Tell clients how you protect their data

Key takeaways

A data security statement tells clients, in plain words, how you protect the information they give you: where it is stored, who can access it, how it is protected and what certifications you hold. It reassures B2B buyers who must check suppliers. Describe your controls in general terms, and never reveal details that would help an attacker.

• 43% of UK businesses reported a breach or attack in a year (DSIT, 2025/2026).
• Say where data is stored, who can access it and how it is protected.
• Show certifications such as Cyber Essentials, if you hold them.
• Keep technical specifics private; they help attackers.

What is a data security statement?

A data security statement is a short, public explanation of how you protect client information. It differs from a privacy notice, which explains what personal data you collect and why. Global Bridge Labs (GBL) sees B2B buyers increasingly ask for both, because they must check suppliers who handle their data.

• What information should every business website have?
• What a UK website privacy policy must include

Why do buyers care?

Buyers care because their own obligations extend to suppliers. The DSIT Cyber Security Breaches Survey 2025/2026 found 43% of UK businesses reported a breach or attack in the previous year. A client sharing customer records, finance data or designs wants to know the supplier is not the weak link.

• Website security for small businesses: the basics

What should the statement include?

Cover where data is stored, including the country, who can access it and how access is controlled, how data is protected in transit and at rest, how long you keep it, how you handle incidents, and any certifications you hold, such as Cyber Essentials. Name a contact for security questions.

• Which company policies to publish on your website

What should you keep private?

Keep specific product versions, network details, internal procedures and named administrators private. The statement should describe controls in general terms: 'multi-factor authentication on all systems' rather than which tool and how it is configured. Share more detail under contract if a client needs it.

• Inaccurate information on your website: the legal risk

Does offshore processing need mentioning?

Yes. If client data is processed outside the UK, say so and explain the safeguards, because UK GDPR has rules on international transfers and clients will need to know. Being open about it early prevents a difficult conversation during due diligence.

• A supplier information page: invoices and onboarding

When is a statement overkill?

A separate statement is overkill for businesses that hold little beyond names and email addresses from enquiries. In that case, the privacy notice covers it. It earns its place when you handle client data as part of the service, such as accounts, records or IT systems.

What does this look like in practice?

A pattern we see in outsourcing and professional services: every new client sends a security questionnaire with the same opening questions. A public statement that answers the first ten, plus a 'request our security pack' link, speeds up onboarding and signals maturity.

• See client work
• Website Design & Development for UK businesses

Data security statement checklist

• Say where data is stored.
• Explain access controls in general terms.
• State retention periods.
• Describe incident handling.
• List certifications you hold.
• Name a security contact.

• An equality and diversity policy on your website

Next step

Take the first ten questions from your last client security questionnaire. Answer them in plain words and publish the answers.