Official Statistics

UK Business Data Survey 2026: Technical report

Published 18 June 2026

1. About the research

This report outlines technical details relating to the UK Business Data Survey (UKBDS) 2026. Research findings are published separately by the Department for Science, Innovation and Technology (DSIT).

DSIT commissioned Ipsos to undertake a survey to explore the significance of data to businesses, what it is used for and how it drives the economy. It also sought to develop the evidence base relating to the international flow of data and difficulties encountered, as well the understanding amongst businesses of the relevant regulatory framework. The key aims were:

• to provide data which can be used to monitor a broad range of activities around business’ use of data over time to provide evidence to support monitoring of policy interventions and key government missions

• to provide more detailed evidence on key areas of data policy to inform emerging data policy priorities, including how businesses use and share data, use of artificial intelligence (AI) in data, transfer data internationally, interact with the data protection regime and reliance on data infrastructure

The research followed on from similar surveys undertaken in 2021, 2022 and 2024. It was conducted over 2 phases: a quantitative mixed mode telephone and online survey with 4,514 UK businesses (64 pilot, 4,450 main); and follow-up qualitative interviews to explore responses to the survey in more detail. A separate standalone qualitative technical report has been prepared and shared with DSIT.

2. Sample design

The sample population was all UK businesses.

The survey was undertaken at the ‘enterprise’ (that is, head office) level where the person best able to speak on behalf of the whole business would be most likely based. In all instances just 1 person was interviewed over phone or contacted via email in each business who was the most senior person with responsibility for making decisions related to data processing and storage.

We ensured the most statistically efficient sample design by using our in-house business sample calculator based on response rates from previous business surveys. The sample was randomly sampled by region and disproportionately stratified by size and sector. An entirely proportionately stratified sample would not allow sufficient subgroup analysis by size and sectors. For example, it would effectively exclude all medium and large businesses from the selected sample, as well as those in the Finance and Insurance (SIC K) and Mining, Energy, Water (SIC B D E) sectors, as they make up a very small proportion of all UK businesses – according to the Business Population Estimates 2025, published by the Department for Business and Trade (DBT). Therefore, we set disproportionate sample targets for sole traders, micro (up to 9 employees), small (10 to 19 and 20 to 49 employees), medium (50 to 249 employees) and large (250 to 499 and 500 or more employees) businesses and in SIC groups K and B D E. We also boosted specific sectors, to ensure we could get at least 100 responses in each SIC group, except for B D E where it was not feasible due to the very small overall number of businesses in these sectors.

The sample was designed to provide sufficient case numbers for key size bands and Standard Industrial Classification (SIC) sectors detailed in Table 2.1. The sample was supplied by Market Location.

All sample was cleaned so any invalid phone numbers were removed, run through our Do Not Call database and de-duped so that no duplicate businesses were included. It was then edited so business information was in the right format to allow monitoring of business characteristics during fieldwork and including those as variables in the final data file.

2.1. Sample frame

Market Location provided Ipsos with a list of 126,315 businesses. This was ordered and sent to us in 2 batches. The first batch was sent at the beginning of fieldwork, and the second sent part way through fieldwork.

Market Location is one of the leading providers of business-to-business (B2B) data in the UK. Ipsos opted for Market Location due to its population coverage, usability and quality. The database includes non-VAT and non-PAYE registered businesses (not present in alternative sample frames such as the Inter-Departmental Business Register). This sample was drawn randomly, proportionate to size and sector. This ensured that the survey was able to profile the entire business population across the UK, identifying accurately the relevant eligible cases for this research.

A breakdown of the Market Location sample leads can be found in Tables 2.1 below:

Table 2.1.: Breakdown of Market Location sample by business size and SIC sector

SIC Sector	Sole traders	Up to 9 employees	10 to 19 employees	20 to 49 employees	50 to 249 employees	250 to 499 employees	500 plus employees	Total by SIC
Agriculture, Forestry and Fishing (SIC A)	404	2,299	181	47	51	23	24	3,029
Mining, Energy, Water (SIC B D E)	920	2,704	430	497	278	70	78	4,974
Manufacturing (SIC C)	1,677	2,360	1,173	153	2,460	766	170	8,759
Construction (SIC F)	4,967	8,443	194	90	71	68	60	13,893
Wholesale and Retail, Repair of Motor Vehicles (SIC G)	2,332	9,779	355	524	845	552	292	14,679
Transport and Storage (SIC H)	2,051	3,266	91	101	167	189	163	6,028
Hotel and Catering (SIC I)	452	8,344	472	511	291	111	191	10,372
Information and Communication (SIC J)	1,251	3,095	1,648	873	776	299	123	8065
Finance and Insurance (SIC K)	1,547	3,246	1,536	915	342	173	174	7,933
Real Estate (SIC L)	1,822	4,500	2,581	467	114	48	44	9,576
Professional, Scientific, Technical (SIC M)	2,377	5,337	3,002	106	89	348	130	11,389
Administrative and Support Services (SIC N)	2,367	5,082	92	132	950	421	238	9,282
Education (SIC P)	2,484	883	21	46	32	186	171	3,823
Human, Health and Social Work (SIC Q)	2,746	1,494	279	303	161	120	148	5,251
Arts, Entertainment and Recreation (SIC R)	2,119	986	20	28	26	71	74	3,324
Other Service Activities (SIC S T U)	2,491	1,919	1,257	30	54	83	101	5,935
Total	32,007	63,737	13,332	4,823	6,707	3,528	2,181	126,315

3. Questionnaire design

The questionnaire was developed by Ipsos and DSIT. The starting point for questionnaire development was the questionnaire used for the UK Business Data Survey 2024. Numerous changes were made to reflect updates to policy and the priorities of the end users of the data. A cognitive testing phase tested respondents’ understanding of the new and updated questions. A pilot was undertaken to test the interview length.

Building on the approach taken in the previous wave, a number of questions were refined, removed, or included to enhance participant understanding and cover emerging policy priorities. This included the introduction of a new section of questions on businesses’ use of Artificial Intelligence (AI). Table 3.1 below summarises the new topic areas and questions included in the 2026 questionnaire:

Table 3.1.: New topic areas and questions covered in UKBDS 2026

Topic area	List of included questions
Artificial Intelligence (AI): AI use cases and comfort with data use for AI training Use of Automatic Decision Making (ADM) tools Awareness and clarity of AI regulation and businesses use of internal AI policies	Q_AI_BIZ_DATA_USE_PRE Q_AI_USE Q_ADM_USE Q_AI_TRAINING (A5_REVISED) Q_INTEGRATED_AI Q_AI_BIZ_DATA_USE_POST Q_AI_POLICY Q_AI_POLICY_DATA_USE Q_AI_REGS_AWARENESS Q_AI_REGS
Data acquisition and sharing: Whether businesses had purchased data, acquired free or open data, or sold data in the last 12 months Whether the business provides data or analytics products, services, tools or technologies to other organisations	Q_FREE_DATA Q_FREE_SOURCES Q_PURCHASED_DATA Q_DATA_SOLD Q_DATA_SERVICES_PROVIDED
Website management: How businesses websites are managed	Q_WEBSITE_MANAGED
International data transfers: Reasons for international data transfers and confidence in the legal safeguards used SCC vs adequacy use and reasons for using SCCs over adequacy	Q_TRANSFER_REASONS_NEW Q_LEGAL_SAFEGUARDS_CONFIDENCE Q_LEGAL_SAFEGUARDS_PLACE Q_LEGAL_SAFEGUARDS_USED Q_SCC_VS_ADEQUACY Q_SCC_VS_ADEQUACY_REASONS

A series of questions and topic areas were removed from this wave’s study to facilitate the inclusion of new questions and to ensure the length of interview remained manageable for participants. A summary of removed questions can be found in Table 3.2 below:

Table 3.2.: Questions removed between UKBDS 2024 and UKBDS 2026

Topic area	List of questions
Data infrastructure and resilience Where servers are held and the impact of server outage	B2 B4
Sensitive data categories Whether businesses processed sensitive personal data and the reasons for doing so	B5 B6
Subject Access Requests Volume of SARs businesses had received and refused	C7A/C7B C8A/C8B C6
UK Data Protection Law Whether staff received training relating to data protection Time or money spent on understanding data protection laws	C9A C9B C9C C10 C11A C11B C11C C 11D C12 C12A C12B

3.1. Cognitive interviewing

Due to the changes to the previous questionnaire, the questionnaire was cognitively tested to ensure new and amended questions were being understood as intended. The cognitive testing involved taking respondents through the questionnaire, administered via CATI (Computer Assisted Telephone Interviewing), followed by a set of questions to gather respondent feedback on how they found answering the questions. These responses were used to identify areas for improvement ahead of the pilot phase.

A total of 10 cognitive interviews were conducted between 18 and 25 August 2025. The interviews included a range of businesses in terms of size and sector.

A debrief meeting was held between DSIT and Ipsos at the end of August 2025 to review the cognitive interviews and discuss any changes required to the questionnaire. Different participants and different businesses had various suggestions, and some were able to answer questions more easily than others. However, in general all the questions tested were deemed to work well. As a result of the cognitive testing, a number of amendments were made to the questionnaire in preparation for the pilot phase. These included:

• For Q_WEBSITE_MANAGED: The inclusion of a fourth answer code “A mixture of in-house and external support”, as this combination had not been captured by the existing answer codes.

• For Q_COOKIE_USE: Making the optional CATI or info button information fixed in the question wording to aid understanding.

• For Q_SHARE_DATA_WHY: The incorporation of additional answer codes after testing of 2 different versions with participants. Participants recommended including these answer codes to aid comprehension.

• For Q_INTEGRATED_AI: Including examples in the CATI or info button information to aid comprehension.

• For Q_DATA_SERVICES_PROVIDED: Re-ordering the question wording to aid comprehension.

• For Q_INT_TRANSFER_BARRIERS: Including CATI or Info button information to provide definitions of the ‘EU’ and ‘EEA’.

• For Q_SCC_VS_ADEQUACY and Q_SCC_VS_ADEQUACY_REASONS: Including CATI or Info button information to explain what Standard Contractual Clauses (SCCs) are.

3.2. Pilot fieldwork

The pilot was used to ensure the questionnaire was working well and of a manageable length for participants. It was conducted over telephone and operated in the same way we would operate CATI interviews in the mainstage to test the logistics of fieldwork. We completed 64 interviews between 10 and 21 October 2025 with a range of sole traders, micro and medium-sized businesses. The size and sector characteristics of these pilot interviews are detailed in Table 3.3 below.

Table 3.3.: Profile of completed pilot interviews broken down by SIC sector and business size

SIC Sector	Sole trader	Up to 9 employees	50 to 249 employees	Total by SIC
Agriculture, Forestry and Fishing (SIC A)	0	1	0	1
Mining, Energy, Water (SIC B D E)	0	2	2	4
Manufacturing (SIC C)	0	1	1	2
Construction (SIC F)	2	2	0	4
Wholesale and Retail, Repair of Motor Vehicles (SIC G)	2	3	0	5
Transport and Storage (SIC H)	0	1	3	4
Hotel and Catering (SIC I)	0	0	1	1
Information and Communication (SIC J)	2	4	0	6
Finance and Insurance (SIC K)	2	2	0	4
Real Estate (SIC L)	1	2	1	4
Professional, Scientific, Technical (SIC M)	8	5	1	14
Administrative and Support Services (SIC N)	1	0	2	3
Education (SIC P)	2	0	1	3
Human, Health and Social Work (SIC Q)	1	1	3	5
Arts, Entertainment and Recreation (SIC R)	2	0	0	2
Other Service Activities (SIC S T U)	1	0	1	2
Total	24	24	16	64

The average interview length for pilot fieldwork was 24 minutes 49 seconds. Interview length is typically significantly longer the larger a business is due to their activities and responses meaning more questions are applicable and asked. Some interviews would also be shorter, if the business did not process digitised data. The pilot sample composition – heavily skewed towards sole traders and micro businesses, which all claimed to process digitised data – therefore made it difficult to draw a reliable conclusion. Since the length was above the target of 20 minutes it was agreed to make cuts to the questionnaire, and the average interview length would continue to be monitored just in case any ‘emergency’ cuts were required after 1 - 2 weeks of the main fieldwork period.

4. Fieldwork and monitoring

Fieldwork took place between 10 October 2025 and 28 January 2026. A total of 4,514 interviews were conducted. The final total includes the 64 interviews completed for the pilot study, and 4,450 main stage interviews. Of the main stage fieldwork interviews (including pilot) using Market Location sample, 3,513 of these took place via CATI and 1,001 were completed online. Sample was split into 2 batches throughout fieldwork, to ensure close monitoring of completes by size and sector. A breakdown of completed interviews by size and sector can be found in Table 4.1 below:

Table 4.1.: All completed interviews by size and sector

SIC Sector	Sole Traders	Micro (up to 9)	Small (10 to 19)	Small (20 to 49)	Medium (50 to 249)	Large (250 to 499)	Large (500 plus)	Total by SIC
Agriculture, Forestry and Fishing (SIC A)	21	101	5	3	3	0	1	134
Mining, Energy, Water (SIC B D E)	20	92	28	26	13	3	0	182
Manufacturing (SIC C)	75	83	21	29	46	6	8	268
Construction (SIC F)	103	175	28	6	1	2	2	317
Wholesale and Retail, Repair of Motor Vehicles (SIC G)	113	402	41	29	12	9	10	616
Transport and Storage (SIC H)	58	126	20	6	12	3	5	230
Hotel and Catering (SIC I)	22	173	37	30	15	4	11	292
Information and Communication (SIC J)	88	127	27	38	14	2	2	298
Finance and Insurance (SIC K)	78	179	34	22	2	1	1	317
Real Estate (SIC L)	72	153	13	21	3	4	3	269
Professional, Scientific, Technical (SIC M)	184	250	29	7	6	3	4	483
Administrative and Support Services (SIC N)	112	180	31	7	23	7	8	368
Education (SIC P)	84	40	14	5	2	8	9	162
Human, Health and Social Work (SIC Q)	95	65	14	30	21	7	3	235
Arts, Entertainment and Recreation (SIC R)	107	31	9	4	1	1	2	155
Other Service Activities (SIC S T U)	120	50	5	1	5	4	3	188
Total	1,352	2,227	356	264	179	64	72	4,514

All sample with an email address were invited to take part in the survey online first. An email invitation with a unique web link was sent to the available online sample. Once the sample had received 4 mailouts (1 invitation and 3 reminders), the sample was moved to be dialled by telephone. Businesses were called to arrange the best time for an interview and a reassurance email was sent if more information was requested. During telephone fieldwork, businesses continued to be given the option to complete online if they preferred. Sample performance was monitored against quotas throughout main fieldwork. To ensure the telephone team had enough lead time to reach the correct contact, they began calling large businesses immediately after the first email reminder. All other sample followed the approach described above.

As in the previous UK Business Data Survey, the CATI interview was completed with the person in the business most responsible for data. In larger businesses this tended to be the Chief Operating Officer or a Finance Director. For smaller businesses this tended to be the Managing Director, Chief Executive Officer or business owner. For email invitations, named contacts were used, which most often tended to be the business owner.

The final average CATI interview length was 20 minutes and 7 seconds. This was broadly in line with the expected average of 20 minutes.

5. Sample outcomes

A summary of key sample outcome metrics is provided in Table 5.1 below.

The eligibility among all respondents, defined as the number of completed interviews as a proportion of the number of completed and ineligible leads, was 63%.

The adjusted response rate, calculated as the number of completes as a proportion of the definitive sample outcomes, was 7.3%.

The unadjusted response rate (that is, all cases loaded onto the survey) was 3.57%. A detailed breakdown of unadjusted response rates by business size and sector can be found in Table 5.2 below. Since all eligible sample with an email address was both emailed and called, it is not possible to accurately split out response rate by survey mode.

Table 5.1.: Eligibility of sample

	Total
Completed interviews	4,514
Ineligible leads	2,705
Refusals	24,089
Live with unknown eligibility	27,358
Unusable leads	67,649
Total	126,315
Eligibility of screened respondents	62.53%
Unadjusted response rate	3.57%
Adjusted response rate	7.30%
Cooperation rate	15.78%

Table 5.2 shows the unadjusted response rates by size and sector.

Table 5.2.: Response rates by business size and sector

SIC Sector	Sole Trader	Micro (up to 9)	Small (10 to 19)	Small (20 to 49)	Medium (50 to 249)	Large (250 to 499)	Large (500 plus)	Total by SIC
Agriculture, Forestry and Fishing (SIC A)	5.20%	4.39%	2.76%	6.38%	5.88%	0.00%	4.17%	4.42%
Mining, Energy, Water (SIC B D E)	2.17%	3.40%	6.51%	5.23%	4.68%	4.29%	0.00%	3.66%
Manufacturing (SIC C)	4.47%	3.52%	1.79%	18.95%	1.87%	0.78%	4.71%	3.06%
Construction (SIC F)	2.07%	2.07%	14.43%	6.67%	1.41%	2.94%	3.33%	2.28%
Wholesale and Retail, Repair of Motor Vehicles (SIC G)	4.85%	4.11%	11.55%	5.53%	1.42%	1.63%	3.42%	4.20%
Transport and Storage (SIC H)	2.83%	3.86%	21.98%	5.94%	7.19%	1.59%	3.07%	3.82%
Hotel and Catering (SIC I)	4.87%	2.07%	7.84%	5.87%	5.15%	3.60%	5.76%	2.82%
Information and Communication (SIC J)	7.03%	4.10%	1.64%	4.35%	1.80%	0.67%	1.63%	3.69%
Finance and Insurance (SIC K)	5.04%	5.51%	2.21%	2.40%	0.58%	0.58%	0.57%	4.00%
Real Estate (SIC L)	3.95%	3.40%	0.50%	4.50%	2.63%	8.33%	6.82%	2.81%
Professional, Scientific, Technical (SIC M)	7.74%	4.68%	0.97%	6.60%	6.74%	0.86%	3.08%	4.24%
Administrative and Support Services (SIC N)	4.73%	3.54%	33.70%	5.30%	2.42%	1.66%	3.36%	3.96%
Education (SIC P)	3.38%	4.53%	66.67%	10.87%	6.25%	4.30%	5.26%	4.24%
Human, Health and Social Work (SIC Q)	3.46%	4.35%	5.02%	9.90%	13.04%	5.83%	2.03%	4.48%
Arts, Entertainment and Recreation (SIC R)	5.05%	3.14%	45.00%	14.29%	3.85%	1.41%	2.70%	4.66%
Other Service Activities (SIC S T U)	4.82%	2.61%	0.40%	3.33%	9.26%	4.82%	2.97%	3.17%
Total	4.22%	3.49%	2.67%	5.47%	2.67%	1.81%	3.30%	3.57%

6. Data processing, weighting and confidence intervals

6.1. Coding

The verbatim responses to unprompted questions could be coded as “other” by interviewers when they did not appear to fit into the predefined code frame. These “other” responses were coded manually by Ipsos’s coding team, and where possible, were assigned to codes in the existing code frame. It was also possible for new codes to be added where enough respondents – 10 per cent or more – had given a similar answer outside of the existing code frame. The Ipsos research team verified the accuracy of the coding, by checking and approving each new code proposed.

6.2. Weighting

Data was weighted by size and sector. We applied random iterative method (RIM) weighting for 2 reasons. Firstly, to account for non-response bias where possible. Secondly, to account for the disproportionate sampling approaches, which purposely skewed the achieved business sample by size and sector. The weighting makes the data representative of the actual UK business population.

RIM weighting is a standard weighting approach undertaken in business surveys of this nature. In cases where the weighting variables are strongly correlated with each other, it is potentially less effective than other methods, such as cell weighting. However, this is not the case here.

We did not weight by region, primarily because region is not considered to be an important determining factor for attitudes and behaviours around data. Moreover, the final weighted data are already closely aligned with the business population region profile. The population profile data came from the 2025 Business Population Estimates published by the Department for Business and Trade.

Interlocking weighting was also possible but was ruled out as it would have potentially resulted in very large weights. This would have reduced the statistical power of the survey results, without making any considerable difference to the weighted percentage scores at each question.

As in the previous UKBDS (2024), the following business size categories were used in the weighting:

• sole traders

• micro (up to 9 employees)

• small (10 to 49 employees)

• medium (50 to 249 employees)

• large (250 plus employees)

Tables 6.1 and 6.2 below show the business sizes bands, sectors and their proportions in the weighted sample, both under the new weighting scheme.

Table 6.1.: Unweighted and weighted profiles of interviews by sector (counts and percentages)

Sector	Weighted	Unweighted
Agriculture, Forestry and Fishing (SIC A)	117	120
%	2.59%	2.66%
Mining, Energy, Water (SIC B D E)	23	126
%	0.51%	2.79%
Manufacturing (SIC C)	209	312
%	4.63%	6.91%
Construction (SIC F)	702	328
%	15.55%	7.27%
Wholesale and Retail, Repair of Motor Vehicles (SIC G)	435	692
%	9.64%	15.33%
Transport and Storage (SIC H)	261	212
%	5.78%	4.70%
Hotel and Catering (SIC I)	185	294
%	4.10%	6.51%
Information and Communication (SIC J)	280	275
%	6.20%	6.09%
Finance and Insurance (SIC K)	71	289
%	1.57%	6.40%
Real Estate (SIC L)	123	282
%	2.72%	6.25%
Professional, Scientific, Technical (SIC M)	650	541
%	14.40%	11.98%
Administrative and Support Services (SIC N)	377	310
%	8.35%	6.87%
Education (SIC P)	248	172
%	5.49%	3.81%
Human, Health and Social Work (SIC Q)	316	232
%	7.00%	5.14%
Arts, Entertainment and Recreation (SIC R)	220	165
%	4.87%	3.66%
Other Service Activities (SIC S T U)	298	164
%	6.60%	3.63%
Total	4,514	4,514
%	100	100

Table 6.2.: Unweighted and weighted profiles of interviews by size (counts and percentages)

Size	Weighted	Unweighted
Sole traders	3,389	939
%	75.08%	20.80%
Up to 9 employees	913	2,531
%	20.23%	56.07%
10 to 49 employees	175	685
%	3.87%	15.18%
50 to 249 employees	30	227
%	0.68%	5.03%
250 plus employees	7	132
%	0.15%	2.92%
Total	4,514	4,514
%	100%	100%

6.2. Confidence intervals

The research respondents were a sample of the total UK business population so we cannot be certain that the figures obtained are exactly those we would have if all in the population had been interviewed (the ‘true’ values).

However, the variation between the sample results and the ‘true’ values can be predicted from the knowledge of the size of the samples on which the results are based and the number of times that a particular answer is given. The confidence with which this prediction can be made is usually chosen to be 95% - that is, the chances are 95 in 100 that the ‘true’ value will fall within a specified range.

For example, based on an effective sample size of 1,374 responses, where 50% gave a particular answer, the chances are that the ‘true’ value (which would have been obtained if the whole population had been interviewed) will fall within the range of ±1.4 percentage points from the sample result (that is, between 48.6% and 51.4%).

Table 6.3.: Sample and 95% confidence intervals

	Unweighted base (N)	Weighted base (N)	Effective Base	95% confidence interval (10%)	95% confidence interval (30%)	95% confidence interval (50%)
UK Business Data Survey 2026	4,514	4,514	1,374	1.4	2.1	2.3
Size				+ / -	+ / -	+ / -
Sole traders	939	3,389	799	2.1	3.2	3.5
Up to 9 employees	2,531	913	2,097	1.3	2.0	2.1
10 to 49 employees	685	175	569	2.5	3.8	4.1
50 to 249 employees	227	30	196	4.2	6.4	7.0
250 plus employees	132	7	118	5.4	8.3	9.0
Mode				+ / -	+ / -	+ / -
CATI	3,513	3,558	1,068	1.8	2.7	3.0
Online	1,001	956	307	3.4	5.1	5.6

Appendix A: Questionnaire

KEY:

ROUTING OR SCRIPTING OR TEXT SUBSTITUTION INSTRUCTIONS (I.E. EVERYTHING THAT WILL NOT APPEAR ON THE INTERVIEWER SCREEN) IN BOLD CAPS

QUESTIONS IN BOLD CAPS

Question text in plain text

Interviewer read-out in green

Script updates highlighted green

Bracketed questions “(S3)” refer to previously titled questions from the 2024 wave of UKBDS

S: Screening

SHOW TO WEB

WEB_INTRO

Thank you for participating in this survey which Ipsos is running on behalf of the Department for Science, Innovation & Technology (DSIT).

The survey is about data usage and protection within your business – when referring to data, we mean any raw, digitised information that your business may hold, for example things such as financial records and data about sales or transactions, as well as names and addresses of employees and customers.

All businesses use data in some form, and we are interested in [CATI: speaking with] [WEB: the views of] all businesses even if you only deal with a small amount of digitised data.

SHOW TO CATI

CATI_INTRO

Good morning (or afternoon). My name is [interviewer name] and I’m calling from Ipsos, an independent research company working on behalf of the Department for Science, Innovation & Technology (DSIT).

They have commissioned Ipsos to carry out some research to understand how businesses use and process personal and non-personal data, any domestic or international data transfers they make, and awareness and understanding of, and compliance with, data protection legislation.

[IF NUMBER OF EMPLOYEES ON SAMPLE IS 250 OR HIGHER: As a thank you for your time, we will make a charity donation of £15 on your organisation’s behalf to one of our 3 chosen charities, if you complete the interview.]

Please can I speak to someone who has responsibility for data in your business? INTERVIEWER: should be [INSERT COMPANY NAME].

CATI: IF UNSURE WHO IS RESPONSIBLE FOR DATA: By this we mean someone who would be able to speak to us about the kind of data your business uses and your data protection practices.

For example, if you’re a smaller company, this might be your Chief Operating Officer, Finance Director, or someone senior who would have oversight of decision-making in your business? In a larger business, it might be a Data Protection Officer or an IT specific person.

By data I mean any raw, digitised information that your business may hold, for example things such as financial records and data about sales or transactions, as well as names and addresses of employees and customers. All businesses use data in some form, and we are interested in speaking with all businesses even if you only deal with a small amount of digitised data.

SINGLE CODE.

1 Continue
2 Referred to someone else at establishment WRITE IN NAME AND JOB TITLE
3 Hard appointment
4 Soft appointment
5 Refusal
6 Refusal (company policy)
7 Refusal (taken part in recent survey)
8 Not available in deadline
9 Reassurance email WRITE IN NAME AND EMAIL ADDRESS

IF REFUSAL OR NOT AVAILABLE (WEB_INTRO OR CATI_INTRO=5-8): THANK AND CLOSE

Q_CONSENT (S3)

ASK ALL

Please note that DSIT will not be able to identify the businesses that take part unless you consent to this at the end of the interview. Your individual answers will remain anonymous.

Before we begin it is important for you to give your consent in line with UK GDPR legislation.

Ipsos reassures you that all information collected will be treated in the strictest confidence. You have the right to a copy of your data, change your data or withdraw from the research at any point. In order to guarantee this, and as part of our quality control procedures, all interviews are recorded. You can read more by accessing our privacy notice on www.ipsos.uk/BusinessData. Are you happy to proceed?

SINGLE CODE.

1 Yes
2 No [THANK AND CLOSE]

CATI: REASSURANCES TO USE IF NECESSARY OR WEB: INFO BUTTON

• Ipsos is an independent market research company, operating under the strict guidelines of the Market Research Society’s Code of Conduct. This means that anything you tell us will be treated in the strictest confidence, and none of your answers will be attributed to you unless you give explicit permission for us to do so.

• The survey will take around 20 minutes, depending on your answers.

• Under data protection law, you have the right to have a copy of your data, change your data, or withdraw from the research at any point. If you’d like to do this, you can consult our website at: www.ipsos.com/en-uk/privacy-data-protection.

• We obtained your company name and telephone number from Market Location, a database of businesses currently active in the UK.

If [CATI: respondent wishes] [WEB: you wish] to confirm the validity of the survey or find out more information about it, [CATI: they] [WEB: you] can call:

• MRS: Market Research Society on 020 7490 4911

• Ipsos: UKbusinessdatasurvey@ipsosresearch.com

• DSIT: Berkeley Zych: ukbusinessdatasurvey@dsit.gov.uk

Q_SIZE (S4)

ASK ALL.

Excluding yourself, how many people does your business employ?

CATI: IF NEEDED OR WEB INFO BUTTON: This is across all sites in the UK, either full or part time. Please include working directors, partners, managers, people who work away from the site. Do not include outside contractors, agency staff or self-employed contractors.

OPEN ENDED.

1 WRITE IN
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

SCRIPTING INSTRUCTION: FOR THE PURPOSES OF ROUTING, CODE S4 ANSWERS INTO Q_SIZE_2 (S4RAN) CODES.

USE SAMPLE DATA TO POPULATE Q_SIZE_2 WHERE PREFER NOT TO SAY (Q_SIZE=99).

Q_SIZE_2 (S4RAN)

ASK IF DON’T KNOW (Q_SIZE=98)

Excluding yourself, which of the following best describes the total number of people employed across all sites in the UK, either full or part time?

SINGLE CODE.

PROMPT WITH BANDS IF NECESSARY. RECORD APPROXIMATE ANSWER IF DON’T KNOW

1 Just yourself (0 employees)
2 1-4
3 5-9
4 10-19
5 20-49
6 50-249
7 250-499
8 500+
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

SCRIPTING INSTRUCTIONS: FOR THE PURPOSES OF ROUTING, USE SAMPLE DATA TO POPULATE Q_SIZE_2 WHERE DON’T KNOW OR PREFER NOT TO SAY (Q_SIZE_2=98 OR 99).

Q_STAFF_DATA (S5)

ASK IF EMPLOY STAFF (Q_SIZE_2=2 - 8)

Does your business digitally process, collect, store or in some way use personal or non-personal data from its staff? This might have been collected for HR purposes and used for things like payroll or communications purposes.

INTERVIEWER NOTE: IF DON’T KNOW, CODE NO.

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_HANDLING (S6)

ASK ALL.

[IF SOLE TRADER Q_SIZE_2=1: Thinking about data in your business that you collect or use in any way.]

[ELSE: Thinking about data in your business that you collect or use in any way, other than data on your own employees or personnel for HR or related purposes.]

Does your business handle digitised personal data, non-personal data, or both? Digitised means data stored or processed on a computer or other IT device.

Just to remind you, personal data is information that relates to an individual or can be linked back to an individual, and non-personal data is any other data.

CATI: IF RESPONDENT IS UNSURE IF THEIR DATA IS PERSONAL OR NON-PERSONAL, THEN RECORD PERSONAL.

MULTICODE OK EXCEPT 3, 98, 99.

1 Personal data
2 Non-personal data

3 Neither
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_CHECK (S9)

ASK SOLE TRADERS WHO COLLECT NEITHER PERSONAL NOR NON-PERSONAL DATA (Q_SIZE_2=1 AND Q_DATA_HANDLING=3, 98 OR 99), OR THOSE BUSINESSES THAT COLLECT NO DATA AT ALL, EITHER ABOUT STAFF OR OTHERWISE (Q_STAFF_DATA=2, 98, OR 99 AND Q_DATA_HANDLING=3, 98 OR 99).

Just to confirm, you’ve said your business does not handle any digitised data. By ‘data’, we include data on sales, marketing, customers, purchases or anything else. Does your business process any data at all?

INTERVIEWER NOTE: IF DON’T KNOW OR PREFER NOT TO SAY, CODE 2.

SINGLE CODE. DO NOT READ OUT.

1 My business does not process any data at all
2 My business does process data, but it is not digitised
3 No, incorrect – my business does process digitised data
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

IF DOES PROCESS DATA AND SOLE TRADER (Q_DATA_CHECK=3 AND Q_SIZE_2=1), ASK Q_DATA_HANDLING AGAIN.

IF DOES PROCESS DATA AND BUSINESS WITH EMPLOYEES (Q_DATA_CHECK=3 AND Q_SIZE_2=2-8), ASK Q_STAFF_DATA AND Q_DATA_HANDLING AGAIN.

Q_WEBSITE (S7)

ASK ALL

Does your business have a website?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_WEBSITE_MANAGED (S8)

ASK IF HAVE A WEBSITE (Q_WEBSITE=1)

How is your business’ website managed?

SINGLE CODE. RANDOMISE EXCEPT 98, 99.

1 Managed entirely in-house CATI: IF NEEDED OR WEB INFO BUTTON: Your business designs, updates, and hosts the website without external help.
2 Managed in-house using a platform provider CATI: IF NEEDED OR WEB INFO BUTTON: Your business uses tools like Squarespace, Wix, or Shopify to build and maintain the website.
3 Managed entirely by an external web developer or platform CATI: IF NEEDED OR WEB INFO BUTTON: A third-party developer, agency, or platform provider such as Squarespace or Wix handles the website’s design, maintenance, and / or hosting.
4 A mixture of in-house and external support CATI: IF NEEDED OR WEB INFO BUTTON: E.g. you handle the look and content but you use external support for the technical details.
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

ROUTING INSTRUCTION: IF Q_DATA_CHECK=1, SKIP TO SECTION F

Q_DATA_TYPE_DUM (S5DUM)

DUMMY VARIABLE FOR FUNCTION DO NOT ASK

MULTICODE

1 Employee data (personal or non-personal)

IF Q_STAFF_DATA=1 OR Q_STAFF_RECORDS (F1)=1, CODE 1
2 Personal data (other than employee data)
IF Q_DATA_HANDLING=1 OR Q_WEBSITE_TRACKING (F3)=1 OR Q_MARKETING_STORED (F6)=1 OR Q_CARD_PAYMENTS (F8)=2 OR Q_DIGITAL_INFO (F9)=1, CODE 2
3 Personal data (including employee data)

IF Q_STAFF_DATA=1 OR Q_DATA_HANDLING=1 OR Q_STAFF_RECORDS (F1)=1 OR Q_WEBSITE_TRACKING (F3)=1 OR Q_MARKETING_STORED (F6)=1 OR Q_CARD_PAYMENTS (F8)=2 OR Q_DIGITAL_INFO (F9)=1, CODE 3
4 Non-personal data
IF Q_DATA_HANDLING=2 OR Q_WEBSITE_TRACKING (F3)=2 OR Q_MARKETING_STORED (F6)=2, CODE 4
5 Does not use any digitised data

IF (Q_STAFF_DATA=2 AND Q_DATA_HANDLING=3) OR (Q_SIZE_2=1 AND Q_DATA_HANDLING=3), CODE 5

A: Data handling and use

INTRO

SHOW IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

In the following questions we are going to ask you about how your business handles data. We will ask questions about both personal data, which is information that relates to an identified or identifiable individual, and non-personal data, which is any other data.

We are interested in the processes your business has in place, however small or significant the amount of data your business handles. We are not here to “check-up” on your compliance with any regulation. Your individual details and all published data will remain completely anonymous, and you won’t be contacted again in relation to this research unless you have consented to it.

Q_COLLECT_DATA (A1)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

Does your business acquire or collect data from other businesses or organisations?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_PURCHASED_DATA (NEW)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

Did your business purchase data in the last 12 months?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_FREE_SOURCES (NEW)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

Did your business acquire or collect any free or open data in the last 12 months?

CATI: IF NEEDED OR WEB INFO BUTTON: Free or open data is any data that your business does not pay for, such as publicly available datasets from government departments, open data platforms, regulators, local authorities, or academic institutions.

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_COOKIE_USE (A1_3)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3, EXCLUDE IF Q_DATA_CHECK (S9)=3).

Does your business acquire or collect personal data through the use of cookies or similar technology placed on people’s connected devices?

CATI: IF NEEDED OR WEB INFO BUTTON: Cookies are small files stored on a user’s device to track activity. This includes tools like Google analytics, Facebook Pixel, embedded YouTube videos, live chat widgets, or social media buttons. Similar technologies may include app-based tracking.

MULTICODE OK EXCEPT 3, 98, 99.

1 [ASK IF HAVE A WEBSITE (Q_WEBSITE=1)] Yes - we use website cookies
2 Yes [IF HAS WEBSITE (Q_WEBSITE=1) ADD - we use app-based tracking technology]
3 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

IF Q_WEBSITE_TRACKING=1 OR 2, CODE Q_COOKIE_USE=1

Q_COOKIE_USE_WHY (A1_4)

ASK IF ACQUIRE PERSONAL DATA THROUGH COOKIES OR SIMILAR TECHNOLOGY (Q_COOKIE_USE=1 OR 2)

For which of the following reasons does your business collect data using cookies or similar technology placed on people’s connected devices?

MULTICODE OK EXCEPT 8,98,99.

RANDOMISE EXCEPT 7,8,98,99.

READ OUT

1 To provide an online service which the user has requested
2 To facilitate the transmission of communications over a network CATI: IF NEEDED OR WEB INFO BUTTON: E.g. making your website more responsive
3 Installing necessary security updates
4 Ensuring user preferences are followed
5 Collecting information for statistical purposes about how website or service is used with a view to making improvements
6 To facilitate marketing and advertising
7 Other
8 We don’t use the data we collect using cookies
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SHARE_DATA (A2)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

Does your business share data outside of your organisation?

CATI: IF NEEDED OR WEB INFO BUTTON: By sharing we mean any movement of data out of your business to other organisations or individuals, such as selling, publishing or sharing for free.

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_SOLD (NEW)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

Did your business sell data in the last 12 months?

CATI: IF NEEDED OR WEB INFO BUTTON: E.g. selling databases or other data to individuals or other businesses. There is a separate question later about selling of data-driven products or insights.

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_FREE_DATA (NEW)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

Did your business provide or share data for free in the last 12 months?

CATI: IF NEEDED OR WEB INFO BUTTON: This could include sharing data with partners, industry bodies, customers or clients, publishing data on public platforms, or making data available for public use under an open licence.

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SHARE_DATA_WHY (NEW)

ASK IF SHARE DATA (Q_SHARE_DATA=1) OR IF HAVE SOLD DATA (Q_DATA_SOLD=1) OR IF HAVE PROVIDED OR SHARED FREE DATA (Q_FREE_DATA=1).

For what reasons does your business share data outside your organisation?

MULTICODE OK EXCEPT 98,99.

RANDOMISE EXCEPT 9,98,99.

GROUP 1: KEEP 3 & 4 TOGETHER IN THAT ORDER.

1 HR, financial, or accounting purposes CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. payroll, recruitment, invoicing, tax reporting)]
2 Supply chain management and logistics CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. shipping, inventory management)]
3 Market research or customer insight CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. surveys, focus groups, usage analytics)] GROUP 1.
4 Marketing and communications CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. advertising campaigns)] GROUP 1.
5 Customer or staff communications CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. messaging, notifications)]
6 Research and development of a product or service CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. design, testing, prototyping)]
7 Legal or regulatory reasons CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. compliance, subject access or government or legal requests)]
8 To deliver or receive goods, services, or products CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. shipping goods, processing transactions, selling data directly)]
9 Other (Please specify) WRITE IN
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_ANALYSE_DATA (A4)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

Does your business analyse data (whether personal, non-personal or in combination) to generate new insights or knowledge? (e.g. creation of, or improvement to, services and products)

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_SERVICES_PROVIDED (NEW)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

Does your organisation provide any of the following to other organisations: data or analytics products, services, tools or technologies?

SINGLE CODE.

1 Yes, it is the main activity of my business
2 Yes, it is a supporting activity of my business
3 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

I: Artificial intelligence and data

AI_INTRO

SHOW IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

This next section asks about your business’s use of Artificial Intelligence (AI) and data, not your personal use. AI includes technologies such as generative AI models (e.g. ChatGPT, Copilot and Gemini), machine learning, computer vision and other similar systems.

This includes all types of use, whether the AI tools are free or paid for, developed in-house or externally sourced.

SCRIPTER: IF Q_DATA_TYPE_DUM=1-4 ALLOCATE TO EITHER MODULE A (50%) OR MODULE B (50%) ON LEAST FULL BASIS.
MODULE A=Q_AI_BIZ_DATA_USE_PRE
MODULE B=Q_AI_BIZ_DATA_USE_POST

Q_AI_BIZ_DATA_USE_PRE

ASK IF MODULE A AND USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

How would your business feel about the data your business owns being used to help train external AI models?

CATI: IF NEEDED OR WEB INFO BUTTON: For example, documents, images, customer interactions being used, either directly or after anonymisation, to improve or develop AI systems such as ChatGPT or Copilot.

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, LEAVE 98 AND 99 AT BOTTOM

READ OUT

1 Very comfortable
2 Somewhat comfortable
3 Somewhat uncomfortable
4 Very uncomfortable
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_AI_USE (Q2b_DUPS)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

Does your business use Artificial Intelligence-based technologies for any of the following purposes?

[CATI IF NEEDED OR WEB INFO BUTTON: This could include technologies like generative AI models (e.g. ChatGPT, Copilot and Gemini), machine learning, and computer vision.]

CATI: READ OUT: OR WEB: SHOW ON SCREEN: Please select all that apply

MULTICODE OK EXCEPT 9,98,99.

RANDOMISE EXCEPT 8,9,98,99.

READ OUT

1 To summarise or collate in-house information, draft reports or correspondence
2 To draft computer code
3 To research information (e.g. in place of a traditional search engine such as Google)
4 To analyse data or build models
5 Customer service chatbots
6 Generating images or videos (e.g. for marketing purposes)
7 To protect the business’ systems and networks from cybersecurity threats
8 Other
9 Do not use AI
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_ADM_USE

ASK IF USES AI TECHNOLOGIES (Q_AI_USE=1-8)

Does your business use any tools or systems that make decisions automatically without human involvement? These are known as Automated Decision-Making systems (ADM). 

[CATI IF NEEDED OR WEB INFO BUTTON: (e.g. decisions on hiring, or who to give a loan to, that don’t have meaningful human involvement)

SINGLE CODE. 

1 Yes 
2 No 
98 DO NOT READ OUT: Don’t know  
99 DO NOT READ OUT: Prefer not to say

Q_AI_TRAINING (A5_REVISED)

ASK IF USE AI TECHNOLOGIES (Q_AI_USE=1-8)

Does your business use data to develop, train, or improve any of the following?

MULTICODE OK EXCEPT 3,98,99.

RANDOMISE EXCEPT 3,98,99.

READ OUT

1 Artificial Intelligence (e.g. machine learning models, generative AI)
2 SHOW IF CODE Q_ADM_USE=1 (YES) Automated Decision-Making systems (e.g. fully automated business rules or scoring or detection systems)
3 No, we don’t use data for these purposes
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_INTEGRATED_AI (NEW)

ASK IF USE AI TECHNOLOGIES (Q_AI_USE=1-8).

Are any Artificial Intelligence tools used by your business integrated with your systems?

CATI: IF NEEDED OR WEB INFO BUTTON: This could include tools like Microsoft Copilot in Microsoft 365 (e.g. Word, Excel or PowerPoint), AI built into CRM (Customer Relationship Management) or finance systems, or AI features in workflow or productivity platforms.

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_AI_BIZ_DATA_USE_POST

ASK IF MODULE B AND USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

How would your business feel about the data your business owns being used to help train external AI models?

[CATI IF NEEDED OR WEB INFO BUTTON For example, documents, images, customer interactions being used, either directly or after anonymisation, to improve or develop AI systems such as ChatGPT or Copilot.]

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, KEEP 98 AND 99 AT BOTTOM

READ OUT

1 Very comfortable
2 Somewhat comfortable
3 Somewhat uncomfortable
4 Very uncomfortable
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_AI_POLICY

ASK IF USES AI TECHNOLOGIES (Q_AI_USE=1-8)

Does your business have a policy or guidelines regarding the use or development of Artificial Intelligence?

SINGLE CODE.

1 Yes, a formal written policy
2 Yes, an informal policy or guidance
3 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_AI_POLICY_DATA_USE

ASK IF HAVE AI POLICY (Q_AI_POLICY=1 OR 2)

Does your AI policy include guidance on AI access to your business’ data and files?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_AI_REGS_AWARENESS (NEW)

ASK IF USES AI TECHNOLOGIES (Q_AI_USE=1-8)

Before taking this survey, which of the following best describes your awareness of guidance or regulations related to Artificial Intelligence?

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, KEEP 99 AT BOTTOM

READ OUT

1 I’m aware of AI regulatory guidance and understand what it involves
2 I’ve heard of AI regulatory guidance, but am not sure what it involves
3 I’m not aware of any AI regulatory guidance
99 DO NOT READ OUT: Prefer not to say

Q_AI_REGS (NEW)

ASK IF AI_REGS_AWARENESS=1-2

Thinking about the use and development of Artificial Intelligence, to what extent do you agree or disagree with the following statement?

“My business finds the regulatory guidance on AI clear and easy to understand.”

CATI: IF NEEDED OR WEB INFO BUTTON: Regulatory guidance for AI includes advice from authorities to help anyone follow best practices or principles when using or developing AI

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, LEAVE 98 AND 99 AT BOTTOM

READ OUT

1 Strongly agree
2 Somewhat agree
3 Neither agree nor disagree
4 Somewhat disagree
5 Strongly disagree
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

J: Impact and access to digitised data

INTRO.

READ OUT IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

This next section asks about how your business’ use of digitised data affects internal processes and innovation.

Q_DATA_BENEFITS (A6 INTRO)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

In your business, how often does the acquisition, collection or analysis of data lead to…

A. More efficient internal processes
B. Innovation or new business functions

SINGLE CODE PER STATEMENT.

REVERSE SCALE FOR HALF OF RESPONDENTS, LEAVE 98 AND 99 AT BOTTOM

READ OUT

1 Always or most of the time
2 Some of the time
3 Hardly ever
4 Not at all
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_AVAILABILITY (A8)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4).

To what extent do you feel data from outside of your business has become more or less readily available to your business during the past 3 years?

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, LEAVE 98 AND 99 AT BOTTOM

READ OUT

1 A lot more readily available
2 A little more readily available
3 Availability has not changed
4 A little less readily available
5 A lot less readily available
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

B: Data infrastructure, responsibility, security and resilience

INTRO.

SHOW TO MODULE B AND IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

This section covers questions around the infrastructure your business uses to store and process data

Q_PHYSICAL_INFRASTRUCTURE

ASK IF MODULE B AND SHOW IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

Thinking about the physical infrastructure your business uses to store and process data, which of the following is currently used?

MULTICODE 1-6.

1 Servers based in your office, a different building owned by your business or your company’s own data centre
2 Servers owned by you in rented space in a data centre (not owned by your business)
3 Servers provided by an outsourced IT services company, such as Fujitsu or Capgemini
4 A public cloud provider such as Amazon Web Services, Microsoft Azure or Google Cloud Platform
5 Your own private cloud [CATI IF NEEDED OR WEB INFO BUTTON: Private cloud is a dedicated computing resource for a single tenant. The computer resource sits on a server or group of servers that only the customer can access]
6 My business’s data are held or managed by a third-party via software or a web solution
7 None of the above
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SERVER_OUTAGE

ASK IF MODULE B AND Q_PHYSICAL_INFRASTRUCTURE=2-6 (STORE DATA AWAY FROM PREMISES)

In the past year has your business been impacted by server or cloud outage or downtime? [ADD IF Q_PHYSICAL_INFRASTRUCTURE=6 This includes outages impacting access to data held or managed by a third-party via software or a web solution, or their services.]

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

C: Data protection regulation

INTRO.

SHOW IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

This next section asks you some questions related to your business’ experience of UK data protection law. As a reminder, we are not here to “check-up” on your compliance with any regulation. Your individual details and all published data will remain completely anonymous, and you won’t be contacted again in relation to this research unless you have consented to it.

Q_REGULATORY_GUIDANCE (C1)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3)

To what extent do you agree or disagree with the following statement?

“My business finds the regulatory guidance published by the Information Commissioner’s Office (ICO) clear and easy to understand.”

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, KEEP 98 AND 99 AT BOTTOM

READ OUT

1 Strongly agree
2 Somewhat agree
3 Neither agree nor disagree
4 Somewhat disagree
5 Strongly disagree
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_ICO_AWARENESS (C2)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

Which of the following statements most closely applies to your awareness of the Information Commissioner’s Office (ICO) before taking this survey?

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, LEAVE 99 AT BOTTOM

READ OUT

1 I have heard of the ICO and I know what it is
2 I have heard of the ICO, but I don’t know what it is
3 I haven’t heard of the ICO
99 DO NOT READ OUT: Prefer not to say

Q_TASK_PREVENTION (C3)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3).

Has your business been prevented from doing any of the following as a result of UK data protection law or guidance in the last 12 months?

MULTICODE OK EXCEPT 4, 98, 99.

RANDOMISE EXCEPT 4, 98,99.

READ OUT

1 Implementation of a new or significantly improved product, process or business model
2 Using or sharing data due to legal restriction under UK data protection law
3 Using or sharing data because of uncertainty that it was permitted under UK data protection law
4 None of the above
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_JOB_ROLE (C4)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3) AND EMPLOY STAFF (Q_SIZE_2=2-8).

Do you have someone in your business whose job role includes leading on Data protection compliance? (e.g. Information Commissioner’s Office compliance, wider UK data protection law compliance, awareness of other countries’ laws)

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_STAFF (C5A)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3) AND EMPLOY STAFF (Q_SIZE_2=2-8)

How many full-time equivalent members of staff does your business employ whose primary role is to undertake activities related to complying with UK data protection laws? Please include yourself in this if your primary role is to undertake such activities.

CATI: IF NEEDED OR WEB INFO BUTTON: For instance, this might include GDPR compliance, responding to Subject Access Requests, ensuring appropriate data storage processes are in place or drafting Privacy Notices.

CATI: IF NEEDED OR WEB INFO BUTTON: As an example, if you hire 2 part time members of staff who each work half a week, please count this as 1 full time equivalent

INTERVIEWER: USE BEST JUDGEMENT FOR PREFER NOT TO SAY. IF “SOFT” RESPONSE, CODE AS DON’T KNOW AND CONTINUE TO Q_DATA_STAFF_APPROX

1 Please type in number: WRITE IN NUMERIC [RANGE 0-1000]
2 DO NOT READ OUT: Around half a full-time equivalent staff member
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_STAFF_APPROX (C5B)

ASK IF DON’T KNOW EXACT NUMBER (Q_DATA_STAFF=98).

How many approximately?

SINGLE CODE.

READ OUT

1 None
2 Around half a full-time equivalent staff member
3 1 to 2
4 3 to 4
5 5 to 6
6 7 to 10
7 11 or more
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_STAFF_COMB (C5AC5BCOMB)

DUMMY VARIABLE FOR FUNCTION DO NOT ASK.

MAP Q_DATA_STAFF RESPONSES INTO Q_DATA_STAFF_APPROX SCALE AND COMBINE

Q_DATA_PROTECTION_COMPLY (C6)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3).

Has your business done any of the following in the last 12 months in order to comply with UK data protection laws?

MULTICODE OK EXCEPT 97, 98, 99.

RANDOMISE EXCEPT 11,97,98,99.

READ OUT

1 [IF EMPLOY STAFF (Q_SIZE_2=2-8)] Employed staff or outsourced to specialist staff to handle data protection requirements, either full time or as part of their role
2 [IF EMPLOY STAFF (Q_SIZE_2=2-8)] Run training for existing staff
3 Sought legal advice
4 Introduced new processes to implement data protection measures CATI: IF NEEDED OR WEB INFO BUTTON: e.g. produced a record of processing activities, implemented data retention policies]
5 [IF USE PERSONAL DATA (NOT EMPLOYEE) (Q_DATA_TYPE_DUM=2)] Introduced opt-in consent mechanisms
6 Rewritten or updated terms and conditions
7 Rewritten, updated or introduced a privacy notice
8 [IF USE COOKIES OR WEB-BASED TRACKING TECHNOLOGY (Q_COOKIE_USE=1 OR 2)] Updated how you manage cookies and tracking technologies used by your business CATI: IF NEEDED OR WEB INFO BUTTON: including how you provide users with choice and control over their preferences]
9 Purchased specialist software for data protection
10 Other (please specify) WRITE IN
97 DO NOT READ OUT: None of the above
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_COMPLIANCE_BURDEN (C13)

ASK IF USE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3).

In terms of both time spent and financial costs it has had, do you feel that the burden on your business of complying with the UK data protection laws has increased, decreased or stayed about the same in the last 12 months?

SINGLE CODE.

REVERSE SCALE FOR HALF OF RESPONDENTS, LEAVE 98 AND 99 AT BOTTOM

PROMPT TO CODE

1 Increased a lot
2 Increased slightly
3 Stayed around the same
4 Decreased slightly
5 Decreased a lot
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

D: International data flows

INTRO.

SHOW IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

This next section includes questions about any data your business transfers outside of the UK.

Q_SEND_DATA_INTERNATIONALLY (D1)

ASK IF USE DIGITISED DATA (Q_DATA_TYPE_DUM=1-4)

Does your business transfer (send or receive) data with other organisations, businesses or people based outside of the UK?

By data transfer outside of the UK, we mean personal and / or non-personal data you send to or receive from organisations, businesses or people abroad. Please exclude data which your business accesses or processes in another country (e.g. through cloud computing, web-services).

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DATA_TYPE_SENT (D1A)

ASK IF TRANSFERS DATA INTERNATIONALLY (Q_SEND_DATA_INTERNATIONALLY=1).

You say your business sends or receives data with organisations, businesses or people outside the UK, which of the following apply (select all that apply):

CATI: IF NEEDED OR WEB INFO BUTTON: Personal data refers to information that can be used to identify a specific individual. As well as name and contact details, this also includes other identifiers such as an IP address or a cookie identifier.

READ OUT 1-4. MULTICODE OK EXCEPT 98,99.

READ OUT

1 [IF Q_DATA_TYPE_DUM=1-3] We send personal data outside the UK
2 [IF Q_DATA_TYPE_DUM=4] We send non-personal data outside the UK
3 [IF Q_DATA_TYPE_DUM=1-3] We receive personal data from outside the UK
4 [IF Q_DATA_TYPE_DUM=4] We receive non-personal data from outside the UK
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_TRANSFER_REASONS

ASK IF SHARES DATA OUTSIDE OF THE UK (Q_SEND_DATA_INTERNATIONALLY=1).

Why does your business transfer (send or receive) data with other businesses, organisations or people based outside the UK?

MULTICODE OK EXCEPT 98,99.

RANDOMISE EXCEPT 9,98,99.

READ OUT

1 HR, financial, or accounting purposes CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. payroll, recruitment, invoicing, tax reporting)]
2 Supply chain management and logistics CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. shipping, inventory management)]
3 Market research or customer insight CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. surveys, focus groups, usage analytics)] GROUP 1.
4 Marketing and communications CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. advertising campaigns)] GROUP 1.
5 Customer or staff communications CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. messaging, notifications)]
6 Research and development of a product or service CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. design, testing, prototyping)]
7 Legal or regulatory reasons CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. compliance, subject access or government or legal requests)]
8 To deliver or receive goods, services, or products CATI: IF NEEDED OR WEB INFO BUTTON: (e.g. shipping goods, processing transactions, selling data directly)]
9 Other (Please specify) WRITE IN
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_TRANSFER_REGIONS (D4)

ASK IF TRANSFERS DATA INTERNATIONALLY (Q_SEND_DATA_INTERNATIONALLY=1).

Does your business transfer (send or receive) data with businesses, organisations or people based in any of the following regions?

MULTICODE OK EXCEPT 98,99.

RANDOMISE EXCEPT 98,99.

GROUP 1: KEEP 1 & 2 TOGETHER IN THAT ORDER.

GROUP 2: KEEP 4 & 5 TOGETHER IN THAT ORDER.

1 Sub-Saharan Africa GROUP 1.
2 North Africa GROUP 1.
3 Asia-Pacific
4 EU or EEA GROUP 2. CATI: IF NEEDED OR WEB INFO BUTTON: EEA is the European Economic Area of 27 EU member states as well as Iceland, Liechtenstein and Norway
5 Europe outside EU or EEA GROUP 2.
6 Middle East
7 North America
8 Latin America and Caribbean
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_TRANSFER_COUNTRIES (D5)

ASK IF TRANSFER DATA WITH REGIONS (Q_TRANSFER_REGIONS=1-8).

Please can you let me know the names of up to 10 countries that your business transfers (sends or receives) data with businesses or organisations in?

SCRIPTER: PLEASE SHOW THE FOLLOWING 4 COUNTRIES AT TOP FOLLOWED BY A-Z OF REMAINING COUNTRIES:

NB: online respondents were presented with the following 5 countries first, followed by an alphabetical list of all remaining countries. For participants completing the survey via telephone, responses were based on free recall

1 France
2 Germany
3 Italy
4 Spain
5 USA

CATI NOTE: IF RESPONDENTS ARE STRUGGLING TO NAME MULTIPLE COUNTRIES, IT IS OKAY TO MOVE TO NEXT QUESTION.

1 MANDATORY (UNLESS DON’T KNOW OR PREFER NOT TO SAY)

2-10 OPTIONAL

1 Please type in a country:
2 Please type in a country:
3 Please type in a country:
4 Please type in a country:
5 Please type in a country:
6 Please type in a country:
7 Please type in a country:
8 Please type in a country:
9 Please type in a country:
10 Please type in a country:
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_TRANSFER_PRIMARY_FUNCTION (D6)

ASK IF AT LEAST 1 COUNTRY SPECIFIED IN Q_TRANSFER_COUNTRIES=1-10

Is transferring data with any of these countries important to primary functions within your business?

MULTICODE 1-10. CARRY FORWARD RESPONSES CODED AT Q_TRANSFER_COUNTRIES=1-10.

NEW:

1 INSERT RESPONSES CODED AT Q_TRANSFER_COUNTRIES _1-10
96 Yes to all
97 None of the above
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_INT_TRANSFER_ISSUE (D7)

ASK IF TRANSFERS DATA INTERNATIONALLY (Q_SEND_DATA_INTERNATIONALLY=1)

Has your business experienced any of the following when trying to transfer (send or receive) data internationally with businesses, organisations or people?

MULTICODE OK EXCEPT 5,98,99.

RANDOMISE EXCEPT 5,98,99.

1 Issues due to cost, complexity or transparency of UK data protection law
2 Issues due to cost, complexity or transparency in a country’s or region’s local data protection law
3 Issues due to data localisation of the receiving country CATI: IF NEEDED OR WEB INFO BUTTON: A requirement that data would have to be stored or processed within that country or region as a condition for doing business
4 Issues due specifically to the cost or complexity of implementing legal safeguards to transfer personal data CATI: IF NEEDED OR WEB INFO BUTTON: E.g. Standard Contractual Clauses etc.
5 DO NOT READ OUT: None of these
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_TRANSFER_PREVENTION (D8)

ASK IF HAVE EXPERIENCED ISSUES WHEN TRANSFERRING DATA (Q_INT_TRANSFER_ISSUE=1-4)

Did your business’ experience prevent you from…

MULTICODE OK EXCEPT 4,98,99.

READ OUT

1 Transferring personal data
2 Transferring non-personal data
3 Trading with a business based outside of the UK
4 None of these
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_INT_TRANSFER_BARRIERS (D3)

ASK IF HANDLE PERSONAL OR EMPLOYEE DATA (Q_DATA_TYPE_DUM=1-3)

Thinking about the UK data protection laws that regulate international transfer of data, do they present a barrier for your business to trade with any of the following?

MULTICODE OK EXCEPT 3, 98,99.

1 Yes, within the EU or EEA CATI: IF NEEDED OR WEB INFO BUTTON: EEA is the European Economic Area of 27 EU member states as well as Iceland, Liechtenstein and Norway
2 Yes, with the rest of the world (outside the EU or EEA) CATI: IF NEEDED OR WEB INFO BUTTON: EEA is the European Economic Area of 27 EU member states as well as Iceland, Liechtenstein and Norway
3 No, they do not present a barrier to trade
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

E: International transfer mechanisms

INTRO.

SHOW IF SENDS PERSONAL DATA OUTSIDE OF UK (Q_DATA_TYPE_SENT=1).

This section is about personal data your business sends outside of the UK. We’re now going to ask you about the legal safeguards your business uses when transferring personal data outside the UK.

These might include EU Standard Contractual Clauses (SCCs) which provide GDPR-compliant safeguards for personal data sent to non-adequate countries, or adequacy decisions which allow transfers to countries recognised by the UK, such as those in the EU, without needing additional safeguards.

Q_LEGAL_SAFEGUARDS_CONFIDENCE

ASK IF SENDS PERSONAL DATA OUTSIDE THE UK (Q_DATA_TYPE_SENT=1).

How confident are you that you know which legal safeguards your business uses when transferring personal data outside the UK?

SINGLE CODE.

READ OUT

1 Very confident
2 Somewhat confident
3 Not very confident
4 Not at all confident
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_LEGAL_SAFEGUARDS_IN_PLACE

ASK IF SENDS PERSONAL DATA OUTSIDE THE UK (Q_DATA_TYPE_SENT=1).

Does your business have formal legal safeguards or policies in place for transferring personal data internationally?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_LEGAL_SAFEGUARDS_USED

ASK IF SENDS PERSONAL DATA OUTSIDE THE UK (Q_DATA_TYPE_SENT=1).

To the best of your knowledge, does your business use any of the following legal safeguards when transferring personal data outside the UK?

MULTICODE OK EXCEPT 7, 98,99.

RANDOMISE EXCEPT 5,6,7,98,99.

READ OUT

1 International Data Transfer Agreement (IDTA) CATI: IF NEEDED OR WEB INFO BUTTON: IDTAs are the UK’s new standard data protection clauses, introduced in March 2022, an Alternative Transfer Mechanism replacing EU Standard Contractual Clauses for international transfers
2 EU Standard Contractual Clauses (SCCs) CATI: IF NEEDED OR WEB INFO BUTTON: SCCs are contractual clauses providing GDPR-compliant safeguards for personal data sent to non-adequate countries
3 Binding Corporate Rules (BCRs) CATI: IF NEEDED OR WEB INFO BUTTON: BCRs are safeguards for restricted internal transfers within multinational corporate groups or related entities, such as global retailers
4 Adequacy CATI: IF NEEDED OR WEB INFO BUTTON: Adequacy decisions allow transfers to countries recognised by the UK, such as those in the EU, without needing additional safeguards
5 Exceptions for specific circumstances
6 Other (Please specify) WRITE IN
7 None of these
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SCC_VS_ADEQUACY

ASK IF TRANSFER DATA WITH EU or EEA (Q_TRANSFER_REGIONS=4) OR NAME: SWITZERLAND, JAPAN, CANADA OR USA (Q_TRANSFER_COUNTRIES=41 OR Q_TRANSFER_COUNTRIES=81 OR Q_TRANSFER_COUNTRIES=2 OR Q_TRANSFER_COUNTRIES=1) AND USE SCCs (Q_LEGAL_SAFEGUARDS_USED=2)

Has your business used SCCs instead of adequacy when transferring personal data to [ASK ONLY RELEVANT MARKETS IF CODED: the EU, the USA, Switzerland, Japan, or Canada]?

CATI: IF NEEDED OR WEB INFO BUTTON: SCCs are contractual clauses providing GDPR-compliant safeguards for personal data sent to non-adequate countries

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SCC_VS_ADEQUACY_REASONS

ASK IF HAVE USED SCCs INSTEAD OF ADEQUACY (Q_SCC_VS_ADEQUACY=1)

Why has your business used SCCs instead of adequacy when transferring personal data to [IF ONLY USA, ONLY SWITZERLAND, ONLY JAPAN or ONLY CANADA mentioned in SCCVSADEQUACY that country or those countries]?

CATI: IF NEEDED OR WEB INFO BUTTON: SCCs are contractual clauses providing GDPR-compliant safeguards for personal data sent to non-adequate countries

MULTICODE OK EXCEPT 5, 98, 99.

RANDOMISE EXCEPT 5, 98, 99.

READ OUT

1 The legal protection of SCCs
2 The simplicity or transparency of SCCs
3 The historical use of SCCs within your business
4 The type of personal data handled within your business
5 None of these
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

F: Businesses that don’t handle digitised data

SKIP SECTION F IF F1-F13 ALREADY CONTAINS ANY DATA

Q_STAFF_RECORDS (F1)

ASK IF EMPLOY STAFF AND DO NOT USE DATA (Q_SIZE_2=2-8 AND Q_DATA_CHECK=1).

Does your business keep records on its staff, such as addresses, performance, bank details?

MULTICODE OK EXCEPT 3, 98,99.

1 Yes – digitally stored
2 Yes – not stored digitally
3 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_WEBSITE_TRACKING (F3)

ASK: IF BUSINESS DOES NOT USE DATA AND HAS A WEBSITE (Q_DATA_CHECK=1 AND Q_WEBSITE=1)

You said your business has a website. Does your business track visitors to its website, for example, via cookies?

MULTICODE OK EXCEPT 3, 98, 99.

1 We collect website analytics, which includes information about visitors (e.g. gender, age, IP address)
2 We collect analytics, but it gives no information about individual visitors (e.g. only website traffic data)
3 We do not collect analytics
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_PRODUCT_MARKETING (F4)

ASK IF BUSINESS DOES NOT USE DATA (Q_DATA_CHECK=1)

Does your business market its products or services?

MULTICODE OK EXCEPT 3, 98,99.

1 Yes - online (e.g. emails, AdWords, advertising)
2 Yes - offline (e.g. leaflets, letters, market stalls)
3 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_TARGETED_MARKETING (F5)

ASK IF BUSINESS DOES NOT USE DATA AND MARKETS PRODUCTS OR SERVICES (Q_DATA_CHECK=1 AND Q_PRODUCT_MARKETING=1-2)

Is any of your business’s marketing targeted (i.e. directed towards audiences with certain traits)?

SINGLE CODE.

1 [IF ONLINE (Q_PRODUCT_MARKETING=1)] Yes, our online marketing
2 [IF OFFLINE (Q_PRODUCT_MARKETING=2)] Yes, our offline marketing
3 [IF ONLINE AND OFFLINE (Q_PRODUCT_MARKETING=1 AND 2)] Yes, both our online and offline marketing
4 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_MARKETING_STORED (F6)

ASK IF BUSINESS DOES NOT USE DATA AND MARKETS PRODUCTS OR SERVICES (Q_DATA_CHECK=1 AND Q_PRODUCT_MARKETING=1-2)

Does your business collect and store data digitally on these marketing activities?

MULTICODE OK EXCEPT 3, 98,99.

1 Yes, we store personal data on this (e.g. age, email addresses)
2 Yes, we store data but it is not personal data (i.e. cannot identify an individual)
3 No, we do not collect data
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

READ OUT IF DIGITALLY STORE DATA OR ANY COLLECT WEBSITE ANALYTICS OR STORE ANY DATA (Q_STAFF_RECORDS=1 OR Q_WEBSITE_TRACKING=1 OR 2, OR Q_MARKETING_STORED=1 OR 2)

It sounds like your business handles, transfers, or uses data in digital form so we would like to ask about your business’s use of digitised data.

ROUTE TO AFTER Q_WEBSITE_MANAGED.

Q_SOLD_DIRECTLY (F7)

ASK IF BUSINESS DOES NOT USE DATA (Q_DATA_CHECK=1).

Does your business sell directly to customers?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_CARD_PAYMENTS (F8)

ASK IF BUSINESS DOES NOT USE DATA AND SELLS TO CUSTOMERS ( Q_DATA_CHECK=1 AND Q_SOLD_DIRECTLY=1)

Does your business accept card payments, e.g. debit or credit cards?

SINGLE CODE.

1 Yes – but we have no access to or do not process the data that arises from the payments
2 Yes – and we store or process the data that arises from the payments
3 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_DIGITAL_INFO (F9)

ASK IF BUSINESS DOES NOT USE DATA AND SELLS TO CUSTOMERS (Q_DATA_CHECK=1 AND Q_SOLD_DIRECTLY=1)

Does your business keep digital information on its customers, for example addresses or delivery information?

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

READ OUT IF STORE PAYMENTS DATA OR KEEPS DIGITAL CUSTOMER INFORMATION (Q_CARD_PAYMENTS=2 OR Q_DIGITAL_INFO=1).

It sounds like your business handles, transfers, or uses data in digital form so we would like to ask about your business’s use of digitised data.

ROUTE TO AFTER Q_WEBSITE_MANAGED.

Q_TRACK_CUSTOMERS (F10)

ASK IF BUSINESS DOES NOT USE DATA (Q_DATA_CHECK=1 AND Q_DIGITAL_INFO=2 OR 98)

READ OUT.

It sounds like your business doesn’t handle or use any data in digital form. We would now like to ask you about how your business handles information.

Could you tell us about how you keep track of your customers’ details. This could be their phone number, the work you’ll do or have done for them, how much they owe you, or anything else about your customers.

OPEN END.

[IF UNSURE OR DON’T KNOW, PROMPT: Do you use a diary, pen and paper, your phone, your memory, or some combination of these? Please give any details you can]

[IF PREFER NOT TO SAY, RECORD “prefer not to say” AND MOVE TO SECTION G]

Q_TRACK_EMPLOYEES (F12)

ASK IF BUSINESS DOES NOT USE DATA (Q_DATA_CHECK=1) AND EMPLOYS STAFF (Q_SIZE_2=2-8).

READ OUT.

Could you tell us about how you keep track of your employees’ details. This could be their address, how much they’re paid, their pension etc, anything used for HR or communications purposes.

OPEN END.

[IF UNSURE OR DON’T KNOW, PROMPT: Do you use a diary, pen and paper, your phone, your memory, or some combination of these? Please give any details you can]

[IF PREFER NOT TO SAY, RECORD “prefer not to say” AND MOVE TO SECTION G]

G: Business demographics

INTRO.

SHOW TO ALL.

We just have a couple of questions left about your business…

Q_ANNUAL_TURNOVER (G1)

ASK ALL

What is your business’ annual turnover [WEB: (in £)]?

CATI INSTRUCTION: PROBE FOR BEST ESTIMATE AND RECORD NUMBER.

INTERVIEWER: USE BEST JUDGEMENT FOR PREFER NOT TO SAY. IF “SOFT” RESPONSE, CODE AS DON’T KNOW AND CONTINUE TO Q_ANNUAL_TURNOVER_APPROX

OPEN ENDED

1 Please type in number WRITE IN NUMERIC
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_ANNUAL_TURNOVER_APPROX (G2)

ASK IF DON’T KNOW (Q_ANNUAL_TURNOVER=98)

Please could you estimate the approximate range that your business’ annual turnover falls into?

CATI: SINGLE CODE ANSWER INTO THE CORRECT BAND. PROBE AS APPROPRIATE.

WEB: SINGLE CODE

1 Less than £1,000
2 £1,000 to £4,999
3 £5,000 to £9,999
4 £10,000 to £19,999
5 £20,000 to £29,999
6 £30,000 to £39,999
7 £40,000 to £49,999
8 £50,000 to £84,999
9 £85,000 to £99,999
10 £100,000 to £249,999
11 £250,000 to £499,999
12 £500,000 to £999,999
13 £1m to £4,999,999
14 £5m to £9,999,999
15 £10 million or more
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SECTOR_CHECK (G3)

ASK ALL

Is [INSERT SIC DESCRIPTION FROM SAMPLE] the correct broad classification for your business?

INTERVIEWER INSTRUCTION: USE BEST JUDGEMENT FOR PREFER NOT TO SAY.IF “SOFT” RESPONSE, LOG AS DON’T KNOW AND CONTINUE TO Q_SECTOR_MAINACTIVITY

SINGLE CODE.

1 Yes
2 No
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_SECTOR_MAIN_ACTIVITY (G4)

ASK IF SIC IS NOT CORRECT OR DON’T KNOW (Q_SECTOR_CHECK=2 OR 98).

How would you describe the main activity of this business?

CATI: INTERVIEWER PROBE FOR THE FOLLOWING – START WITH FIRST PROBE AND ONLY USE THE OTHERS IF NECESSARY TO GET CLEAR INFORMATION.

WEB TEXT: You might want to think about the following:

• What would you type into a search engine to find a business like yours online?
  

• What is the main product or service of this business?
  

• What exactly is made or done?

1 Please write in WRITE IN
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_INTERNATIONAL_TRADE (G5)

ASK ALL

Has your business carried out any international trade with businesses based in the following, in the last 12 months? By international trade, we mean all imports or international purchases as well as exports or international sales.

MULTICODE OK EXCEPT 3,98,99.

READ OUT

1 The EU
2 Rest of the World
3 No, we have only traded within the UK in the last 12 months
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

Q_YEARS_TRADING (G6)

ASK ALL.

For how many years has the business been trading?

SINGLE CODE.

READ OUT

1 Less than 1 year
2 1 to 3 years
3 4 to 10 years

4 More than 10 years
98 DO NOT READ OUT: Don’t know
99 DO NOT READ OUT: Prefer not to say

H: Thank you and close

INTRO.

Thank you very much for taking the time to [CATI: speak to us] [WEB: complete this survey] today. Now just some administrative questions before we finish.

Q_RECONTACT_QUAL (H1)

ASK ALL.

As part of this research, we may conduct some interviews to further explore some of the answers you gave today. It would involve an Ipsos researcher calling you at a time convenient to you. We would pay you £60 as a thank you for your time, and the interview would last 45-60 minutes. Would you be willing to be contacted by Ipsos before the end of 2026 to discuss taking part in a follow-up interview?

SINGLE CODE.

1 Yes
2 No

Q_RECONTACT (H2)

ASK ALL.

And would you be willing for us to call you back in the next 6-9 months regarding:

MULTICODE OK EXCEPT 3.

1 This particular study – if we need to clarify any of the information
2 Other research on this topic that may be relevant to you
3 Neither of these

Q_RECONTACT_DETAILS (H3)

ASK IF CONSENT TO RECONTACT (Q_RECONTACT_QUAL=1 OR Q_RECONTACT=1).

And could I just check your name, job title and [NUMBER] is the best number to call you on?

CATI: INTERVIEWER NOTE: TAKE DOWN NAME, SURNAME AND JOB TITLE WITHOUT PREFIXES (MR, MRS ETC.)

NAME (COPY OVER FROM CATI_INTRO OR SAMPLE IF AVAILABLE)

1 Write in WRITE IN
99 DO NOT READ OUT: Prefer not to say

JOB TITLE (COPY OVER FROM CATI_INTRO OR SAMPLE IF AVAILABLE)

1 Write in WRITE IN
99 DO NOT READ OUT Prefer not to say 1 Yes – correct number
2 No - write in number WRITE IN
99 DO NOT READ OUT Prefer not to say

Q_DATA_LINKAGE (H4)

ASK ALL

For research and statistical purposes only, DSIT would like to link your answers to other information, such as other survey data sets, they hold so they can further analyse the survey. [IF EMPLOY STAFF (Q_SIZE_2=2-8) ADD: Your responses will remain completely confidential.] Are you happy for DSIT to link your survey responses to other information?

SINGLE CODE.

1 Yes
2 No

Q_CHARITY_DONATION (H5)

ASK IF CATI AND 250 OR MORE EMPLOYEES ON SAMPLE

As promised, we will make a £15 charity donation on your behalf as a thank you for taking part. We have 3 charities for you to choose from:

• NHS Charities Together Appeal
  

• The NSPCC
  

• Samaritans

CATI: READ OUT IF NECESSARY

• The NHS Charities Together Appeal brings together over 250 charitable organisations that support the NHS in England, Scotland and Wales.
  

• The NSPCC, or National Society for the Prevention of Cruelty to Children, is a charity campaigning and working in child protection in the United Kingdom.
  

• Samaritans provides emotional support to anyone in emotional distress, struggling to cope, or at risk of suicide throughout the United Kingdom and Ireland.

SINGLE CODE.

1 NHS Charities Together
2 NSPCC
3 Samaritans
4 Prefer not to donate

THANK RESPONDENT AND CLOSE INTERVIEW.

Appendix B: Initial and reminder emails

INITIAL INVITATION EMAIL

Subject: UK Business Data Survey 2025-2026

IPSOS AND DSIT LOGOS INCLUDED AS LETTERHEADS

Subject: UK Business Data Survey 2025-2026

Dear [Contact name from sample, if none then default to Sir or Madam],

We are writing to you on behalf of the Department for Science, Innovation and Technology (DSIT) part of His Majesty’s Government, who have commissioned Ipsos to undertake research on how businesses use their data. We are inviting your business, [company name], to take part.

The survey gives businesses in the [insert sector from sample frame] sector in [insert word ‘the’ depending on sample frame] [insert region from sample frame] the opportunity to influence government policy on data, and the advice, guidance and support given to businesses like yours. [if large business show] Ipsos will make a £15 charity donation on your behalf upon completion of the survey.

The survey should take around 15-20 minutes to complete, depending on the extent of your data use. If you would like to take part online, you can take part immediately, using the following link:

[INSERT SURVEY LINK]

Please be assured that any information you provide will only be used for research purposes. All your answers will be kept completely confidential. Participation is voluntary and you can withdraw from the research at any point.

If you would like to know more about how your own data will be handled, click here to view Ipsos privacy policy. DSIT’s privacy policy can be found here.

If you have any questions, please contact ukbusinessdatasurvey@ipsosresearch.com.

Thank you in advance for your participation.

Aris Xylouris

Head of Data Policy Analysis, DSIT

Allan Simpson

Project Director, Ipsos

REMINDER EMAIL

Subject: A reminder to take part in the UK Business Data Survey 2025-2026

IPSOS AND DSIT LOGOS INCLUDED AS LETTERHEADS

Dear [Contact],

[IF ABANDONED] Thank you for starting the UK Business Data Survey. There is still time to complete the survey on the following link:

[IF NOT STARTED] We recently invited you to take part in the research we are conducting on behalf of the Department for Science, Innovation and Technology (DSIT) to understand how businesses use their data. There is still time to complete the survey on the following link:

[INSERT SURVEY LINK]

Your input will help DSIT understand:

• The significance of data to [business size from sample] businesses like yours

• How data is used in the [business sector] industry like yours

• How data is used to drive the economy

• How data regulations may affect your business

The survey should take no longer than 20 minutes to complete online, depending on the extent of your data use.

Please be assured that any information you provide will only be used for research purposes. All your answers will be kept completely confidential. Participation is voluntary and you can withdraw from the research at any point.

If you would like to know more about how your own data will be handled, click here to view Ipsos privacy policy. DSIT’s privacy policy can be found here.

If you have any questions, please contact ukbusinessdatasurvey@ipsosresearch.com.

Thank you in advance for your participation.

Aris Xylouris

Head of Data Policy Analysis, DCMS

Allan Simpson

Project Director, Ipsos

Appendix C: Cognitive interview guide

Probes for all questions

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. FOR QUESTIONS WITH ADDITIONAL INFORMATION: Would you need the additional information to answer this question?

5. How clear are the answer options for this question?

S: Screening

CHECK FIRST THAT THE BUSINESS HAS A WEBSITE

WEBCOOKIENEW_1

ASK IF HAVE A WEBSITE

How is your business’ website managed?

SINGLE CODE. RANDOMISE 1-3.

1 Managed entirely in-house GROUP 1.
2 Managed in-house using a platform provider GROUP 1.
3 Managed by an external web developer or platform
4 Don’t know [DON’T READ OUT]
5 Prefer not to say [DON’T READ OUT]

PROBE (QUESTION FROM LAST WAVE):

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How clear are the answer options for this question?

A: Data Handling and use

Q_COLLECT_DATA

ASK IF USE DIGITISED DATA

Does your business acquire or collect data from other businesses or organisations?

SINGLE CODE

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE (QUESTION SAME AS LAST WAVE):

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

PURCHASEDDATANEW

ASK IF USE DIGITISED DATA

Did your business purchase data in the last 12 months?

SINGLE CODE

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

FREESOURCESNEW

ASK IF USE DIGITISED DATA

Did your business acquire or collect any free or open data in the last 12 months?

[IF NEEDED : Free or open data is any data that your business does not pay for, such as publicly available datasets from government departments, open data platforms, regulators, local authorities, or academic institutions.]

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Would you need the ‘IF NEEDED’ additional information to answer this question?

5. How clear are the answer options for this question?

6. How is the flow of these questions? Does the respond equate purchasing data with acquiring or collecting data?

Q_COOKIE_USE (A1_3)

ASK IF USE PERSONAL OR EMPLOYEE DATA

Does your business acquire or collect personal data through the use of cookies or similar technology placed on people’s connected devices?

[IF NEEDED : Cookies are small text files placed on a user’s device to store information. Similar technologies may include app-based tracking.]

MULTICODE 1-2.

1 [ASK IF HAVE A WEBSITE] Yes - we use website cookies
2 Yes [IF HAS WEBSITE ADD - we use app-based tracking technology]
3 No
4 Don’t know [DON’T READ OUT]
5 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Would you need the ‘IF NEEDED’ additional information to answer this question? Do people understand what cookies are?

5. How clear are the answer options for this question?

Q_COOKIE_USE_WHY (A1_4)

CHECK RELEVANCE TO ASK IN LIGHT OF A1_3 ANSWER

ASK IF ACQUIRE PERSONAL DATA THROUGH COOKIES OR SIMILAR TECHNOLOGY OR (A1_3=1 OR A1_3=2).

For which of the following reasons does your business collect data using cookies or similar technology placed on people’s connected devices?

MULTICODE 1-7. RANDOMISE 1-6.

1 To provide an online service which the user has requested
2 To facilitate the transmission of communications over a network
3 Installing necessary security updates
4 Ensuring user preferences are followed
5 Collecting information for statistical purposes about how website or service is used with a view to making improvements
6 To facilitate marketing and advertising
7 Other
8 We don’t use the data we collect using cookies
9 Don’t know [DON’T READ OUT]
10 Prefer not to say [DON’T READ OUT]

PROBE (QUESTION SAME AS LAST WAVE):

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How clear are the answer options for this question?

5. For those that answer “7. Other”, probe to see whether other answer options are unclear or whether additional answer codes can be included.

Q_SHARE_DATA (A2)

ASK IF USE DIGITISED DATA

Does your business share data outside of your organisation?

[IF NEEDED: By sharing we mean any movement of data out of your business to other organisations or individuals, such as selling, publishing or sharing for free.]

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE (QUESTION SAME AS LAST WAVE):

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Would you need the ‘IF NEEDED’ additional information to answer this question?

5. How clear are the answer options for this question?

Q_DATA_SOLD (NEW)

ASK IF USE DIGITISED DATA

Did your business sell data in the last 12 months?

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Does this question and the prior questions on purchasing data seem repetitive?

Q_FREE_DATA (NEW)

ASK IF USE DIGITISED DATA

Did your business provide or share data for free in the last 12 months?

[IF NEEDED : This could include sharing data with partners, industry bodies or customers, publishing data on public platforms, or making data available for public use under an open licence.]

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Would you need the ‘IF NEEDED’ additional information to answer this question?

5. Does the flow of these questions make sense? Does the participant equate providing or sharing data with selling data?

Q_SHARE_DATA_WHY (NEW)

INTERVIEWER CHECK RESPONSES TO LAST 3 QUESTIONS BEFORE ASKING.

ASK A3NEW AND A3NEWNONMERGED – ROTATE ORDER OF ASKING

ASK IF SHARE DATA (A2=1) OR IF HAVE SOLD DATA (DATASOLDLAST12MONTHS=1) OR IF HAVE PROVIDED OR SHARED DATA (FREEDATASHAREDLAST12MONTHS=1).

For what reasons does your business share data outside your organisation?

MULTICODE 1-6. RANDOMISE 1-5.

1 Business operations and logistics [IF NEEDED: (e.g. HR, accounts, supply chain)]
2 Marketing and communications [IF NEEDED: (e.g. customer insight, advertising, staff or customer messaging)]
3 Research and development of a product or service [IF NEEDED: (e.g. technical research, design, testing, prototyping)]
4 Legal or regulatory reasons [IF NEEDED: (e.g. compliance, subject access or government or legal requests)]
5 To deliver or receive goods, services, or products [IF NEEDED: (e.g. shipping goods, processing transactions, selling data directly)]
6 Other
7 None of the above
8 Don’t know [DON’T READ OUT]
9 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. FOR CODES WITH ADDITIONAL INFORMATION: Would you need the additional information to answer this question?

5. How clear are the answer options for this question?

A3NEWNONMERGED

ASK IF SHARE DATA (A2=1) OR IF HAVE SOLD DATA (DATASOLDLAST12MONTHS=1) OR IF HAVE PROVIDED OR SHARED DATA (FREEDATASHAREDLAST12MONTHS=1).

For what reasons does your business share data outside your organisation?

MULTICODE 1-9. RANDOMISE 1-8.

GROUP 1: KEEP 3 & 4 TOGETHER IN THAT ORDER.

1 HR, financial, or accounting purposes [IF NEEDED : (e.g. payroll, recruitment, invoicing, tax reporting)]
2 Supply chain management and logistics [IF NEEDED : (e.g. shipping, inventory management)]
3 Market research or customer insight [IF NEEDED : (e.g. surveys, focus groups, usage analytics)] GROUP 1.
4 Marketing and communications [IF NEEDED : (e.g. advertising campaigns)] GROUP 1.
5 Customer or staff communications [IF NEEDED : (e.g. messaging, notifications)]
6 Research and development of a product or service [IF NEEDED : (e.g. design, testing, prototyping)]
7 Legal or regulatory reasons [IF NEEDED : (e.g. compliance, subject access or government or legal requests)]
8 To deliver or receive goods, services, or products [IF NEEDED : (e.g. shipping goods, processing transactions, selling data directly)]
9 Other
10 None of the above
11 Don’t know [DON’T READ OUT]
12 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. FOR CODES WITH ADDITIONAL INFORMATION: Would you need the additional information to answer this question?

5. How clear are the answer options for this question?

Q_ANALYSE_DATA (A4)

ASK IF USE DIGITISED DATA

Does your business analyse data (whether personal, non-personal or in combination) to generate new insights or knowledge? (e.g. creation of, or improvement to, services and products)

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

INTERVIEWER TO CHECK ANSWERS FROM A4 – TO POTENTIALLY ASK AS A HYPOTHETICSL IF A4=2

Q_AI_BIZ_DATA_USE_PRE

ASK IF USE DIGITISED DATA

How would your business feel, if at all, about the business’ data being used to help it train Artificial Intelligence systems?

1 Very comfortable
2 Somewhat comfortable
3 Somewhat uncomfortable
4 Very uncomfortable
5 Don’t know [DON’T READ OUT]
6 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How did the respondent interpret this question? Were they answering on behalf of their business, or as their own position?

AIPOLICY

ASK IF USE DIGITISED DATA (S5DUM=1-4).

Does your business have a formal policy or guidelines regarding the use or development of Artificial Intelligence?

SINGLE CODE

1 Yes, a formal written policy
2 Yes, an informal policy

3 No
4 Don’t know [DON’T READ OUT]
5 Prefer not to say [DON’T READ OUT]

AIPOLICYDATAUSE

ASK IF HAVE AI POLICY (AIPOLICY=1-2).

Does your AI policy include guidance on AI access to business data and files?

SINGLE CODE

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

Q_AI_TRAINING (A5_REVISED)

INTERVIEWER – CHECK IF BUSINESS USES AI TECHNOLOGIES OR IS AT LEAST FAMILIAR WITH AI TECHNOLOGIES BEFORE ASKING

Does your business use data to develop, train, or improve any of the following?

MULTICODE 1–2. RANDOMISE 1-2.

1 Artificial Intelligence (e.g. machine learning models, LLMs)
2 Automated Decision-Making systems (e.g. fully automated business rules or scoring or detection systems)
3 No, we don’t use data for these purposes
4 Don’t know [DON’T READ OUT]
5 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How clear are the answer options for this question? Can the respondent differentiate between codes 1 and 2?

Q_INTEGRATED_AI (NEW)

ASK IF USE AI TECHNOLOGIES

Are any Artificial Intelligence tools used by your business integrated with your systems?

[IF NEEDED : This could include tools like Microsoft Copilot in Microsoft 365, AI built into CRM or finance systems, or AI features in workflow or productivity platforms.]

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. FOR QUESTIONS WITH ADDITIONAL INFORMATION: Would you need the additional?

5. Does the respondent understand what “artificial intelligence tools” are?

Q_AI_BIZ_DATA_USE_POST

ASK IF USE DIGITISED DATA

Would you want your business’ data to be used for AI training?

SINGLE CODE.

1 Very comfortable
2 Somewhat comfortable
3 Not very comfortable
4 Not at all comfortable
5 Don’t know [DON’T READ OUT]
6 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How clear are the answer options for this question? Is the scale relevant?

AIREGS1

ASK IF USE DIGITISED DATA (S5DUM=1-4).

Thinking about the use and development of Artificial Intelligence (AI), to what extent do you agree or disagree with the following statement?

“My business finds the regulatory guidance on AI clear and easy to understand.”

[IF NEEDED: Regulatory guidance for AI includes advice from authorities to help anyone follow best practices or principles when using or developing AI.]

SINGLE CODE. REVERSE SCALE (1-5).

1 Strongly agree
2 Somewhat agree
3 Neither agree nor disagree
4 Somewhat disagree
5 Strongly disagree
6 Don’t know [DON’T READ OUT]
7 Prefer not to say [DON’T READ OUT]

DATASERVICESPROVIDEDNEW

ASK IF USE DIGITISED DATA

Does your organisation provide any data or analytics products, services, tools or technologies to other organisations?

SINGLE CODE.

1 Yes, it is the main activity
2 Yes, it is a supporting activity
3 No
4 Don’t know [DON’T READ OUT]
5 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How clear are the answer options for this question? Can the respondent differentiate between codes 1 and 2?

5. Does the respondent understand the terms in the question?

D: International data flows

Q_TRANSFER_COUNTRIES (D5)

INTERVIEWER CHECK WHETHER THE BUSINESS TRANSFERS DATA INTERNATIONALLY (IN GENERAL AND THEN PERSONAL DATA) BEFORE ASKING THE REMAINING QUESTIONS EITHER IN DETAIL OR MORE HYPOTHETICALLY

ASK IF TRANSFER DATA INTERNATIONALLY

Please can you let me know the names of up to 10 countries that your business transfers (sends or receives) data with businesses or organisations in?

1 MANDATORY (UNLESS DON’T KNOW OR PREFER NOT TO SAY).

2-10 OPTIONAL.

1 Please type in a country:
2 Please type in a country:
3 Please type in a country:
4 Please type in a country:
5 Please type in a country:
6 Please type in a country:
7 Please type in a country:
8 Please type in a country:
9 Please type in a country:
10 Please type in a country:
11 Don’t know [DON’T READ OUT]
12 Prefer not to say [DON’T READ OUT]

DO NOT PROBE – COLLECT ANSWERS AND MOVE TO D6:

Q_TRANSFER_PRIMARY_FUNCTION (D6)

ASK IF AT LEAST 1 COUNTRY SPECIFIED IN D5=1-10.

Is transferring data with any of these countries important to primary functions within your business?

MULTICODE 1-N. CARRY FORWARD RESPONSES CODED AT D5=1-10.

NEW:

1 INSERT RESPONSES CODED AT D5_1-10
996 Yes, to all
999 None of the above
998 Don’t know [DON’T READ OUT]
997 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Does the respondent understand what is meant by primary functions?

Q_INT_TRANSFER_BARRIERS (D3)

ASK IF HANDLE PERSONAL OR EMPLOYEE DATA

Thinking about the UK data protection laws that regulate international transfer of data, do they present a barrier for your business to trade with any of the following?

MULTICODE 1-2.

1 Yes, within the EU or EEA
2 Yes, with the rest of the world (outside the EU or EEA)
3 No, they do not present a barrier to trade
4 Don’t know [DON’T READ OUT]
5 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4 Is the respondent aware of the UK data protection laws mentioned?

E: International transfer mechanisms

INTRO. INTERVIEWER IF NEEDED CHECK (AGAIN) IF BUSINESS SENDS PERSONAL DATA OUTSIDE THE UK BEFORE ASKING IN DETAIL OR MORE HYPOTHETICALLY

READ OUT

This section is about personal data your business sends outside of the UK. We’re now going to ask you about the legal safeguards your business uses when transferring personal data outside the UK.

These might include EU Standard Contractual Clauses (SCCs) which provide GDPR-compliant safeguards for personal data sent to non-adequate countries, or adequacy decisions which allow transfers to countries recognised by the UK, such as those in the EU, without needing additional safeguards.

DO NOT PROBE – FOR CONTEXT ONLY

Q_LEGAL_SAFEGUARDS_CONFIDENCE

ASK IF SENDS PERSONAL DATA OUTSIDE THE UK

How confident are you that you know which legal safeguards your business uses when transferring personal data outside the UK?

SINGLE CODE.

1 Very confident
2 Somewhat confident
3 Not very confident
4 Not at all confident
5 Don’t know [DON’T READ OUT]
6 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Are respondents familiar with the term “legal safeguards”?

Q_LEGAL_SAFEGUARDS_IN_PLACE

ASK IF SENDS PERSONAL DATA OUTSIDE THE UK

Does your business have formal legal safeguards or policies in place for transferring personal data internationally?

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. Is this question viewed by the respondent as a compliance question? Does this skew them to “yes”

5. Does the respondent have a good understanding of the safeguards in place?

Q_LEGAL_SAFEGUARDS_USED

ASK IF SENDS PERSONAL DATA OUTSIDE THE UK

Does your business use any of the following legal safeguards to transfer personal data to businesses, organisations or people based outside of the UK?

READ OUT 1-5. MULTICODE 1-6.

1 International data transfer agreement (IDTA) [IF NEEDED : IDTAs are the UK’s new standard data protection clauses, an Alternative Transfer Mechanism replacing EU Standard Contractual Clauses for international transfers]
2 EU Standard Contractual Clauses (SCCs) [IF NEEDED : SCCs are contractual clauses providing GDPR-compliant safeguards for personal data sent to non-adequate countries]
3 Binding Corporate Rules (BCRs) [IF NEEDED : BCRs are safeguards for restricted internal transfers within multinational corporate groups or related entities, such as global retailers]
4 Adequacy [IF NEEDED : Adequacy decisions allow transfers to countries recognised by the UK, such as those in the EU, without needing additional safeguards]
5 Exceptions for specific circumstances
6 Other [PLEASE SPECIFY]
7 None of these
8 Don’t know [DON’T READ OUT]
9 Prefer not to say [DON’T READ OUT]

DO NOT PROBE – ASKED FOR CONTEXT FOR SCCVSADEQUACY ONLY

Q_SCC_VS_ADEQUACY

ASK IF TRANSFER DATA WITH EU or EEA, SWITZERLAND, JAPAN, CANADA OR USA AND USE SCCs (E1=2)

Has your business used SCCs instead of adequacy when transferring personal data to the [ASK ONLY RELEVANT MARKETS IF CODED EARLIER: EU, USA, Switzerland, Japan, or Canada]?

SINGLE CODE.

1 Yes
2 No
3 Don’t know [DON’T READ OUT]
4 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

Q_SCC_VS_ADEQUACY_REASONS

ASK IF HAVE USED SCCs INSTEAD OF ADEQUACY (SCCVSADEQUACY=1)

Why has your business used SCCs instead of adequacy when transferring personal data to those countries?

MULTICODE 1-4.

1 The legal protection of SCCs
2 The simplicity or transparency of SCCs
3 The historical use of SCCs within your business
4 The type of personal data handled within your business
5 None of these
6 Don’t know [DON’T READ OUT]
7 Prefer not to say [DON’T READ OUT]

PROBE:

1. What did you understand by this question? How did you interpret it?

2. How easy or difficult was this to answer? What makes you say that?

3. Any points of confusion? Any text that didn’t make sense?

4. How clear are the answer options for this question?

Appendix D: Further information

The Department for Science, Innovation and Technology would like to thank the following people for their work in the development and carrying out of this research and for their work compiling this report:

• Allan Simpson, Ipsos

• Jacob Scalco, Ipsos

• Jono Roberts, Ipsos

This work was carried out in according with the requirements of the international quality standard for Market Research, ISO 20252.