The Assurance Desk
What Data GRC offers, and what it publishes
You can book a 30-minute advice call by Teams or Zoom for £175 plus VAT, a fixed price on its homepage. It also offers training, advisory work, a virtual DPO, a virtual CISO, audit and staff coaching. Its GDPR training has tracks for HR, marketing and charities.
Data GRC does not publish a price for ongoing DPO or CISO retainers. The £175 figure covers one call only. It does not name its consultants or list their qualifications. It does not publish professional indemnity cover, firm accreditations or an ICO registration number.
So you cannot see who would act as your DPO until you ask. On breaches, we found only a training course on data breach response, with no ICO liaison service or outcomes described. We found no software product and no statement on independence.
Strengths
- Publishes a fixed, transparent price (£175 + VAT) for ad hoc 30-minute advisory calls, a level of pricing transparency not found on the other four sites reviewed
- Combines DPO advisory with an outsourced CISO offering, covering both data protection and information security governance
- Offers structured GDPR training tracks tailored to specific functions, including HR, Marketing and Charities
Things to check
- No named staff, individual credentials, or firm accreditations found published on the site
- No professional indemnity insurance or ICO registration number disclosed
- Only ad hoc advisory-call pricing is published; ongoing DPO/CISO retainer pricing is not disclosed
Common questions
Does Data GRC publish any prices?
Yes, for one thing. A 30-minute advice call costs £175 plus VAT. It publishes no price for ongoing DPO or CISO retainers.
Are its consultants named?
No. Its homepage, services page and More Information page name no consultants and list no qualifications.
Does it offer a CISO as well as a DPO?
Yes. It lists a virtual DPO and a virtual CISO among six service lines, alongside training, advisory work, audit and staff support.
Evidence for each Data GRC score
Show our working
Notes behind each thing to check
- No named staff, individual credentials, or firm accreditations found published on the site (The homepage, services page and 'More Information' page were checked and none lists named consultants, their qualifications, or firm-level accreditations (datagrc.co.uk/more-information/, checked 2026-07-17).)
- No professional indemnity insurance or ICO registration number disclosed (Neither was found on the pages checked (datagrc.co.uk/more-information/, datagrc.co.uk/services/, checked 2026-07-17).)
- Only ad hoc advisory-call pricing is published; ongoing DPO/CISO retainer pricing is not disclosed (The published £175+VAT figure applies to a single 30-minute call only; no rate card for outsourced DPO or CISO retainers was found (datagrc.co.uk/, checked 2026-07-17).)
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | Only a 'data breach response training' course was found; no case-level ICO liaison or breach-response service description with named staff or outcomes appears on the services page (datagrc.co.uk/services/). | |
| Qualifications of the people who do the work | No named staff or individual qualifications are published on the homepage, services page, or 'More Information' page checked (datagrc.co.uk/more-information/). | |
| What it publishes about fees | A fixed £175+VAT price is published for a single advisory call, but no rate card or figures exist for ongoing DPO/CISO retainer services (datagrc.co.uk/). | |
| Knowledge of your sector | Training tracks are offered for HR, Marketing and Charity sectors, but no named sector specialists or dedicated sector case studies were found (datagrc.co.uk/services/). | |
| Independence from what it sells | No commercial software product or independence disclosure statement was found on the pages checked, leaving the firm's product relationships unclear either way (datagrc.co.uk/services/). | |
| Who carries the risk if the advice is wrong | No professional indemnity insurance or liability terms are disclosed on any page checked (datagrc.co.uk/more-information/, datagrc.co.uk/services/). |
Sources for Data GRC
- Registered at Companies House as Data GRC Ltd (Company number 10892418, incorporated 1 August 2017, status: Active, registered office Stoneheal Cottage, Holmwood, Dorking, Surrey, RH5 4NG) (Companies House, checked 17 July 2026)
- No firm-level ICO registration number found published (Not found on the homepage, services page or 'More Information' page checked) (datagrc.co.uk, checked 17 July 2026)
- Publishes six core service lines (Training, Advisory Services, Virtual DPO, Virtual CISO, Audit & Assurance, and Staff Support (coaching/mentoring)) (datagrc.co.uk, checked 17 July 2026)
- Publishes a fixed price for ad hoc advisory calls, but not for ongoing DPO/CISO retainer services ('Expert advisory calls with senior GDPR consultants for £175 + VAT' for a 30-minute consultation via Teams/Zoom; no figures found for ongoing outsourced DPO or CISO retainer pricing) (datagrc.co.uk, checked 17 July 2026)
- No named staff or individual credentials found published (The homepage, services page and 'More Information' page were checked and none lists named consultants or their qualifications) (datagrc.co.uk, checked 17 July 2026)
First DPO or AI policySeeking ISO 42001 certificationAfter a breach or ICO contact
Where this firm appears
- Do you need a data protection officer?
- Can the firm that prepares you also certify you?
- After a data breach: what UK law asks of you
- Which data protection, AI governance and cyber security providers publish a price?
- Compare providers
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.