v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

RELX takes measures to assess, identify, and manage material risks from cybersecurity threats, including the following:

●We have established security programmes which are constantly reviewed and updated to address developments in the threat landscape with the aim of ensuring our ability to prevent, respond to and recover from a cybersecurity attack, that data is protected and our business infrastructures continue to operate.
●We have governance mechanisms in place to design and monitor common policies and standards across our businesses.
●We invest in appropriate technological and physical controls which are applied across the enterprise in a risk-based security programme which operates at the infrastructure, application, and user levels. These controls include, but are not limited to, infrastructure vulnerability management, application scanning and penetration testing, network segmentation, encryption and logging and monitoring.
●We provide regular training and communication initiatives to establish and maintain awareness of risks at all levels of our businesses.
●We have appropriate incident response plans to respond to threats and attacks which include procedures to recover and restore data and applications in the event of an attack.
●We maintain appropriate information security policies and contractual requirements for our businesses and run programmes monitoring the application of our data security and resilience policies by third-party service providers.
●We use independent internal and third-party auditors to test, evaluate, and help enhance our procedures and controls.
●We continuously monitor the global regulatory landscape to identify emerging cybersecurity, data protection and privacy laws, and, as needed, create implementation plans to comply with them.
●We procure appropriate cybersecurity insurance to mitigate the potential losses arising from a cybersecurity incident.

RELX has a well-embedded risk management framework based on the Internal Control-Integrated Framework (2013) by the Committee of Sponsoring Organisations of the Treadway Commission (COSO). Through this framework, risks are identified, assessed, mitigated, and monitored in an effective and consistent way across its businesses. RELX uses the 3 Lines of Defence model and aligns its risk management and internal control systems with the COSO framework. Business Areas maintain risk management and internal control systems which are appropriate to the nature and scale of their activities and address all significant strategic, operational, financial, cybersecurity, legal, regulatory compliance, and reputational risks that they face.

RELX risk management is integrated in the management of the business, with a robust semiannual risk assessment process in place and overseen by the Head of Group Insurance and Risk. The approach is designed to ensure a high level of awareness on risk matters, including emerging risks, thorough identification of risks, and consideration of appropriate mitigating controls including an evaluation of their effectiveness. Every business unit of significance and each corporate function within RELX is part of this process. Internal Audit and Assurance (IAA) performs internal audits and assesses the effectiveness of controls and management responsiveness to identified risks. Prioritisation of audits on the audit plan are informed by the risk assessment. The audit findings and required remediation are documented for key stakeholders and reported to and discussed with the RELX PLC Audit Committee.

The cybersecurity risk framework aligns with and feeds into the enterprise risk management framework. Specifically, the RELX Information Security Council (ISC), chaired by the Head of Information Assurance and Data Protection, has established and integrated processes to measure risk in each RELX business using qualitative and quantitative measures, including the factoring of industry risk events, attacks on RELX systems, and the investigation, remediation, and cost of incidents within each business. The risk assessment results drive future cybersecurity programme priorities within RELX and its businesses.

In support of these measures, RELX has built skilled cybersecurity teams. Members of the RELX cybersecurity teams have extensive experience and maintain industry certifications such as the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), The SANS Institute Global Information Assurance Certification (SANS GIAC), Certified Information Privacy Professional (CIPP), and Certified Information Security Auditor (CISA).

As noted above, the Company from time to time engages with independent consultants and auditors to assess distinct elements of its cybersecurity program, including a biennial third-party audit of products and services which incorporate sensitive

personally identifiable information. The Company also periodically completes ISO 27001 certifications, SOC 2 audit reports, and other independent assessments for its businesses. In further support of its cybersecurity programme, the Company regularly engages independent researchers and penetration testers; and implements bug bounty programmes to proactively identity potential vulnerabilities and further mitigate risk.

The Company has defined and implemented a Third Party Provider Policy that includes the assessment of cybersecurity risk from third-party service providers (suppliers) ; the evaluation of such risk using industry standard criteria such as audit reports, certifications, and interviews; the mitigation or acceptance by management of residual risk from the engagement of the supplier; and periodic re-assessments of the supplier. The Company has established business continuity plans pursuant to a comprehensive business continuity programme aimed at reducing disruption in the event of a significant cybersecurity failure by a supplier. The Company additionally uses threat intelligence services to identify suppliers that have had significant cybersecurity incidents and ensures that the supplier has appropriately mitigated the root causes of that incident. The Company has also established a formal supplier resilience programme to identify and manage critical suppliers across the business. The Company includes cybersecurity contractual provisions with suppliers to address prevention, detection, notice obligations, communication protocols, and recovery steps.

For a description of how risks from cybersecurity threats could materially affect RELX, including its business strategy, results of operations or financial condition, see “Item 3: Key Information—Risk Factors—Compromises of our cyber security systems and other unauthorised access to our databases, could adversely affect our business and operations” which is incorporated by reference into this Item 16K.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

RELX risk management is integrated in the management of the business, with a robust semiannual risk assessment process in place and overseen by the Head of Group Insurance and Risk. The approach is designed to ensure a high level of awareness on risk matters, including emerging risks, thorough identification of risks, and consideration of appropriate mitigating controls including an evaluation of their effectiveness. Every business unit of significance and each corporate function within RELX is part of this process. Internal Audit and Assurance (IAA) performs internal audits and assesses the effectiveness of controls and management responsiveness to identified risks. Prioritisation of audits on the audit plan are informed by the risk assessment. The audit findings and required remediation are documented for key stakeholders and reported to and discussed with the RELX PLC Audit Committee.

The cybersecurity risk framework aligns with and feeds into the enterprise risk management framework. Specifically, the RELX Information Security Council (ISC), chaired by the Head of Information Assurance and Data Protection, has established and integrated processes to measure risk in each RELX business using qualitative and quantitative measures, including the factoring of industry risk events, attacks on RELX systems, and the investigation, remediation, and cost of incidents within each business. The risk assessment results drive future cybersecurity programme priorities within RELX and its businesses.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

For a description of how risks from cybersecurity threats could materially affect RELX, including its business strategy, results of operations or financial condition, see “Item 3: Key Information—Risk Factors—Compromises of our cyber security systems and other unauthorised access to our databases, could adversely affect our business and operations” which is incorporated by reference into this Item 16K.
Cybersecurity Risk Board of Directors Oversight [Text Block]

The RELX PLC Board monitors the internal control and risk management systems and performs an annual assessment of their effectiveness. With respect to cybersecurity:

●The Head of Information Assurance & Data Protection updates the RELX Board of Directors semiannually on the state of the Company’s cybersecurity program. These updates consist of, but are not limited to, a discussion of the industry threat landscape and implications for the Company; an explanation of the current cybersecurity risk assessment for the Company; a description of key incidents, lessons learned, and new initiatives in the reporting period; a summary of key operational metrics; and focus areas and initiatives to mitigate current and future cybersecurity threats for the Company.

​

●The CTO Forum, defined below, updates the RELX Board of Directors annually, primarily on technology which includes key cybersecurity implications of technology projects.

In addition, as noted above, the RELX PLC Audit Committee receives and discusses the IAA’s audit findings, which may include cybersecurity matters.

The Chief Legal Officer and Company Secretary (CLO) and the Chief Financial Officer (CFO) are the senior management members who have primary responsibility for assessing and managing cybersecurity risks. As such, the Company’s risk assessment, internal audit, information assurance, and incident response organisations report into either the CLO or CFO. The CLO and CFO determine whether an incident is sufficiently serious to require public disclosure.

The Company has established three cross-functional senior-level forums which further coordinate governance over the technology which supports the mitigation of cybersecurity risks: the ISC, the RELX Technology Forum (CTO Forum), and the Security Governing Committee (SGC). Additionally, the RELX Head of Information Assurance & Data Protection periodically updates the CLO, CFO, and other senior management members on cybersecurity risks.

ISC

​

The ISC comprises the RELX Head of Information Assurance & Data Protection (Chair) and the Chief Information Security Officer (CISO) from each of the RELX divisions - Risk, Scientific, Technical & Medical, Legal, and Exhibitions. ISC members have extensive experience in cybersecurity and contribute to industry cybersecurity threat sharing groups such as FS-ISAC (Financial Services Information Sharing and Analysis Center). They have published and spoken on relevant topics at industry events such as RSAC USA (RSA Conference USA) and FS-ISAC FinCyber Today and in industry journals published by the International Systems

Security Association (ISSA), Directors & Boards magazine, the International Association of Privacy Professionals (IAPP) and the Institute of Electrical and Electronics Engineers IEEE.

The ISC, among other functions:

●oversees the development of the RELX cybersecurity strategy;
●liaises with management and operations across the Company to align cybersecurity objectives with the risk assessment, risk profile, and current and future business needs;
●assesses, communicates, and advises on the cybersecurity risks to the Company including on the use of legacy systems, emerging technologies, and industry threats;
●inventories cybersecurity risks and controls in place, and recommends the implementation of mitigating controls;
●performs the semiannual cybersecurity risk assessment for the Company, including third party service providers, and communicates the cybersecurity risk assessment results to RELX senior management, including the CEOs of each of the RELX business areas; and
●reviews cybersecurity trends, incidents, and lessons learned on a regular basis.

The escalation points for the ISC are the CTO Forum and the SGC.

CTO Forum

​

The CTO Forum comprises the Chief Technology Officer of each RELX business area and RELX’s Chief Strategy Officer. The current Chair of the CTO Forum is the Chief Technology Officer of the Risk business. He was previously Vice President of Technology, LexisNexis Insurance Solutions and has also held technology executive positions at ChoicePoint, Paragon Solutions, Primus Knowledge Solutions, and McKesson. He holds a bachelor’s degree in electrical and electronics engineering from the Birla Institute of Technology and Science, Pilani, a master’s degree in cybersecurity from the Georgia Institute of Technology, and completed an advanced management programme for executives at MIT Sloan School of Management. The CTO Forum focuses on technology and cybersecurity strategy, talent, and cross-business collaboration on these issues. The CTO Forum requests and receives regular updates on responsibilities such as cybersecurity issues, technology talent acquisition, procurement, and critical suppliers. It receives regular cybersecurity governance, operations, and incident management updates from the Chair of the ISC, and annual briefings on the state of cybersecurity from the entire ISC.

SGC

The SGC comprises RELX’s Chief Legal Officer (Chair), Chief Counsel, Technology, Patents, Procurement, Chief Strategy Officer, Chair of the CTO Forum, and the Chair of the ISC. The primary governance function of the SGC is to review overall cybersecurity strategy and serve as a point of escalation for cybersecurity programme resource allocation and project prioritisation decisions. The SGC receives regular briefings on the same topics as the CTO Forum, as well as risk assessments and project updates on non-technology related cybersecurity risks, such as business processes for incident response and verification programmes for customer access to sensitive data; and adjacent risks, such as compliance.

​
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The audit findings and required remediation are documented for key stakeholders and reported to and discussed with the RELX PLC Audit Committee.

In addition, as noted above, the RELX PLC Audit Committee receives and discusses the IAA’s audit findings, which may include cybersecurity matters.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The audit findings and required remediation are documented for key stakeholders and reported to and discussed with the RELX PLC Audit Committee.
●The Head of Information Assurance & Data Protection updates the RELX Board of Directors semiannually on the state of the Company’s cybersecurity program. These updates consist of, but are not limited to, a discussion of the industry threat landscape and implications for the Company; an explanation of the current cybersecurity risk assessment for the Company; a description of key incidents, lessons learned, and new initiatives in the reporting period; a summary of key operational metrics; and focus areas and initiatives to mitigate current and future cybersecurity threats for the Company.

​

●The CTO Forum, defined below, updates the RELX Board of Directors annually, primarily on technology which includes key cybersecurity implications of technology projects.

In addition, as noted above, the RELX PLC Audit Committee receives and discusses the IAA’s audit findings, which may include cybersecurity matters.
Cybersecurity Risk Role of Management [Text Block]

In addition, as noted above, the RELX PLC Audit Committee receives and discusses the IAA’s audit findings, which may include cybersecurity matters.

The Chief Legal Officer and Company Secretary (CLO) and the Chief Financial Officer (CFO) are the senior management members who have primary responsibility for assessing and managing cybersecurity risks. As such, the Company’s risk assessment, internal audit, information assurance, and incident response organisations report into either the CLO or CFO. The CLO and CFO determine whether an incident is sufficiently serious to require public disclosure.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Chief Legal Officer and Company Secretary (CLO) and the Chief Financial Officer (CFO) are the senior management members who have primary responsibility for assessing and managing cybersecurity risks. The ISC comprises the RELX Head of Information Assurance & Data Protection (Chair) and the Chief Information Security Officer (CISO) from each of the RELX divisions - Risk, Scientific, Technical & Medical, Legal, and Exhibitions. The CTO Forum comprises the Chief Technology Officer of each RELX business area and RELX’s Chief Strategy Officer. The SGC comprises RELX’s Chief Legal Officer (Chair), Chief Counsel, Technology, Patents, Procurement, Chief Strategy Officer, Chair of the CTO Forum, and the Chair of the ISC.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] ISC members have extensive experience in cybersecurity and contribute to industry cybersecurity threat sharing groups such as FS-ISAC (Financial Services Information Sharing and Analysis Center). They have published and spoken on relevant topics at industry events such as RSAC USA (RSA Conference USA) and FS-ISAC FinCyber Today and in industry journals published by the International Systems Security Association (ISSA), Directors & Boards magazine, the International Association of Privacy Professionals (IAPP) and the Institute of Electrical and Electronics Engineers IEEE.The current Chair of the CTO Forum is the Chief Technology Officer of the Risk business. He was previously Vice President of Technology, LexisNexis Insurance Solutions and has also held technology executive positions at ChoicePoint, Paragon Solutions, Primus Knowledge Solutions, and McKesson. He holds a bachelor’s degree in electrical and electronics engineering from the Birla Institute of Technology and Science, Pilani, a master’s degree in cybersecurity from the Georgia Institute of Technology, and completed an advanced management programme for executives at MIT Sloan School of Management.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] As such, the Company’s risk assessment, internal audit, information assurance, and incident response organisations report into either the CLO or CFO. Additionally, the RELX Head of Information Assurance & Data Protection periodically updates the CLO, CFO, and other senior management members on cybersecurity risks.

The ISC, among other functions:

performs the semiannual cybersecurity risk assessment for the Company, including third party service providers, and communicates the cybersecurity risk assessment results to RELX senior management, including the CEOs of each of the RELX business areas; The CTO Forum requests and receives regular updates on responsibilities such as cybersecurity issues, technology talent acquisition, procurement, and critical suppliers. It receives regular cybersecurity governance, operations, and incident management updates from the Chair of the ISC, and annual briefings on the state of cybersecurity from the entire ISC.The SGC receives regular briefings on the same topics as the CTO Forum, as well as risk assessments and project updates on non-technology related cybersecurity risks, such as business processes for incident response and verification programmes for customer access to sensitive data; and adjacent risks, such as compliance.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true