We have developed key policies that provide guidance to staff and suppliers and provide clear expectations on our standards and commitments.

Our Governance

Governance of information security

Information security at Big Yellow Group PLC is governed at Board level. Executive responsibility sits with the Chief Financial Officer, who manages oversight of information security and cyber risk and reports directly on this subject to the Board. The Board as a whole retains ultimate accountability for information security, and it is included in the Group's principal risk register, which the Board and Audit Committee review regularly.

Day-to-day delivery is led by the Head of IT, who is responsible for IT operations, information security, and compliance. The Head of IT reports to the CFO on security posture, incidents, risk treatment, and compliance activity, including Cyber Essentials certification, vulnerability management, and incident response. Material security incidents and significant risks are escalated to the CFO and, where appropriate, to the Board.

Board briefings

The Board and Committee receives an information security update from the Head of IT through the formal Board papers submitted ahead of each bi-monthly scheduled Board meeting, and the Head of IT meets the Board in person once a year.

Board skills

No members of the Board currently hold specialist information security or cyber security qualifications or experience. The Board addresses this through clear delegation and expert reporting.

Executive responsibility for information security sits with the CFO, who is supported by the Head of IT. The Head of IT has 26 years' experience with the Group and long-standing expertise in enterprise IT and information security.

External certification

Big Yellow Group PLC holds the following externally assessed security certifications:

• IASME Cyber Essentials, a UK Government-backed scheme certified through IASME. It covers the core technical controls: firewalls, secure configuration, user access control, malware protection, and security update management. It is renewed annually.
• IASME Cyber Assurance Level 1 & Level 2, a governance-based standard. It assesses information security management, risk assessment, policies, incident response, business continuity, and data protection, and it complements the technical controls covered by Cyber Essentials.

Security training

All employees, including part-time and temporary staff, complete information security and data protection training on joining. Store staff, Area Managers, Customer Support and National Customers have bitesize bespoke training on a quarterly basis. Head Office staff complete an annual training course. We also run phishing simulations, hold incident response exercises and publish regular blog posts.

Third-party risk

Suppliers with access to our systems or customer data are security-assessed before appointment. We ensure that a vendor assessment, asset assessment and depending on the type of supplier: either a GDPR Security of Processing Assessment or a GDPR Record of Processing Assessment, are carried out. This is reviewed annually with the Business Owner of the relationship or when a change has occurred in the contract or business requirement. Each quarter we review Security Scorecard ratings for our five highest-risk suppliers in terms of data. No third-party incident affected our data in FY25/26.

Our Environment       

Energy target

Our Energy Management Target is to install improved lighting and heating controls in at least 20 stores a year, reducing energy consumption at each upgraded store by at least 20%.

Water stress          

Our stores use very little water. It is used only for tearooms and toilets, all from mains supply, totalling 21,606 m³ in FY2026. Many of our stores are in London and the South East, which the Environment Agency classes as seriously water stressed. We have considered the risks to water availability, access and quality at these stores and do not consider water stress a material risk to our operations. We monitor use through remotely read meters and install water-efficient fittings where relevant.

Our Buildings      

Site selection and biodiversity

When choosing new sites, we prioritise previously developed (brownfield) land and avoid protected areas and areas of high biodiversity value. Every new store is designed to achieve biodiversity net gain, using green roofs and walls where appropriate, native planting and sustainable drainage.

Construction waste

For new developments, we target diverting at least 95% of construction and demolition waste from landfill, in line with our BREEAM Very Good design standard. Main contractors manage site waste under site waste management plans.

Our Social Value: Our People

Training evaluation

Evaluating our training: We evaluate our training programmes as well as tracking hours and completion.

Participant feedback: Employees give feedback on workshops, eLearning courses and all induction training through feedback forms and our learning management system. The People, Talent and Development team reviews this feedback via Viewpoint every two years.

Knowledge and competency checks: Some courses, such as forklift and health and safety training, include practical assessments or theory tests to confirm the training has been understood and applied.

Programme review: The People, Talent and Development team reviews training content periodically to keep courses current, relevant and effective. During FY2026 this led to the introduction of our video-based induction programme and the expansion of eLearning for part-time employees.

Training hours and completion data are reported annually in our ESG Report.

Employee confirmation

All employees confirm they have read and understood the Employee Handbook, including our policies on business conduct, when they join.

Contractor health and safety - Maintenance and facilities contractors

Suppliers and contractors complete a health and safety assessment when they are onboarded. It covers who is responsible for health and safety, accident statistics for the last three years, recognised certification such as ISO 45001, risk assessment, training arrangements, and any enforcement history. Contractors are told about any asbestos at the location before work starts. Before starting any job in a store, contractors complete a permit to work declaration in our Ostara system. They confirm they have carried out risk assessments and are competent for the work, have completed the store contractor register and know the store evacuation plan. Contractors working at height complete an additional questionnaire.

Contractor health and safety - New store construction

Before appointment, demolition and main contractors must show their health and safety competence through an independent third party prequalification, run by the appointed CDM Principal Designer. This includes a review of the contractor's health and safety record and accident reporting, and a formal assessment of credentials such as CHAS or equivalent. Before work starts, each contractor prepares a site specific Construction Phase Plan, which includes a site specific health and safety induction. The induction covers site hazards, emergency procedures, welfare facilities, permit to work requirements and site rules, all recorded by the Site Manager. During the contract, an independent third party appointed by us administers health and safety on our behalf. Inspections, issues and corrective actions are formally minuted in monthly progress meetings. Contractors remain responsible for complying with health and safety regulations on site.

Contractor fatalities

There have been no work-related contractor fatalities at our stores or on our construction sites in FY2024, FY2025 or FY2026.

Water hygiene and pest control

There is a basic water system at every store which is mains fed for the use of the tearooms and toilets. The drinking water is mains fed filtered via the water machine. The risk of legionella across the estate is extremely low. The water temperatures are checked by Riddance every 8 weeks on a PPM visit. Our pest control contractor, Riddance, visits the stores on a PPM visit every 8 weeks to check for rodent activity.

Our Social Value: Responsible Business Practices 

Supplier assessment

New suppliers are assessed before they are appointed. This covers their ethical and sustainable business practices and their information security standards. Key suppliers also complete our supply chain risk questionnaire. It covers quality management, environmental management (including ISO 14001 certification, environmental risk assessment and waste), corporate responsibility policies, child labour, workers' rights, anti-bribery and corruption, business continuity, how suppliers manage their own supply chain, and health and safety. Each supplier's responses are scored by section.

Employees who procure goods or services are trained on our supplier approval process, supply chain risk questionnaire and Supplier Code of Conduct. The briefing covers how suppliers are assessed and approved, when the questionnaire must be completed, and the labour, human rights, anti-bribery and environmental standards we expect suppliers to meet.

Raising a concern

Anyone can raise a concern about the Company confidentially, and anonymously if they prefer, at https://bigyellow.ethicspoint.com. This is open to employees, contractors, suppliers, customers and members of the public.