XML 313 R31.htm IDEA: XBRL DOCUMENT v3.25.2
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Jun. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] As Diageo becomes more connected and digitally enabled, we
recognise the growing risks from increasingly sophisticated cyber
threats. Cyber security is aligned to our group risk framework and is
central to our principal risk area of ‘Cyber and IT resilience’.
We continue to strengthen how we protect our systems, data and
brands through governance, employee awareness and regular
assessments. Our approach includes working to keep pace with
global regulatory changes, such as the EU’s Network and Information
Security Directive 2 (NIS2), where we are enhancing our incident
response, supplier oversight and risk reporting processes to meet
evolving expectations.
Cyber security remains key to safeguarding our most valuable assets
and ensuring trust in our products, services and operations worldwide.
We align our cyber security practices with recognised industry
standards to help us respond effectively to threats and incidents across
our global operations. In today’s environment, we are seeing increased
risks from social engineering attacks and vulnerabilities in cloud
infrastructure. A key area of focus is strengthening third-party risk
management. We continue to work closely with our vendors and
suppliers to ensure they meet our security expectations, including
safeguards for systems, data and recovery capabilities, helping to build
greater resilience across our end-to-end supply chain.
Our cyber security framework operates consistently across all regions
and functions, enabling us to assess risks, respond quickly to threats
and implement appropriate countermeasures. We are enhancing and
clarifying existing protocols for escalating material cyber incidents to
senior management and the Board. 
In line with evolving regulatory requirements, we are progressing a
structured programme to align with NIS2, focusing on governance,
incident response and third-party risk obligations across our operations
in Europe and globally.
We regularly engage independent cyber security experts to benchmark
our capabilities and test the resilience of our systems. Alongside this,
all employees and certain contractors are required to complete cyber
training, with additional targeted education to address specific roles,
risks and evolving threat scenarios.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Cyber security is aligned to our group risk framework and is
central to our principal risk area of ‘Cyber and IT resilience’.
We continue to strengthen how we protect our systems, data and
brands through governance, employee awareness and regular
assessments. Our approach includes working to keep pace with
global regulatory changes, such as the EU’s Network and Information
Security Directive 2 (NIS2), where we are enhancing our incident
response, supplier oversight and risk reporting processes to meet
evolving expectations.
Cyber security remains key to safeguarding our most valuable assets
and ensuring trust in our products, services and operations worldwide.
We align our cyber security practices with recognised industry
standards to help us respond effectively to threats and incidents across
our global operations. In today’s environment, we are seeing increased
risks from social engineering attacks and vulnerabilities in cloud
infrastructure. A key area of focus is strengthening third-party risk
management. We continue to work closely with our vendors and
suppliers to ensure they meet our security expectations, including
safeguards for systems, data and recovery capabilities, helping to build
greater resilience across our end-to-end supply chain.
Our cyber security framework operates consistently across all regions
and functions, enabling us to assess risks, respond quickly to threats
and implement appropriate countermeasures. We are enhancing and
clarifying existing protocols for escalating material cyber incidents to
senior management and the Board.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board retains overall responsibility for risk management, including
cyber security, with oversight delegated to the Audit Committee. The
Audit Committee reviews management's actions with the aim of
ensuring that robust processes are in place to identify, assess and
manage cyber risks, and that appropriate measures are taken to
mitigate potential incidents across the business.
Under our protocols, material cyber risks would be escalated by the
Audit Committee to the Board, while day-to-day responsibility lies with
management. Our cyber programmes are led by our Chief Information
Security Officer (CISO), supported by a team of experienced industry
professionals. Together, they oversee the continuous monitoring of
emerging cyber trends and vulnerabilities, actions taken to prevent,
respond to and mitigate potential cyber threats across the business.
Management, including the CISO and cyber security team, provides
regular updates to the Audit Committee, including formal reporting
twice a year. These reports cover key developments, programme
assessments, risk trends and mitigation strategies aligned to our
risk appetite.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board retains overall responsibility for risk management, including
cyber security, with oversight delegated to the Audit Committee. The
Audit Committee reviews management's actions with the aim of
ensuring that robust processes are in place to identify, assess and
manage cyber risks, and that appropriate measures are taken to
mitigate potential incidents across the business.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Under our protocols, material cyber risks would be escalated by the
Audit Committee to the Board, while day-to-day responsibility lies with
management.
Cybersecurity Risk Role of Management [Text Block] Under our protocols, material cyber risks would be escalated by the
Audit Committee to the Board, while day-to-day responsibility lies with
management. Our cyber programmes are led by our Chief Information
Security Officer (CISO), supported by a team of experienced industry
professionals. Together, they oversee the continuous monitoring of
emerging cyber trends and vulnerabilities, actions taken to prevent,
respond to and mitigate potential cyber threats across the business.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Under our protocols, material cyber risks would be escalated by the
Audit Committee to the Board, while day-to-day responsibility lies with
management. Our cyber programmes are led by our Chief Information
Security Officer (CISO), supported by a team of experienced industry
professionals. Together, they oversee the continuous monitoring of
emerging cyber trends and vulnerabilities, actions taken to prevent,
respond to and mitigate potential cyber threats across the business.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our cyber programmes are led by our Chief Information
Security Officer (CISO), supported by a team of experienced industry
professionals.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Management, including the CISO and cyber security team, provides
regular updates to the Audit Committee, including formal reporting
twice a year.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true