and easy to understand, compared to those in the construction (SIC F) sector (5%) and wholesale and retail, repair of motor vehicles (SIC G) sector (8%).

In 2025 to 2026, businesses that said that they were aware of AI regulatory guidance and understood what it involves (58%) were more likely to agree (strongly or somewhat) that they the guidance was clear and easy to understand, compared to those that aware of AI regulatory guidance by were not sure what it involves (10%).

These findings may suggest that, while AI regulatory guidance has reached part of the business population that use AI, it may not be consistently understood or perceived as clear, particularly among those with more limited familiarity with its content.

Figure 21: Percentage of businesses that were aware of artificial intelligence regulatory guidance, that said that the guidance is “clear and easy to understand”, by size, in 2025 to 2026

Base: 1,120 UK businesses that were aware of artificial intelligence regulatory guidance
Note: Some categories have been merged to manage small sample sizes

More detailed statistics have been included in the data tables that accompany this report, when they are based on sufficiently large samples.

4. Availability of data and the outcomes of data use

4.1. Availability of data

The UKBDS 2026 asked businesses that handled digitised data of any type about the availability of data and outcomes of this data use. Businesses were asked whether, in the previous 3 years, data had become more available to them (shown in figure 22). In 2025 to 2026:

• 32% said that data from outside of their business had become more readily available

• 41% said that the availability of data from outside of their business had not changed

• 9% of businesses said that data from outside of their business had become less readily available in the previous 3 years

Figure 22: Percentage of businesses that thought that data has become more or less available in the previous 3 years, by size, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data
Note: Some categories have been merged to manage small sample sizes

More detailed statistics have been included in the data tables that accompany this report, when they are based on sufficiently large samples.

There were limited size differences of statistical significance, however businesses in the administrative and support services (SIC N) sector (49%) were more likely to say that data had become more available to them in the previous 3 years, compared to several other sectors. This may reflect the intermediary role of businesses in the administrative and support services sector.

Perceptions of increasing data availability were also associated with other data-related activities. In 2025 to 2026, businesses were more likely to say that data had become more available where they:

• share digital data (44%, compared to 30% of those that do not)

• use artificial intelligence (AI) (46%, compared to 23% of those that do not)

• analyse data (43%, compared to 29% of those that do not)

This may suggest that businesses already engaging more actively with data are more likely to perceive improvements with data availability.

4.2. Outcomes of data use among businesses

In the UKBDS 2026, businesses were also asked about some of the beneficial outcomes of data use, shown in figures 23 and 24 below. In 2025 to 2026:

• 8% of businesses that handled digitised data said that the use of data led to more efficient internal processes always or most of the time, and 18% said some the time

• 21% said that data use hardly ever led more efficient internal processes and nearly half (49%) said it did not at all

• 5% of businesses said that data use always or most of the time led to innovation or new business functions, and 16% said some of the time

• 21% said that data use hardly ever led to innovation or new business functions and 54% said that it did not at all

These findings of the UKBDS 2026 were broadly consistent with those of the previous iteration UKBDS 2024, which showed similar patterns across both measures.

Figure 23: Percentage of businesses for which the use of data led to more efficient internal processes, by size, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data
Note: some categories have been merged to manage small sample sizes

More detailed statistics have been included in the data tables that accompany this report, when they are based on sufficiently large samples.

Some variations with business size were noted. In 2025 to 2026:

• Large businesses (29%) were more likely to say that the use of data led to more efficient internal processes always or most of the time, compared to small (11%) and micro (10%) businesses, and sole traders (7%).

• Medium businesses (16%) were also more likely to say it led to this outcome always or most of the time, compared to sole traders.

• Large businesses (12%) were more likely to say that data use leads to innovation or new business functions always or most of the time compared to micro businesses (5%).

• Most sole traders said that data use did not at all lead to more efficient internal processes (53%) or innovation or new business functions (54%).

These differences by business size may reflect variations in resourcing and capability, with larger businesses more likely to have the time, skills and infrastructure required to embed data use into operational processes and innovation activities.

Figure 24: Percentage of businesses for which the use of data led to innovation or improved business functions, by size, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data
Note: Some categories have been merged to manage small sample sizes

More detailed statistics have been included in the data tables that accompany this report, when they are based on sufficiently large samples.

There were also sectoral differences in the reported outcomes of data use. In 2025 to 2026:

• Businesses in the human, health and social work (SIC Q) sector (17%), finance and insurance (SIC K) sector (15%), and information and communication (SIC J) sector (13%) were more likely to say that the use of data led to more efficient internal processes always or most of the time, compared to those in the manufacturing (SIC C) sector (3%) and construction (SIC F) sector (3%).

• Businesses in the professional, scientific, technical (SIC M) sector (10%) were also more likely to report this compared to those in the construction (SIC F) sector.

• Businesses in the information and communication (SIC J) sector (14%) were more likely to say that the use of data led to innovation or new business functions always or most of the time, compared to businesses in the construction (SIC F) sector (1%), manufacturing (SIC C) sector (1%), and wholesale and retail, repair of motor vehicles (SIC G) sector (3%).

These differences may reflect variation in the extent to which data use is embedded in core business activities across sectors.

In 2025 to 2026, further analysis was conducted on the sample of businesses that said that data was at least somewhat more readily available in the previous 3 years (32%).

• 35% of these businesses said that data use led to more efficient internal processes

• 29% of these businesses said that data use led to innovation or new business functions

5. Data infrastructure

5.1. Types of data infrastructure

In the UKBDS 2026, businesses that handled digitised data were asked what types of physical infrastructure they use to store and process data (shown in figure 25). In 2025 to 2026:

• 31% of businesses said that they use a public cloud provider, such as Amazon Web Services, Microsoft Azure or Google Cloud

• 27% said that they use servers on business premises, such as based in their office, a different building owned by their business, or their business’s own data centre

• 22% said that they use a third party via software or a web solution (for example, cloud-based services accessed online)

• 19% said that they use their own private cloud provider

• 6% said that they used servers provided by an outsourced IT services company (for example, Fujitsu or Capgemini)

• 6% said that they use company-owned servers in rented space in a data centre

• 19% said that they did not use of the storage methods listed

• 5% said that they did not know what physical infrastructure their business uses to store and process data

Figure 25: Percentage of businesses that used the following types of data infrastructure to store and process data, in 2025 to 2026

Base: 2,050 UK businesses that handled digitised data and were randomly assigned to module A (see section A.4 on modularised survey questions)
Note: The x-axis runs from 0% to 50% only to improve readability

Overall, the results showed that larger businesses tended to have more developed and diversified data infrastructure, possibly reflecting their greater resources and operational complexity. Smaller businesses and sole traders were more reliant on simpler or externally managed solutions, as shown in figure 26 (below). In 2025 to 2026:

• Large (60%), medium (54%), and small (45%) businesses were more likely than micro businesses (34%) and sole traders (23%) to use business-owned servers on premises.

• Large (64%), medium (61%), and small (55%) businesses were more likely to use a public cloud or third-party via software or a web solution, compared to sole traders (42%).

• Large (25%), small (14%) and micro (10%) businesses were more likely than sole traders (4%) to use servers provided by outsourced IT services companies.

• Large businesses were more likely to use public cloud providers (60%) than small (35%), micro (32%) businesses and sole traders (30%).

• Large businesses were also more likely to use business‑owned servers in rented data‑centre space (23%) than small (8%), micro (9%) businesses and sole traders (5%).

Figure 26: Percentage of businesses that used the following types of data infrastructure to store and process data, by size, in 2025 to 2026

Base: 2,050 UK businesses that handled digitised data and were randomly assigned to module A (see section A.4 on modularised survey questions)

There was also some variation between businesses in different sector categories. In 2025 to 2026:

• Businesses in the finance and insurance (SIC K) sector (52%) were more likely to say that their business’s data is held / managed by a third-party via software or a web solution, compared to most other sectors – apart from those in the human, health and social work (SIC Q) sector (29%), administrative and support services (SIC N) sector (29%), transport and storage (SIC H) sector (36%), and the hotel and catering (SIC I) sector (26%).

• Businesses in the information and communication (SIC J) sector (23%) were more likely to say they that use servers owned by them in rented space in a data centre, compared to those in the real estate (SIC L) sector (5%), education (SIC P) sector (4%), professional, scientific, technical (SIC M) sector (3%), human, health and social work (SIC C) sector (3%), wholesale and retail, repair of motor vehicles (SIC G) sector (3%) and construction (SIC F) sector (1%).

• Businesses in the information and communication (SIC J) sector (42%), real estate (SIC L) sector (41%) and professional, scientific, technical (SIC M) sector (37%) were more likely to say that they use a public cloud provider to store and process data, compared to those in the wholesale and retail, repair or motor vehicles (SIC G) sector (18%) and arts, entertainment and recreation (SIC R) sector (15%).

The variation in reported data storage and processing arrangements by business size and sector may reflect differences in operational scale, internal technical capacity, regulatory requirements, and the volume or sensitivity of data managed.

5.2. Overlap of different server types

To understand the range of different infrastructure types used by UK businesses, different infrastructure types were grouped into 3 types by the location of their servers:

• Businesses that said they stored and processed data on servers owned by the business in a rented space in a data centre, public cloud providers or third party via software or a web solution were grouped as storing data in an external data centre.

• Businesses that said they stored and processed data on servers in their office, a different building owned by their business or their company’s own data centre were grouped as storing data in an enterprise data centre.

• Businesses that said they stored and processed data on servers provided by an outsourced IT services company or a private cloud provider were classified as ambiguous.

Shown in figure 27, among UK businesses that handle digitised data, in 2025 to 2026 different types of data infrastructure were used both individually and in combination to store and process data. 29% of businesses said that they stored and processed data only in external data centres, 14% only in enterprise data centres, and 10% of responses mentioned only ambiguous types of infrastructure (that are not straightforwardly classified into either external or enterprise types).

Businesses also reported combining different types of infrastructure to store and process data:

• 7% used both external data centres and enterprise data centres

• 8% used both external data centres and infrastructure that were ambiguous

• 3% used both enterprise data centres and infrastructure that were ambiguous

• 3% reported using all 3 types of infrastructure

Figure 27: Percentage of businesses that used the following types of data infrastructure to store and process data, in 2025 to 2026

Base: 2,050 UK businesses that handled digitised data and were randomly assigned to module A (see section A.4 on modularised survey questions)

5.3. Server outage

In 2025 to 2026, businesses that said that they store and process data away from their premises (59% of those that handle digitised data) were asked whether they were affected by server or cloud outages or downtime in the previous 12 months.

• Overall, 20% of businesses that stored data away from their premises said that their business been impacted by server or cloud outage or downtime (shown in figure 28).

• Large businesses (58%) were more likely to say that they were affected, compared to all other business sizes: medium (28%), small (31%) and micro (27%) businesses, and sole traders (17%).

• Small (31%) and micro (27%) businesses were also more likely to say that they had been affected by server or cloud outage or downtime, compared to sole traders.

• Businesses in the mining, energy, water (SIC B D E) sector (43%), and information and communication (SIC J) sector (39%) were more likely to say that they had been affected, compared to those in the real estate (SIC L) sector (7%).

Figure 28: Percentage of businesses that stored data away from their premises and were affected by cloud or server outages or downtime in the previous 12 months, by size, in 2025 to 2026

Base: 1,330 UK businesses that stored data away from their premises

6. Data protection law and regulation

This chapter concerns businesses’ awareness of, as well as the activities they have undertaken to comply with UK data protection law.

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act (DPA) 2018 is the framework for data protection law in the UK. Some provisions in the framework were updated by measures in the Data (Use and Access Act) 2025. It controls how personal information is used by organisations, including businesses or government departments, and what rights people have in relation to their personal data.

6.1. The Information Commissioner’s Office

The Information Commissioner’s Office (ICO) is an executive non-departmental public body that upholds information rights in the public interest. The ICO is responsible for enforcing a variety of data-related laws including the Data Protection Act 2018, UK GDPR 2021, the Privacy and Electronic Communications Regulations (PECR) 2003 and the Freedom of Information Act 2000. To help with this, the ICO publishes regulatory guidance and provides educational tools for individuals and organisations about complying with these laws.

In 2025 to 2026, among businesses that handled digitised data of any type:

• 62% said they had heard of the ICO and knew what it was

• 17% said they had heard of the ICO but did not know what it was

• 21% said they hadn’t heard of the ICO

There were no differences in responses by businesses from the UKBDS 2024. This is also consistent with the ICO’s 2025 Data Controller Study which asked all businesses if they are aware of the ICO, where 63% of businesses agreed they are “aware of the ICO and its work” and 21% of businesses disagree, they are not aware of the ICO and its work.

In 2025 to 2026, there were some differences between business size and sectors:

• Large businesses (73%) were more likely to say they had heard of the ICO and knew what it was than micro businesses (56%).

• Businesses in finance and insurance (SIC K) were more likely to say they had heard of the ICO and knew what it was (94%) than businesses in most other sectors, shown in figure 29.

Figure 29: Percentage of businesses that say they have heard of the ICO, by SIC sector, in 2025 to 2026

Base: 4,090 UK businesses that handled digitised data of any type
Note: Some data are suppressed due to small numbers

In 2025 to 2026, among businesses that handled personal data (either of employees or others):

• 46% said they agreed (strongly or somewhat) that the ICO’s published regulatory guidance was clear and easy to understand. 9% said they disagreed (somewhat or strongly) and 34% said they neither agreed nor disagreed.

• 73% of large businesses said they agreed the ICO’s guidance was clear and easy to understand. This is a larger percentage than sole traders (46%), micro businesses (44%) small businesses (50%) and medium businesses (53%), shown in figure 30.

• 66% of businesses in finance and insurance (SIC K) agreed the ICO’s regulatory guidance was clear and easy to understand. This is a larger percentage than 43% of businesses in hotel and catering (SIC I), 42% in professional, scientific, technical (SIC M), 36% in manufacturing (SIC C) and 26% in construction (SIC F).

In 2025 to 2026, among businesses that said that they found the AI regulatory guidance clear and easy to understand, 77% of businesses also found the ICO’s published regulatory guidance clear and easy to understand. This correlation is likely due to an underlying correlation with business size for businesses that find either ICO data protection or AI regulatory guidance clear and easy to understand. Further analysis is required to understand the relative importance of business size in this correlation.

Figure 30: Percentage of businesses that find the regulatory guidance published by the ICO clear and easy to understand, by size, in 2025 to 2026

Base: 3,760 UK businesses that handled digitised personal data (either of employees or others)
Note: Some categories have been merged to manage small sample sizes. More detailed figures have been included in the data tables that accompany this report when they are based on sufficiently large samples.

6.2. Impacts of data protection laws

Businesses that handled digitised personal data were then asked whether they had been prevented from carrying out the following activities, because of UK data protection laws:

• implementation of a new or significantly improved product, process or business model

• using or sharing data due to legal restriction under UK data protection law

• using or sharing data because of uncertainty that it was permitted under UK data protection law

In 2025 to 2026, the majority (90%) said they had not been prevented from carrying out any of the activities listed above. Sole traders (92%), micro businesses (87%), small businesses (83%) and medium businesses (85%) were more likely to say they had not been prevented from doing 1 of these activities than large businesses (69%).

• 5% said they had been prevented from using or sharing data due to a legal restriction under UK data protection law

• 4% said they had been prevented from using or sharing data because of uncertainty that it was permitted under UK data protection law

• 1% of businesses said they had been prevented from implementing new or significantly improved product, process or business model

• these responses are the same as those in 2023 to 2024 from the UKBDS 2024

There was some additional variation between businesses of different size categories. Notably, in 2025 to 2026, large businesses (13%) were more likely to say they had been prevented from using or sharing data due to legal restriction under UK data protection law than sole traders (4%). This might reflect the higher percentage of large and medium businesses that said they shared data outside their organisation, an indicator of more sophisticated data use.

6.3. Data protection compliance staff

All businesses with employees that handled digitised personal data and reported that their staff spent time understanding UK data protection law in the previous twelve months, were asked if someone in their organisation whose job role includes leading on data protection compliance. In 2025 to 2026:

• 56% of businesses that employ staff and handled digitised personal data (either of employees or others) said they had someone whose role includes leading on data protection compliance

• this percentage is higher in large businesses (92%) than medium businesses (74%), small businesses (64%) and micro businesses (53%).

• 85% of businesses finance and insurance (SIC K) said they had someone whose role includes leading on data protection compliance, which is a larger percentage than most other sectors (shown in figure 31)

Figure 31: Percentage of businesses that had someone whose role includes leading on data protection compliance, by SIC sector, in 2025 to 2026

Base: 3,150 UK businesses that handled digitalised data and employ staff

To help understand the size and extent of businesses’ compliance activities, businesses were also asked how many Full Time Equivalent (FTE) members of staff undertake activities related to complying with UK data protection law as their primary activity. In 2025 to 2026:

• 46% of businesses that handled digitised personal data (either of employees or others) had at least 1 FTE member of staff whose primary role was to undertake activities related to complying with UK data protection laws.

• 44% said they did not have any FTE staff whose primary role was to undertake activities related to complying with UK data laws. This does not necessarily mean these businesses do not have any staff who undertake activities related to complying with data protection laws.

As expected, the percentage of businesses that said they did not have any FTE staff whose primary role was to undertake activities related to complying with UK data protection laws is smaller in large businesses (14%) compared with micro (47%), small businesses (35%) and medium businesses (32%). This could reflect how, in smaller businesses employees are likely to have less specialised roles compared to larger businesses.

Further analysis tried to understand the relative importance of undertaking activities related to complying with UK data protection law, in the role of employees whose role includes leading on data protection compliance.

In 2025 to 2026, among businesses that said they had someone whose role includes leading on activities related to complying with UK data protection laws, 34% said they did not have any FTE members of staff whose main role was to undertake activities related to complying with UK data protection laws. This percentage was higher in micro businesses (37%) than large businesses (15%), which further suggests there is more specialisation in larger businesses’ compliance activities.

UK businesses with employees that handled personal data were then asked to estimate how many of those staff did spent time on data protection compliance despite it not being their primary role. In 2025 to 2026:

• among businesses with employees that handled digitised personal data, 44% reported no FTE staff spending time understanding UK data protection laws, including in cases where such activities fall within an employee’s primary role

• 6% said around half an FTE staff member

• 38% said between 1 and 2 members of staff

• 7% said between 3 and 10 members of staff

• 1% said 11 or more staff

47% of micro businesses said none of their staff, have a primary role which is complying with UK data protection law, spent time understanding UK data protection laws in the previous 12 months. This was a larger percentage than small businesses (35%), medium (32%) and large businesses (14%).

6.4. Data protection compliance activities

In 2025 to 2026, among businesses that handled digitised personal data (either of employees or others) and employ staff were asked about the measures they had taken in the previous 12 months to comply with UK data protection laws and regulation:

• 29% said they employed or outsourced to specialist staff to handle data protection requirements

• 11% said they ran data protection-related training for existing staff

• 7% said they both outsourced or employed new staff and ran training for existing staff

• this could suggest the outsourcing of understanding data protection laws does not perfectly substitute for the training of current staff to understand these laws (shown in figure 32)

There were differences in responses by businesses from the UKBDS 2024. There has been a decrease in the proportion of businesses that said they ran data protection-related training for existing staff, from 23% in 2023 to 2024. There has also been an increase in the proportion of businesses that said they employed or outsourced staff to handle data protection requirements, from 7% in 2023 to 2024.

Figure 32 shows how businesses reported using different types of staff-related data protection compliance activities in 2025 to 2026. 22% of businesses with employees only outsourced or employed new staff, 4% only ran training for existing staff, and 7% did both to comply with data protection laws.

Figure 32: The overlap between the percentage of businesses with employees that ran data protection compliance training for existing staff or outsourced or employed new staff to handle data protection compliance activities, in 2025 to 2026

Base: 3,150 UK businesses that handled personal data (either employees or others) and employ staff

In 2025 to 2026, among businesses that handled digitised personal data (other than of employees):

• 17% said they introduced opt-in consent mechanisms

In 2025 to 2026, among businesses that handled digitised personal data (either of employees or others) of any size:

• 25% said they rewrote or updated terms and conditions (up from 19% in 2023 to 2024)

• 24% said they introduced new processes to implement data protection measures (up from 13% in 2023 to 2024)

• 16% said they sought legal advice (up from 5% in 2023 to 2024)

• 7% said they purchased specialist software for data protection (no change from 2023 to 2024)

• 4% said they rewrote, updated or introduced a privacy notice (down from 18% in 2023 to 2024)

Figure 33 shows how businesses reported using different types of data protection compliance activities in 2025 to 2026. 11% of businesses that handled digitised personal data only sought legal advice or introduced new processes, 7% only rewrote or updated their terms and conditions or a privacy notice, and 2% only purchased specialist software. 15% both sought legal advice or introduced new process and rewrote or updated their terms and conditions or a privacy notice. 1% both purchased specialist software and rewrote or updated terms and conditions or a privacy notice. 1% also both purchased specialist software and sought legal advice or introduced new processes. 3% undertook all 3 compliance activities.

Figure 33: The overlap between the percentage of businesses that undertake different compliance activities, in 2025 to 2026

Base: 3,760 UK businesses that handled digitised personal data (either of employees or others)

In 2025 to 2026, among businesses that acquired personal data using cookies or similar technology placed on people’s connected devices, 5% said they updated how they manage cookies and tracking technologies used by their business.

Larger businesses were generally more likely to have taken a specified action to comply these rules. In 2025 to 2026:

• Large businesses (49%) were more likely to say they ran data protection-related training for existing staff than medium (21%), small (17%) and micro (10%) businesses.

• Large (88%) and medium (56%) business were also more likely to employ staff or outsource specialist staff than small (44%) and micro (24%) businesses.

There were also some differences between sectors. In 2025 to 2026:

• 26% of businesses in real estate (SIC L) said they ran training for existing staff. This was a larger percentage than in every other sector with the exception of 19% in administration and support services (SIC N) and 16% in human, health and social work (SIC Q).

• 46% of businesses in finance and insurance (SIC K) said they had rewritten or updated terms and conditions, which was a larger percentage than in some other sectors.

6.5. Perceived burden of complying with UK data protection law

In the 12 months prior to businesses responding to the UKBDS 2026, there have been changes to the UK’s data protection laws. The Data (Use and Access) Act 2025 (DUAA) became law in June 2025. It included several measures to simplify aspects of data protection law (see GOV.UK summary). Some technical measures in the DUAA were brought into force in August 2025. Most of these measures were brought into force in February 2026 (see GOV.UK summary).

All businesses that handled digitised personal data (either of employees or others) were asked whether it felt like the burden of complying with UK data protection laws had changed over the previous 12 months. In 2025 to 2026:

• 19% said the burden of complying with UK data protection law had increased (either a little or a lot)

• 76% said it had stayed around the same

• 1% of businesses said it had decreased (either a little or a lot)

• 4% said they did not know whether the burden had increased, decreased or stayed the same

• large businesses were more likely (35%) to say it felt like the burden had increased than micro businesses (21%) and sole traders (17%), shown in figure 34

There was a slight increase in businesses that said the burden of complying with UK data protection law had increased in last 12 months, from 14% in 2023 to 2024. This suggests these businesses are adjusting by using administrative resource to comply to the multiple legislative changes made to UK data protection. Whilst other businesses may be less impacted due to possible anticipation to the legislative changes and already started to adjust or other businesses may not be aware of these legislative changes and yet to adjust.

Figure 34: Percentage of businesses that felt the burden of complying with UK data protection laws in the previous 12 months had increased, stayed around the same or decreased, by size, in 2025 to 2026

Base: 3,760 UK businesses that handled digitised personal data (either of employees or others)
Note: Some categories have been merged to manage small sample sizes. More detailed figures have been included in the data tables that accompany this report when they are based on sufficiently large samples

7. International data flows

This chapter investigates the flow of data between UK businesses and organisations or people outside of the UK, as well as the factors that promote or limit these international data flows. It also concerns the mechanisms businesses use to make restricted transfers of personal data internationally. See chapter 8 for a discussion of these mechanisms.

7.1. General transfer of data internationally

In 2025 to 2026, 10% of businesses, that said they handled digitised data of any type, said they transferred (either sent or received) data with other organisations outside of the UK. This equates to 8% of all UK businesses.

• Large (24%) and medium (18%) businesses were more likely to have transferred data internationally than micro businesses (10%) and sole traders (9%).

• Businesses in administrative and support services (SIC N) sector (17%), information and communication (SIC J) sector (16%) and professional, scientific, technical (SIC M) sector (14%) were more likely to have transferred data internationally than those in the hotel and catering (SIC I) sector (3%) and construction (SIC F) sector (2%), shown in figure 35.

Figure 35: Percentage of businesses that transferred data internationally, by SIC sector, in 2025 to 2026

Base: 4,090 UK businesses that handle digitised data of any type
Note: The x-axis runs from 0% to 50% only to improve readability

7.2. Trade and the transfer of data

In 2025 to 2026, among businesses that handled digitised data of any type and traded with countries outside the United Kingdom, 27% transferred data internationally. A smaller percentage (4%) of businesses that handled digitised data of any type, and did not trade with countries outside the UK, transferred data internationally.

Businesses that handled digitalised data of any type can be broken down by how they trade and transfer data with other countries. In 2025 to 2026:

• 33% of businesses that traded with countries both inside and outside the EU (European Union) said they transferred data outside of the UK

• 26% of businesses that only traded with countries in the EU and handled digitised data said they transferred data outside of the UK

• 22% of businesses that only traded with countries outside the EU and handled digitised data said they transferred data outside of the UK

The sample size is insufficient to identify whether international data transfers are more common among businesses trading with both EU and non-EU countries than among trading with only 1 group.

7.3. Types of data being transferred internationally

In 2025 to 2026, of the businesses that handled digitalised data and transferred data internationally, 77% said they sent personal or non-personal data outside of the UK and 74% of businesses said they received personal or non-personal data from outside of the UK.

Businesses that handled personal data (either of employees or others) and transferred data internationally were asked whether they sent or received personal data from outside of the UK. 50% said they sent personal data outside of the UK and 46% said received personal data from outside the UK. 66% said they both sent and received personal data from outside the UK.

Among these businesses, 70% of large business es say they sent personal data outside the UK whilst 66% of business in in administrative and support services (SIC N) said they sent personal data outside the UK.

Figure 36 shows the proportion of businesses which send or received personal data internationally. 20% of businesses that handled digitised personal data and transferred data internationally only sent personal data, 16% only received personal data, and 30% did both.

Figure 36: The overlap between the percentage of businesses that sent and received personal data from outside the UK, in 2025 to 2026

Base: 450 UK businesses that handled digitised personal data (either of employees or others) and transferred data internationally

Businesses that handled non-personal data (other than of employees) were similarly asked whether they sent or received non-personal data from outside the UK. In 2025 to 2026, 70% of businesses said they sent non-personal data outside of the UK only and 70% said they received non-personal data outside of the UK only. 82% said they both received or sent non-personal data to countries outside the UK.

Figure 37 shows the proportion of businesses which send or received non-personal data internationally. 11% of businesses that handled digitised non-personal data and transferred data internationally only sent non-personal data, 12% only received non-personal data, and 59% did both.

Figure 37: The overlap between the percentage of businesses that sent and received non-personal data from outside the UK, in 2025 to 2026

Base: 390 UK Businesses that handled digitised non-personal data (other than employee data) and transferred data internationally

7.4. Reasons for data being transferred internationally

The survey asked businesses that transferred data internationally about the purpose of these transfers.

In 2025 to 2026, the majority (64%) of businesses that transfer data internationally said to deliver or receive goods, service or products.

• 51% of businesses said for customer or staff communication

• 31% of businesses said HR, financial or accounting purposes

• 31% of businesses said supply chain management and logistics

• 31% of businesses said research or development of a product or service

• 30% of businesses said for marketing and communication

• 22% of businesses said for market research or customer insights

• 19% of businesses said for legal or regulatory reasons

Figure 38: Reasons businesses transfer data internationally, in 2025 to 2026

Base: 480 UK businesses that transfer data internationally

There were also some differences between size and sectors. In 2025 to 2026:

• Large and medium businesses (46% and 49%, respectively) are more likely to say for legal or regulatory reasons than sole traders (16%).

• 79% of businesses in wholesale and retail, repair of motor vehicles (SIC G) said they transfer data internationally due to supply chain management and logistics reasons which is a larger percentage compared to 29% in administration and support services (SIC N), 24% in real estate (SIC L) and 20% in professional, scientific, technical (SIC M).

• 75% of businesses in manufacturing (SIC C) said they transfer data internationally due to R&D of a product or service which is a larger percentage compared to 21% in wholesale and retail, repair of motor vehicles (SIC G), 19% in real estate (SIC L) and 26% in administrative and support services (SIC N).

7.5. Locations with which businesses transfer data internationally

The UKBDS 2026 then asked businesses that transferred data internationally about the provenance of these transfers. In 2025 to 2026:

• the majority (76%) of these businesses said they sent or received data from countries in the EU or EEA (European Economic Area)

• 55% that said they transferred data with countries in North America

• 40% said they transferred data with countries in the Asia-Pacific region

• 36% said they transferred data with countries in Europe outside the EU and EEA

• 24% said they transferred data with countries in the Middle East

• 19% said they transferred data with countries in Latin America and the Caribbean

• 16% said they transferred data with countries in Sub-Saharan Africa

• 14% said they transferred data with countries in North Africa

Figure 39: Regions with which businesses transferred data, in 2025 to 2026

Base: 480 UK businesses that transferred data internationally
Note: Responses sum to more than 100% because businesses were allowed to specify more than 1 region

In 2025 to 2026, businesses that transferred data internationally were asked to list up to 10 countries with which they transferred data. The top 10 most listed countries are as follows (in order):

• 51% of businesses said the United States of America

• 35% of businesses said Germany

• 34% of businesses said France

• 24% of businesses said Spain

• 21% of businesses said Italy

• 15% of businesses said Australia

• 18% of businesses said Canada

• 15% of businesses said Ireland

• 14% of businesses said the Netherlands

• 12% of businesses said Belgium

Figure 40: Top 10 countries with which businesses transferred data internationally, in 2025 to 2026

Base: 460 UK businesses that said they transferred data internationally and specified the regions with which they transfer data
Note: Responses sum to more than 100% because businesses were asked to provide up to 5 countries with which they transfer data

The chart below plots the relative popularity of EU and EEA countries as locations with which UK businesses said they transfer data.

Figure 41: Percentage of businesses that transferred (sent or received) data with each country in the EU and EEA, in 2025 to 2026

Base: 460 UK businesses that said they transferred data internationally and specified the regions with which they transfer data
Note: Countries for which data is suppressed are shown in grey. Businesses were only asked to provide up to 10 countries with which they transfer data

The chart below plots the relative global popularity of countries as locations with which UK businesses said they transfer data.

Figure 42: Percentage of businesses that transferred (sent or received) data with each country globally, in 2025 to 2026

Base: 460 UK businesses that said they transferred data internationally and specified the regions with which they transfer data
Note: Countries for which data is suppressed are shown in grey. Businesses were only asked to provide up to 10 countries with which they transfer data.

Analysis tried to understand how the number of countries with which businesses transfer data is distributed. To note that businesses were only asked to list up to 10 countries with which they transferred data. In 2025 to 2026:

• 22% of businesses listed only 1 country with which they transferred data

• 14% of businesses listed 2

• 12% of businesses listed 3

• 10% of businesses listed 4

• 9% of businesses listed 5

• 10% of businesses listed 10

Figure 43: The number of distinct countries with which UK businesses transferred data, in 2025 to 2026

Base: 460 UK businesses that said they transferred data internationally and specified the regions with which they transfer data
Notes: Businesses were only allowed to provide up to 10 countries with which they transfer data internationally. However, businesses may transfer data internationally to more than 10 countries. The x-axis runs from 0% to 50% only to improve readability.

In 2025 to 2026, for the number of distinct countries with which businesses transferred data to, the overall weighted mean is 4.1 listed countries, and the overall weighted median is 3 listed countries.

There were some differences between business sizes, sole traders weighted mean and weighted median were 4.0 and 3 listed countries, respectively. This increased with medium businesses weighted mean and weighted median were 4.9 and 4 listed countries, respectively. Whilst large businesses weighted mean and weighted median were 5.0 and 6 listed countries, respectively. This suggests larger businesses tended to list more countries they transferred data with than smaller businesses.

7.6. Perceived burden of UK data protection laws on trade

All businesses that said they handled digitised personal data (either of employees or others) were asked whether they thought UK data protection laws were a barrier to trade with countries outside of the UK. In 2025 to 2026:

• 85% of these businesses said UK data protection laws do not present a barrier to trade

• 3% of these businesses indicated that UK law is a barrier to trade with countries within the EU and EEA and 2% said these laws were barrier to trade with countries outside the EU and EEA

Larger businesses were more likely to agree the UK’s data protection laws were a barrier to trade with countries outside the UK (13%) than small (5%) and micro businesses (4%) and sole traders (4%).

This could reflect larger businesses were more likely to transfer data with countries outside the UK and feel consequences of UK data protection law for their trade with other countries.

7.7. Experiences transferring data internationally

Businesses that transferred data internationally were asked whether they had encountered any of the following issues when transferring data internationally:

• issues due to cost, complexity or transparency of UK data protection law

• issues due to the cost, complexity or transparency in a country’s / region’s local data protection law

• issues due to data localisation of the receiving country

• issues due to the cost, complexity or transparency of UK data protection law or the cost or complexity of implementing legal safeguards to transfer personal data

In 2025 to 2026, 83% of these businesses said they had not encountered any of these issues when trying to transfer data internationally. 15% said they encountered at least 1 of these issues.

• Among businesses that sent personal data outside the UK, 2% said they encountered issues due to the cost or complexity of implementing legal safeguards to transfer personal data (3% of businesses that transfer data internationally).

• 5% of businesses that said they transferred data internationally said they had encountered issues due to cost, complexity or transparency of UK data protection law.

• 6% said they had issues due to the cost, complexity or transparency in a country’s local data protection law.

• 3% said they encountered issues due to data localisation of the receiving country (requirement on where the data needs to be stored or processed). Though some businesses may have low awareness of data localisation, as highlighted in the UKBDS 2024 qualitative research.

Businesses that encountered 1 or more of these issues were asked whether their experience prevented them from transferring data internationally. In 2025 to 2026:

• 14% said it prevented them from transferring personal data

• 4% said it prevented them from transferring non-personal data

• 4% said it prevented them from trading with a business outside of the UK

The sample was too small to infer statistically significant sectoral or size differences in the percentage of businesses that either encountered issues when trying to transfer data internationally, or that said this prevented them from carrying out specific activities.

8. International transfer mechanisms

The UK GDPR has rules about restricted transfers of personal data to people or organisations based in third countries outside the UK. The transfer of personal data is permitted if the UK has findings of adequacy for protecting personal data in the third country or a specified territory/sector in that country (see GOV.UK summary).

If the UK does not have these findings, there are various mechanisms or safeguards that organisations can use to transfer data:

• EU’s Standard Contractual Clauses (SCCs) with the international data transfer addendum (the Addendum)

• International Data Transfer Agreements (IDTAs)

• Binding Corporate Rules (BCRs)

The ICO publishes guidance on the different types of international transfer mechanisms (see ico.org.uk for additional information).

8.1. Businesses confidence in transferring data internationally

As the use of different mechanisms to transfer personal data overseas is governed by UK data protection law, it was anticipated the variety of available mechanisms for transferring personal data overseas could create confusion among businesses that were less familiar with UK data protection laws.

Therefore, before businesses were asked which legal safeguards they used to send personal data to countries outside of the UK, specific respondents were asked how confident they were to know which legal safeguards to use and if they have formal legal safeguards or policies in place.

In 2025 to 2026, 79% of businesses said they were (very or somewhat) confident that they knew which legal safeguard to use and 52% of businesses said that they had formal legal safeguards or policies in place for transferring personal data internationally.

In 2025 to 2026, of the businesses that said they were confident which legal safeguard to use, 63% said they have formal legal safeguards or policies in place. Similarly, businesses that said they were (not very or not at all) confident, 88% said they don’t have formal legal safeguards or policies in place.

The number of businesses asked this question was too small to draw meaningful conclusions about variation between businesses in different size or sector categories.

8.2. Mechanisms used to transfer personal data internationally

The survey then asked businesses that transferred data internationally about which international transfer mechanisms were used to transfer the personal data internationally.

Among businesses that said they sent personal data to countries outside of the UK, in 2025 to 2026:

• 16% said they used International Data Transfer Agreements (IDTAs)

• 26% said they used EU Standard Contractual Clauses (SCCs)

• 14% said they used Binding Corporate Rules (BCRs)

• 23% said they used Adequacy

• 7% said they used exceptions for exceptional circumstances

• 47% said they used none of these mechanisms

Figure 44: Percentage of businesses using specific mechanisms for transferring personal data internationally, in 2025 to 2026

Base: 210 UK businesses that sent personal data outside the UK

Businesses responses from the UKBDS 2026 are consistent with the previous results from the UKBDS 2024 or 2022 (direct comparison to 2021 is not possible due to the introduction of IDTAs).

8.2.1. Types of mechanisms used to transfer personal data internationally and level of confidence

In 2025 to 2026, among businesses that said they were confident to know which legal safeguard to use to send personal data to countries outside of the UK:

• 19% said they used International Data Transfer Agreements (IDTAs)

• 32% said they used EU Standard Contractual Clauses (SCCs)

• 17% said they used Binding Corporate Rules (BCRs)

• 28% said they used Adequacy

• 8% said they used exceptions for exceptional circumstances

• 41% said they used none of these mechanisms

These businesses are not different to businesses that said they were not confident to know which legal safeguard to use to send personal data to countries outside of the UK and said they used none of these mechanisms. This could be explained by following reasons, as explored in the UKBDS 2024 qualitative research:

• Some respondents may be unaware they use these mechanisms as another part of their business use them or relies on their legal department to ensure that proper frameworks were followed.

• Other businesses that do not use international transfer mechanisms, said they relied on emails as well as the security of virtual private networks (VPNs) and file hosting services to transfer data internationally.

8.2.2. Types of mechanisms used to transfer personal data internationally and having formal legal safeguards in place.

In 2025 to 2026, among businesses that said they have a formal legal safeguards or policies in place to personal data to countries outside of the UK:

• 29% said they used International Data Transfer Agreements (IDTAs)

• 43% said they used EU Standard Contractual Clauses (SCCs)

• 25% said they used Binding Corporate Rules (BCRs)

• 31% said they used Adequacy

• 11% said they used exceptions for exceptional circumstances

• 35% said they used none of these mechanisms

Among businesses that said they don’t have a formal legal safeguards or policies in place, 61% said they don’t use any of legal safeguards listed above. Whilst 14% of businesses said they use Adequacy and 7% of businesses said they use EU SCCs. This supposed contradiction could be explained by the following reasons as explored in the UKBDS 2024 qualitative research:

• Some businesses may not be able to relate with these mechanisms as ‘safeguards’ or ‘polices’ and so will not view them as such, although still use them when transferring personal data internationally. This is likely for Adequacy, as the legal mechanism is already in place, and businesses will not need to put additional legal safeguards in place.

• Some business, such as small businesses, instead may follow a code of practice when transferring data internationally, but would not have formal rules in place.

• Some businesses, such as large businesses, that have clientele within the EU assumed they are automatically covered by EU GDPR and so perceived as a form of data adequacy.

The sample was too small to infer statistically significant sectoral or size differences in the percentage of businesses that use specific mechanisms for transferring personal data internationally.

8.3. Mechanisms used to transfer personal data within the EU and EEA

Further analysis tried to understand whether these patterns are different in businesses that said they only transferred data with the EU and EEA.

Among businesses that sent personal data outside the UK and only transferred data with the EU and EEA. In 2025 to 2026:

• 28% said they used Adequacy

• 18% said they used IDTAs

• 24% said they used EU SCCs

• 6% said they used BCRs

In 2025 to 2026, of the businesses that said they only sent personal data to the EU and EEA, 88% said they were confident to know which legal safeguard to use. Whilst 54% that only transferred data with the EU and EEA said they have a formal legal safeguards or policies in place.

8.4. Mechanisms used to transfer personal data outside the EU and EEA

Among businesses that sent personal data outside the UK and trade with the rest of the world (outside the EU). In 2025 to 2026:

• 22% said they used Adequacy

• 14% said they used IDTAs

• 34% said they used EU SCCs

• 20% said they used BCRs

This is consistent with businesses that said they transfer personal data outside the EU and EEA.

There is possible uncertainty among businesses to know which legal safeguard to use, even when the third country has been granted ‘Adequacy’ legal status by the UK. In 2025 to 2026, 14% of businesses said that they use SCCs instead of Adequacy when transferring personal data with the EU, the United States of America (USA), Switzerland, Japan or Canada, although Adequacy status is in place. Whilst 34% of businesses said that they don’t use SCCs instead of Adequacy, and 52% of businesses said that they don’t know.

This could be explained by the UKBDS 2024 qualitative research findings, where businesses described why they use EU SCCs, alongside Adequacy, written in their contracts. SCCs are considered a ‘safety-net’ for businesses as they explain the process of dealing with data, such as giving clarity of responsibilities for each party and the ease for enforcement.

The UK only has partial recognition of Adequacy with Canada and Japan. Whilst the USA has been recognised as adequate through the extension of the Data Privacy Framework (see GOV.UK). Some businesses may have used SCCs due to the specific Adequacy arrangements with these countries.

9. Comparison with previous years

This chapter summarises some headline comparisons between the results of the UKBDS 2026 for 2025 to 2026 and previous results from 2020 to 2021, 2021 to 2022 and 2023 to 2024 (UKBDS 2021, 2022 and 2024 respectively). These inter-year comparisons should be treated with caution: from 2021 to 2022 onwards the UKBDS used a mix of Computer Assisted Telephone Interview (CATI) and online interviewing methods, however no businesses were interviewed online in 2020 to 2021 (UKBDS 2021). See Appendix A.5 for a discussion of possible ‘mode effects’ on each year’s results.

9.1. Handling of any digitised data

In 2025 to 2026, most UK businesses with 10 or more employees said that they handle digitised data of any type, including 99% of small businesses, 99% of medium businesses and 96% of large businesses (shown in figure 45). This is consistent with findings from the 2023 to 2024, 2021 to 2022 and 2020 to 2021, indicating little change over time.

According to the UK business population estimates (2025), businesses with 10 or more employees account for more than two-thirds of employment in the UK’s private sector business population (excluding the financial and insurance sectors) and contribute to nearly 80% of its turnover. Taken together, these findings suggest that many businesses with a large share of private sector employment and turnover report handling digitised data.

In 2025 to 2026, 86% of businesses reported that they handled digitised data of any type. This represents an increase from 77% in 2023 to 2024, but is broadly consistent with levels reported in 2020 to 2021 (81%) and 2021 to 2022 (85%). The increase between 2023 to 2024 and 2025 to 2026 suggests that the lower prevalence of digitised data handling observed in 2023 to 2024 may not have represented a sustained decline in business use of digitised data. Instead, reported levels in 2025 to 2026 may suggest a return to those seen in earlier years of the survey, with the lower 2023 to 2024 estimate possible reflecting a sampling variation of short-term fluctuation rather than a sustained change.

Estimates for small, medium and large businesses remain consistently high in 2025 to 2026. As in previous years, variation in the overall proportion of businesses handling digitised data appears to be primarily driven by businesses with fewer than 10 employees.

In particular, the proportion of:

• sole traders reporting that they handle digitised data increased from 73% in 2023 to 2024 to 83% in 2025 to 2026, in line with the estimate reported in 2021 to 2022 (83%)

• micro businesses (fewer than 10 employees) increased from 86% in 2023 to 2024 to 92% in 2025 to 2026, consistent with levels reported in 2021 to 2022 (90%) and 2020 to 2021 (91%)

Taken together, this may suggest that the fall in the overall proportion of businesses handling digitised data observed in 2023 to 2024 was largely driven by businesses with the lowest levels of digital intensity, rather than reflecting a broader reduction in the use of digitised data across the business population. However, this pattern should be interpreted with caution, as the change in 2023 to 2024 may also reflect sampling variation or short-term fluctuation rather than a sustained shift.

Figure 45: Percentage of businesses that handle digitised data of any type, by size and years

Base: 4,450 UK businesses (2025 to 2026), 3,910 UK businesses (2023 to 2024), 5,090 UK businesses (2021 to 2022) and 4,500 UK businesses (2020 to 2021)

There is also evidence of sectoral variation across years. Businesses in wholesale and retail, repair of motor vehicles (SIC G) that said that they handled digitised data in 2025 to 2026 (78%) increased from 59% in 2023 to 2024 but remained consistent with 2021 to 2022 (81%) and 2020 to 2021 (76%). While sectoral differences are apparent, fluctuations over time, particularly for smaller sectors, may reflect sampling variability rather than real changes in business behaviour.

9.2. Further inter-year comparisons

The following tables summarise the other comparisons between 2025 to 2026, and the 2023 to 2024, 2021 to 2022 and 2020 to 2021 publications. Differences are reported only where the question wording and structure are consistent across years. For more detail, such as confidence intervals or additional answer options, please review the data tables for each wave. Figures should only be interpreted as a statistically significant difference between that wave and the previous 1 if an arrow is shown next to the percentage reported. An upwards arrow (↑) indicates a significant increase, and a downwards arrow (↓) indicates a significant decrease.

Answer options not asked in a given year are marked as ‘Not asked’. This could be because a new question was introduced, or the structure or routing changes sufficiently that it is effectively a new question.

For conciseness questions are omitted from the tables below if there is no difference between any of the waves.

Table 3: Comparable questions on data handling and use across surveys waves, by years

Question	2020 to 2021 total	2021 to 2022 total	2023 to 2024 total	2025 to 2026 total
Percentage of all UK businesses that handled digitised personal data (other than employee data)	65%	63%	58% ↓	67% ↑
Percentage of all UK businesses that handled any non-personal data (other than employee data)	50%	52%	47%↓	56% ↑
Percentage of businesses that handle digitised data and analyse data	26%	Not asked	21%↓	25%

Note: Figures which are statistically significantly different to the previous year’s figures are denoted by either an upwards arrow (↑), indicating a significant increase, or a downwards arrow (↓), indicating a significant decrease, in the most recent wave. When businesses were not asked a question in 2023 to 2024, 2021 to 2022, or 2020 to 2021, or it was sufficiently altered as to effectively be a new question, this is denoted using ‘Not asked’.

Table 4: Comparable questions on the data market across surveys waves, by years

Question	2020 to 2021 total	2021 to 2022 total	2023 to 2024 total	2025 to 2026 total
Percentage of businesses that have a website	Not asked	Not asked	68%	78% ↑

Note: Figures which are statistically significantly different to the previous year’s figures are denoted by either an upwards arrow (↑), indicating a significant increase, or a downwards arrow (↓), indicating a significant decrease, in the most recent wave. When businesses were not asked a question in 2023 to 2024, 2021 to 2022, or 2020 to 2021, or it was sufficiently altered as to effectively be a new question, this is denoted using ‘Not asked’.

Table 5: Comparable questions on the data infrastructure across surveys waves, by years

Question	2020 to 2021 total	2021 to 2022 total	2023 to 2024 total	2025 to 2026 total
Percentage of businesses that handle digitised data and used a public cloud provider to store and process data	Not asked	Not asked	19%	31% ↑
Percentage of businesses that handle digitised data and used servers on their own premises to store and process data	Not asked	Not asked	35%	27% ↓
Percentage of businesses that handle digitised data and used their own private cloud to store and process data	Not asked	Not asked	13%	19% ↑
Percentage of businesses that handle digitised data and said that their business had been impacted by server or cloud outage or downtime in the past year	Not asked	Not asked	10%	20% ↑

Note: Figures which are statistically significantly different to the previous year’s figures are denoted by either an upwards arrow (↑), indicating a significant increase, or a downwards arrow (↓), indicating a significant decrease, in the most recent wave. When businesses were not asked a question in 2023 to 2024, 2021 to 2022, or 2020 to 2021, or it was sufficiently altered as to effectively be a new question, this is denoted using ‘Not asked’.

Table 6: Comparable questions on the data protection law and regulation across surveys waves, by years

Question	2020 to 2021 total	2021 to 2022 total	2023 to 2024 total	2025 to 2026 total
Percentage of businesses that handle digitised data and have heard of the ICO and knew what it was	44%	58% ↑	58%	62%
Percentage of businesses with employees that handle personal data that ran data protection-related training for existing staff	Not asked	29%	23% ↓	11% ↓
Percentage of businesses that handle personal data (other than employee data) that introduced opt-in consent mechanisms	Not asked	18%	10% ↓	17% ↑
Percentage of businesses that handle personal data that sought legal advice to comply with data protection laws	Not asked	8%	5% ↓	16% ↑
Percentage of businesses that handle personal data that introduced new processes to implement data protection measures	Not asked	20%	13% ↓	24% ↑
Percentage of businesses that handle personal data that rewrote or updated terms and conditions	Not asked	29%	19% ↓	25% ↑
Percentage of businesses that handle personal data that rewrote, updated or introduced a privacy notice	Not asked	29%	18% ↓	4% ↓
Percentage of businesses that acquired personal data using cookies that updated how they managed cookies and tracking technologies	Not asked	43%	33%	5% ↓
Percentage of businesses that handled digitised personal data said the burden of complying with UK data protection law had increased	Not asked	22%	14% ↓	19% ↑

Note: Figures which are statistically significantly different to the previous year’s figures are denoted by either an upwards arrow (↑), indicating a significant increase, or a downwards arrow (↓), indicating a significant decrease, in the most recent wave. When businesses were not asked a question in 2023 to 2024, 2021 to 2022, or 2020 to 2021, or it was sufficiently altered as to effectively be a new question, this is denoted using ‘Not asked’.

10. Regional differences

The survey collected information about the region in which respondents to the survey were based. Where the sample size is sufficiently large, it is possible to explore variation in the results across different regions of the UK.

There were very few statistically significant differences between regions. This is consistent with results from previous years. One statistically significant regional difference was reported in section 3:

• Businesses in London in were more likely to say that they use AI (60%) compared to those in the East of England (36%), the North West (38%) and the South East (41%).

It is also possible some of these differences are driven by variation in the percentage of businesses in each size and sector category (see the ONS Business: activity, size and location dataset). Therefore, it is difficult to draw any meaningful conclusions from these differences.

The data tables accompanying this report contain full regional breakdowns of the results for most questions, as well as the confidence intervals for these breakdowns.

Appendix

A. Methodology

A.1. Overview

Respondents from a total of 4,450 UK businesses were interviewed for the mainstage of this survey between October 2025 and January 2026 either via Computer Assisted Telephone Interview (CATI) or an online self-completion form.

The sample was chosen to give robust coverage of businesses in each UK region, business size and sector category. Responses were weighted according to business size and sector to make the sample representative of the UK business population.

See the technical report for more information about the sample selection and weighting procedure.

A.2. Definition of digitised data

As described in the accompanying technical report, businesses were asked whether they handle any digitised data, of which they were given the following definition:

“Digitised information that your organisation may hold, for example things such as financial records and names and addresses of employees and customers. All businesses use data in some form, and we are interested in speaking with all businesses even if you only deal with a small amount of digitised data.”

The survey was tailored to the handling of digitised data, although the handling of non-digitised personal information (like paper records) is also subject to UK data protection law.

A.3. Business size, sector and regional categories

In this publication, businesses are categorised by sector according to their Standard Industrial Classification (SIC) 2007 section codes. For more information about these codes, please see the Office for National Statistics’ (ONS) web page.

Compared with previous years of the UKBDS, business size categories were relabelled for the UKBDS 2026 (comparison below). While the labels have changed, the underlying size definitions remain the same, meaning comparisons by business size can still be made across years.

• sole traders

• micro businesses (up to 9 employees)

• small businesses (10 to 49 employees)

• medium businesses (50 to 249 employees)

• large businesses (250 employees or more)

Regional categories are determined using International Territorial Level (ITL) classification. Every business is assigned 1 of the 12 ITL 1 subdivisions. For more information about these codes, please see the ONS’ web page on International Geographies.

A.4. Modularised survey questions

As described in the technical report, questions about the outcomes of data use, data infrastructure and sensitive personal data were modularised. This approach meant the survey could collect data on a larger range of topics without asking each business too many questions.

Businesses that said they handle any digitised data were randomly assigned to 1 of 2 groups. Businesses in Module ‘A’ were then asked about their business’s attitude towards proprietary data being used to train external artificial intelligence (AI) models, prior to answering any other AI questions. Businesses assigned Module ‘B’ were asked this AI attitudes question after answering other AI questions, as well as questions about the infrastructure they use to store and process data. Random assignment means the results of these questions are still representative of the wider sample and, with appropriate weighting, the UK business population.

A.5. Mode effects

The fieldwork in 2025 to 2026 was conducted in 2 modes: businesses were interviewed either via computer assisted telephone interview (CATI) or via an online questionnaire, consistent with the approach from 2021 to 2022 onwards in the UKBDS 2022 and 2024. For UKBDS 2021, in 2020 to 2021, businesses were only interviewed using CATI.

In 2025 to 2026, the percentage of businesses interviewed via CATI was 78%, which aligns with 2023 to 2024 and 2021 to 2022 (77% and 72% respectively). Further analysis explored if businesses responded differently to the survey based on their survey mode.

This may be because businesses that choose to answer survey questions online are more engaged with the use of digitised data and technology and better understand whether and how their business uses digitised data.

Across the UKBDS, there was no systematic type of responses between businesses interviewed via CATI compared to businesses responded via the online survey. This is consistent with findings from previous releases. There was a difference in responses from businesses who said they procured (acquire, collected or purchased) any data from other businesses; however, the difference in responses was not consistent when the questions are broken down to each data source.

There was also a difference in responses from businesses on their awareness of the ICO. Businesses that responded via the online survey are more likely to heard of the ICO and know what it is and businesses that responded via CATI are more likely haven’t heard of the ICO. Additional in-depth research would be required to identify the possible reasoning for the differences and to control for other factors such as businesses size and sector.

B. Interpreting the data

B.1. Uncertainty when estimating results

The sample of businesses that responded to the survey is only a fraction of all UK businesses. This means it is not possible to say for certain whether the statistics reported in this publication are representative of the ‘true’ values in the UK business population.

However, it is possible to calculate the probability that the true value lies within a given range, or “confidence interval” of the sample statistic. This is calculated using the number of respondents or ‘observations’ in the sample and the percentage of observations who give each response to a question. Confidence intervals are expressed in percentage terms: there is a 95% probability that a figure’s true value lies in the 95% confidence interval of its sample statistic.

Confidence intervals can be depicted using ‘error bars’ on bar charts of the responses to a question, which are demonstrated below in an example. 65% of respondents in a hypothetical sample were reported as saying ‘Yes’, but there is a 95% probability the true population figure lies between 45% and 85%.

Figure 46: An example showing how to interpret confidence intervals on a bar chart

B.2. Reporting differences between groups

Throughout this report, there are comparisons between the percentage of businesses in 2 different groups that gave each response to a particular question. For example, large (95%), medium (97%), and small (95%) businesses are reported as being more likely to handle employee data than micro businesses (75%).

Such comparisons are only highlighted if the difference between 2 estimates is statistically significant. The reporting threshold in this publication is the 5% significance level, meaning the probability 2 different estimates are really the same value is less than 5%.

B.3. Treatment of small samples

If there are too few responses to a question, sample percentages can be misleading estimates of the true population figure. For this reason and to prevent the disclosure of individual results, some figures in the attached output tables are suppressed.

Note that each time the number of respondents to a question is reported (including in the attached output tables and the charts contained in this report), this has also been rounded to prevent the disclosure of individual results.