Diversity, equity, and inclusion (DEI) initiatives have gained significant importance in organizations worldwide, shaping efforts to create more inclusive environments and to promote equal opportunities. Nonetheless, DEI data collection remains a “blurry space” in need of rigorous examination (Moieni & Mousaferiadis, 2022). In particular, four overlapping issues contribute to this ambiguity: (1) a lack of standardized frameworks for determining which data points should be gathered in order to track and evaluate DEI progress, (2) unclear boundaries around ethical data usage and participant consent, (3) the complexity of navigating multiple global legal standards pertaining to personal data, and (4) the underrepresentation of certain regions and identities within existing DEI datasets and scholarship ([49]; [70]). These challenges persist even as newer, data-driven approaches and advanced algorithms are increasingly used to define and measure inclusivity within communities ([51]; [37]; [38]).

Collecting and handling DEI data poses critical privacy concerns, given that this information often involves protected characteristics such as race, ethnicity, gender identity, and disability status. Ensuring robust data protection measures—such as anonymization, encryption, and differential privacy—remains essential to build trust, safeguard individual rights, and maintain the integrity of DEI programs ([63]; [67]; [22]; [51]). Trust is especially crucial, as stakeholders are more likely to participate in DEI initiatives if they feel confident that their personal data will be handled responsibly, ethically, and in accordance with their consent ([11]; [30]; [52]). Breaches of confidentiality not only undermine trust but can also trigger significant reputational harm and impede the success of any DEI effort ([8]; [36]).

Moreover, organizations operating in diverse regions must navigate an array of legal and regulatory frameworks. Table 1 lists key regulatory compliances—from FERPA in the United States to the PIPL in China—illustrating how the treatment of sensitive data can vary considerably across jurisdictions. Noncompliance can lead to legal actions, fines, or anti-discrimination claims, further emphasizing the need for robust and adaptive data governance strategies ([8]).

Table1. Key regulatory compliances from various regions.

Given these complexities, this literature review aims to conduct an empirical analysis of privacy concerns in DEI initiatives. By examining recent scholarship and real-world practices, we seek to identify the ethical, legal, and technological considerations that most significantly affect DEI data handling. We then propose strategies for organizations to leverage DEI data responsibly and inclusively balancing privacy obligations with the broader goal of promoting equity. The findings underscore the importance of well-defined frameworks, transparent consent processes, and regionally tailored compliance measures. As organizations continue to adopt DEI programs at scale, addressing these data privacy considerations will be essential for building trust and ensuring the effectiveness of DEI initiatives over the long term.

Maintaining privacy is paramount when collecting and handling diversity, equity, and inclusion (DEI) data, as this often involves sensitive personal information related to protected characteristics such as race, ethnicity, gender identity, and disability status. Ensuring proper data protection and privacy measures fosters trust, promotes inclusivity, and safeguards the rights and dignity of individuals. Here, we discuss current literature on this topic from legal, business, and sociological perspectives.

A comprehensive study on DEI ([55]) within supplier chains revealed that DEI initiatives are complex and multifaceted. The study emphasized that technology plays a critical role within a multifactorial approach to enhancing DEI. According to Silva et al., DEI practices in supplier chains involve various layers and dimensions, such as organizational hierarchy, which includes leadership commitment and policy implementation, and dimensions such as gender, ethnicity, and socioeconomic status. These aspects demonstrate the intricate interplay between different factors, highlighting the importance of a structured and technological approach to effectively promote diversity, equity, and inclusion in supplier chains. This approach ensures that DEI initiatives are not only top-down but also consider the diverse and intersecting needs of all stakeholders involved.

Broader information privacy literature, not specifically related to DEI, can also be considered. ([41]) examined privacy concerns in peer contexts on commercial social media sites, finding that individuals with negative privacy experiences exhibit greater privacy concerns. Additionally, there is evidence that privacy concerns do not always translate to privacy-positive behaviour ([6]). Big data and machine learning algorithms can perpetuate discrimination and disparate impacts on marginalized groups ([5]), as seemingly neutral data can encode protected information and lead to biased decision-making (Ajunwa et al., 2016). These issues likely extend to DEI data collection as well. ([50]) emphasize the importance of diversity in the cybersecurity workforce, highlighting improved innovation and organizational performance, and call for targeted efforts to address barriers faced by professionals from marginalized backgrounds.

Another way of looking at the collection of data in DEI is through DEI-specific studies. This body of work explores DEI through anthropological, business, and consumer research. This is an important field, and there is a need for significant further research ([71]). Since the 2020the murder of George Floyd and associated protests and the exponential growth of the DEI field, there have been notable gaps in geographic representation and data specificity ([70]). Additionally, the field of DEI studies is largely based in Western institutions. Contributions from the Global South and other underrepresented parts of the world would lead to a more robust understanding ([49]).

While the benefits of diversity are well studied, there is a gap in data regarding the results of DEI initiatives. ([63]) discusses the importance of DEI initiatives and access concerning LGBTQ+ individuals and argues for improved data collection and the removal of barriers to employment among marginalized groups. ([7]) emphasizes that experts and practitioners consider a data-driven approach to be the best practice for implementing and evaluating DEI initiatives.

Trust is a critical element in DEI data collection initiatives. Employees and stakeholders are more likely to participate in DEI initiatives and share their personal information when they trust that their data will be handled with utmost confidentiality and respect for their privacy ([30]). A breach of trust or mishandling of DEI data can lead to reluctance in participation, undermining the effectiveness of DEI efforts and creating an environment of distrust and apprehension ([11]).

Preventing discrimination and harm is another crucial factor. Unauthorized disclosure or misuse of DEI data can lead to discrimination, stigmatization, and harm to individuals ([61]). Robust privacy measures help mitigate these risks and create an inclusive environment where individuals feel safe and respected, regardless of their personal characteristics or identities ([30]).

Collecting and processing DEI data raises ethical concerns regarding the responsible and respectful treatment of individuals’ personal information (Moerel, 2023). Implementing robust privacy measures and obtaining informed consent demonstrate an organization’s commitment to ethical practices and respect for individual autonomy ([52]; [53]).

Employers may consider obtaining employees’ explicit consent as a basis to collect and process sensitive personal data, even when such data is later anonymized and presented as aggregate statistics. However, relying on employee consent in an employment context can be insufficient due to the potential power imbalance between employers and employees ([8]).

Organizations must comply with relevant data protection regulations regardless of where they operate. The California Consumer Privacy Act (CCPA) applies to any business that collects personal information from California residents and meets one of the following criteria: makes at least $25 million in annual revenue, processes the personal data of 50,000 or more consumers, households, or devices annually, or derives 50% or more of its annual revenue from selling consumers’ personal data. Similarly, the [23] applies to organizations engaged in professional or commercial activity with individuals in the European Union, regardless of where the organization is based. However, there are exceptions; for instance, organizations with fewer than 250 employees are generally exempt from certain record-keeping obligations under the GDPR, though they are not completely exempt from the regulation ([17]). These regulations outline specific requirements for handling personal data, including DEI data, and impose strict penalties for non-compliance. Additionally, under UK legislation, the processing of special category data is legally allowed for the specific purpose of assessing and monitoring equality of opportunity or treatment among different groups. This permission has a relatively narrow scope and is primarily aimed at ensuring the promotion and preservation of equal opportunities ([8]).

Non-compliance with data protection regulations can lead to legal consequences, including fines, lawsuits, and potential criminal charges for individuals responsible for the mishandling of data ([25]). While strict laws and harsh penalties for non-compliance are arguably necessary, many organizations, especially global organizations, find it challenging to comply with all the local laws ([67]; [11]). DEI initiatives must comply with each jurisdiction’s legal statutes, making consistency of data collection, storing, and analysing difficult. This has become particularly pronounced with the European Union’s strict guidelines compared to those of other Western legal bodies ([30]; [67]; [11]).

Mishandling DEI data can have significant legal implications. DEI data often includes sensitive personal information related to protected characteristics such as race, ethnicity, gender identity, and disability status. Failing to properly protect this data can lead to violations of data protection regulations and anti-discrimination laws ([8]). Such claims can result in legal liabilities and damages, damage the organization’s reputation, and create a hostile work environment, undermining DEI efforts and employee trust (Moerel, 2023).

Prioritizing privacy and implementing robust data protection measures can mitigate these difficulties and enhance an organization’s public image ([52]; [53]). Organizations can strengthen relationships with employees, stakeholders, and the broader community by demonstrating their commitment to privacy and responsible data handling practices ([11]).

To address DEI challenges and create an inclusive environment, organizations must prioritize privacy and implement robust data protection measures, such as anonymization, pseudonymization, access controls, secure data storage and transmission, transparency, and obtaining informed consent ([67]). By doing so, they can foster trust, prevent discrimination, comply with regulations, uphold ethical principles, and enhance their reputation as responsible and inclusive organizations.

Many organizations rely on third-party service providers or consultants to assist with DEI initiatives and data collection. Organizations must ensure the proper handling and protection of DEI data by these third parties through contractual obligations and robust data protection measures ([30]).

Key strategies to ensure the privacy and protection of DEI data include:

AnonymizationandDataMinimization: Implement anonymization techniques to remove or obfuscate personally identifiable information from DEI data, making it impossible to trace the data back to specific individuals. Minimize data storage by collecting and retaining only the minimum amount of DEI data necessary for legitimate purposes ([25]; [11]).

StrictAccessControls: Implement strict access controls and role-based access mechanisms to ensure that only authorized personnel can access DEI data on a need-to-know basis. Regularly review and audit access logs to detect and prevent unauthorized access attempts ([11]).

SecureDataStorageandTransmission: Store DEI data using industry-standard encryption techniques to protect against unauthorized access or data breaches. Transmit DEI data over secure, encrypted channels to prevent interception or unauthorized access during transmission ([17]).

TransparencyandInformedConsent: Communicate the purpose, scope, and intended use of collected DEI data to employees. Obtain explicit and informed consent from participants before collecting and processing their personal information for DEI initiatives ([8]).

Third-PartyVendorManagement: Vet third-party service providers or consultants who may have access to DEI data and ensure they have robust data protection measures in place. Implement contractual obligations and written assurances from third parties to safeguard the confidentiality and privacy of DEI data ([30]).

EmployeeTrainingandAwareness: Provide regular training to employees on data best practices, security protocols, and the importance of protecting sensitive DEI information, fostering a culture of privacy awareness and accountability within the organization ([30]).

CompliancewithRegulations: Ensure compliance with relevant data protection regulations. Data safety and IT security are responsibilities shared across the organization ([25]).

This study employs a systematic literature review to analyse existing research on privacy concerns in Diversity, Equity, and Inclusion (DEI) data. The aim is to identify gaps in the current literature and provide recommendations for companies to address these gaps, focusing on enhancing privacy practices in DEI initiatives. The methodology follows a structured approach to ensure a comprehensive and unbiased review of relevant studies.

The primary research questions guiding this review are:

RQ1: What are the prevalent privacy concerns related to DEI data?

RQ2: What regulatory and ethical considerations are critical in DEI data management?

RQ3: What technological and organizational practices can enhance data privacy in DEI initiatives?

These questions shaped the research strategy and analysis of the literature.

This systematic literature review followed the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines ([56]), using an explicit and systematic research strategy and established inclusion and exclusion criteria. The literature research was conducted across multiple academic databases, including Google Scholar, PubMed, IEEE Xplore, Web of Science, and Scopus. Additionally, industry reports and whitepapers were reviewed to capture practical insights. Keywords used in the research included “DEI data privacy,” “diversity equity inclusion data protection,” “privacy concerns in DEI,” “regulatory compliance DEI data,” and “ethical considerations DEI data.” The research primarily focused on peer-reviewed journal articles, conference papers, and industry reports published between 2004 and 2024, though some key studies from earlier years, as far back as 1982, were included due to their relevance. Studies focusing on privacy concerns, regulatory and ethical considerations, and technological practices in DEI data were included. Articles not directly related to DEI data privacy, non-English publications, and studies lacking empirical or theoretical contributions were excluded. Titles and abstracts of identified studies were screened to determine their relevance to the research questions, followed by full-text reviews for inclusion based on the defined criteria. Discrepancies in selection were resolved through discussion among the research team.

To clarify the study selection process, Figure 1 illustrates the flow of information across different phases of the review. Initially, records were identified through database searches and additional sources, with duplicates removed. The remaining studies were screened based on titles and abstracts, and those not meeting the inclusion criteria, such as articles unrelated to DEI data privacy or non-English publications, were excluded. Full-text articles were then reviewed in detail to assess their relevance, leading to further exclusions based on their lack of empirical or theoretical contributions to privacy concerns, regulatory and ethical considerations, or technological practices. The final set of studies included in the review met all established criteria and underwent thematic analysis to identify key themes and gaps in the literature. Figure1 visually represents this entire process, detailing the number of records at each stage and the reasons for exclusion.

The quality of included studies was assessed using established criteria such as the relevance of research questions, methodological rigor, clarity of findings, and contributions to the field of DEI data privacy. Based on the thematic analysis, key gaps and challenges in the current literature were identified. These included: insufficient research on the intersection of DEI and data privacy; lack of comprehensive frameworks for regulatory compliance; and limited empirical studies on the effectiveness of privacy-enhancing technologies in DEI data management. Recommendations were formulated to address the identified gaps. These recommendations were grounded in the findings from the literature review and tailored to provide actionable guidance for organizations and companies. Recommendations focused on enhancing trust in DEI data initiatives, ensuring regulatory compliance, implementing robust privacy measures, and promoting ethical data handling practices. This systematic literature review methodology provides a structured and comprehensive approach to analysing existing research on DEI data privacy. By identifying gaps in the current literature and formulating targeted recommendations, this study aims to guide companies in enhancing their DEI data practices. The focus on regulatory compliance, ethical considerations, and technological safeguards ensures that the recommendations are both practical and aligned with current best practices in data privacy.

Figure1. PRISMA Flow diagram of how the systematic literature review was conducted. The diagram is divided into three phases: identification, screening, and inclusion.

Due to the sensitive nature of DEI data and the strict privacy obligations governing it, we are unable to disclose raw participant-level data. Instead, we will make aggregated or de-identified datasets available upon reasonable request, ensuring full protection of sensitive personal information. To facilitate independent verification of our findings, we have documented all methodological procedures in detail and will share the analytic code used for data processing and statistical analyses. This combined approach preserves individual privacy while allowing external researchers to replicate key steps and assess the validity of our results.

Each article in this systematic literature review was evaluated based on its focus on identifying and assessing existing approaches to enhance data privacy and security in Diversity, Equity, and Inclusion (DEI) initiatives. This comprehensive evaluation covered a wide range of topics, including privacy concerns, regulatory and ethical considerations, technological safeguards, and organizational strategies for data protection. The review included a total of 40 relevant articles, each providing valuable insights and highlighting critical gaps in current literature. The following sections summarize the key findings and implications derived from these studies. Table 2 provides the main characteristics of the studies included in this review.

Table2. Characteristics of the studies included in this review.

The analysis and findings of this systematic literature review highlight several critical insights and gaps in the current landscape of data privacy practices within Diversity, Equity, and Inclusion (DEI) initiatives. This section synthesizes these insights, discusses the implications for organizations, and provides targeted recommendations for enhancing data privacy and security in DEI initiatives.

This systematic literature review provides a comprehensive analysis of data privacy concerns in Diversity, Equity, and Inclusion (DEI) initiatives, highlighting the legal, ethical, and practical considerations essential for safeguarding sensitive DEI data. The findings underscore the critical role of trust in encouraging participation in DEI initiatives, with robust privacy measures being fundamental to fostering this trust. Employees and stakeholders are significantly more likely to share sensitive personal information when they are confident that their data will be handled confidentially and ethically.

Regulatory compliance emerges as a triple benefit, helping organizations avoid legal penalties while improving the quality of their data and enhancing their reputation and trustworthiness. Adherence to frameworks such as GDPR and CCPA has been shown to reduce data breaches and increase trust, emphasizing the importance of staying updated with evolving data protection laws and conducting regular compliance audits.

Ethical practices, including transparency and informed consent, significantly influence employees’ willingness to share personal information. Implementing clear consent processes not only improves the accuracy and completeness of DEI data but also aligns with ethical standards that respect individual autonomy and privacy.

Technological safeguards, such as data anonymization, encryption, and strict access controls, are essential for protecting DEI data without compromising its utility. Regularly reviewing and updating these safeguards ensures they remain effective against evolving threats.

The exploration of advanced privacy-preserving technologies—differential privacy, blockchain, AI-driven privacy solutions, homomorphic encryption, secure multi-party computation, federated learning, and privacy-preserving data publishing—offers promising solutions for addressing the complex challenges of maintaining data privacy in DEI initiatives. These technologies provide robust methods for protecting sensitive data while enabling organizations to leverage DEI data for fostering a diverse and inclusive workforce.

In conclusion, this review highlights the importance of a multifaceted approach to data privacy in DEI initiatives. Building trust through transparency and ethical practices, ensuring regulatory compliance, implementing robust technological safeguards, and leveraging advanced privacy-preserving technologies are crucial strategies for organizations. By adopting these recommendations, organizations can enhance the privacy and security of DEI data, foster greater participation in DEI initiatives, and promote a culture of inclusivity and respect for individual privacy. These efforts not only help organizations comply with regulatory requirements but also reinforce their commitment to ethical and responsible data handling practices, ultimately contributing to a more equitable and inclusive environment.

This research was supported by Diversity Atlas and their provision of data has been instrumental in shaping the findings of this study. The authors would like to thank Peter Mousaferiadis, Michael Walmsley, Quincy Hall and Nicole Lee for their support even though they may not agree with some parts of this research. The authors also would like to thank Catherine Mccredie for her editorial support.

This research was funded by Diversity Atlas, which provided financial support for data collection and analysis. The authors declare no conflicts of interest relevant to this work. No human participants were involved in this study, and therefore, ethics approval was not required. The data supporting the findings of this study are available from Diversity Atlas upon reasonable request. Due to the sensitive nature of the DEI data, access may be restricted to ensure privacy and confidentiality. Parisasadat Shojaei and Rezza Moieni contributed to the conceptualization, methodology, and writing of the manuscript, while Catherine McCredie provided editorial support and assisted with reviewing and revising the final version of the paper.