We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Deloitte LLP review

Advisory firm

A large UK professional services firm whose Digital Trust & Privacy practice advises on data protection and AI governance, alongside audit, tax and wider consulting.

Relevant if you are a large organisation with EU AI Act duties and want a named privacy partner

Price Not published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Deloitte scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 4/5
What it publishes about fees 2/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 3/5

What Deloitte offers, and what it publishes

You get a named practice lead. Partner Peter Gooch runs Digital Trust & Privacy, and the firm says he 'specialises in consumer Privacy, Data Protection and information/cyber security'. Deloitte UK appointed Hayley McKelvey as its first firm-wide Chief AI Officer in 2026, and its AI Institute UK, led by Sulabh Soral, publishes research on AI governance.

Deloitte does not publish a price. Its UK privacy advisory page gives no fee rates or pricing model, and terms come on request. It does not publish its professional indemnity cover or policy details. We could not verify a current ISO 27001 or ISO 42001 certificate for the UK firm.

Deloitte's 2024 UK privacy statement names its AI tools, including Microsoft Copilot, and says customer data is not retained or used for model training. The Financial Reporting Council opened an investigation into its audits of Glencore on 23 July 2025, still open on 19 September 2026. In January 2020 the ICAEW fined it £925,000 over its Comet Group administration.

Strengths

  • Digital Trust & Privacy practice has a named, dedicated Partner lead (Peter Gooch) with a stated privacy/data-protection specialism, not a generalist claim.
  • Operates a dedicated Deloitte AI Institute UK plus a firm-wide Chief AI Officer role (Hayley McKelvey, appointed 2026), both producing published AI research.
  • Publishes an unusually specific account of its own AI data-processing practice, including cross-border data flow and a no-model-training commitment, in its 2024 UK privacy statement.

Things to check

  • An FRC statutory investigation into Deloitte's historic statutory audits of Glencore is open and unresolved.
  • No fee rates, pricing model, or cost information is published for Deloitte UK's GDPR/privacy/AI-governance advisory services.
  • In January 2020 the ICAEW fined Deloitte £925,000 (plus £890,000 costs) after a five-year investigation found its client take-on process failed to identify a conflict-of-interest threat to the independence of its Comet Group administrators.

Common questions

Is Deloitte LLP regulated?

Yes. Its own regulators page lists ICAEW audit registration C009201919, FCA authorisation 213218 and SRA authorisation 646135 as a multi-disciplinary practice.

Does Deloitte publish its fees for privacy or AI governance advice?

No. Its UK GDPR and privacy advisory page gives no prices, day rates or worked examples. Terms come on request.

Does Deloitte say how it uses AI itself?

Yes. Its 2024 UK privacy statement names Microsoft Copilot, Google Gemini and OpenAI ChatGPT, says data may pass through Airtable's US servers before reaching EU-hosted models, and says customer data is not retained or used for model training.

Does Deloitte have any open investigations?

Yes, in its audit work. The Financial Reporting Council opened an investigation on 23 July 2025 into its audits of Glencore plc and Glencore Energy UK Limited for the financial years 2013 to 2020. It was unresolved on 19 September 2026.

Evidence for each Deloitte score

Show our working

Notes behind each thing to check

  • An FRC statutory investigation into Deloitte's historic statutory audits of Glencore is open and unresolved. (FRC's own notice (23 Jul 2025): investigation into Deloitte LLP's audits of Glencore plc/Glencore Energy UK, FY2013-2020; no findings published as of 19 Sep 2026.)
  • No fee rates, pricing model, or cost information is published for Deloitte UK's GDPR/privacy/AI-governance advisory services. (Deloitte's own GDPR/privacy-advisory service page (deloitte.com) contains no pricing or fee information; engagement terms given on request only.)
  • In January 2020 the ICAEW fined Deloitte £925,000 (plus £890,000 costs) after a five-year investigation found its client take-on process failed to identify a conflict-of-interest threat to the independence of its Comet Group administrators. (https://www.cityam.com/deloitte-fined-1-8m-and-reprimanded-over-comet-administration-failures/)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 FRC opened a statutory investigation (23 Jul 2025) into Deloitte's Glencore audits, FY2013-2020; outcome unresolved as of Sep 2026.
Qualifications of the people who do the work 4/5 Deloitte LLP publishes ICAEW audit registration (C009201919), FCA authorisation (213218) and SRA registration (646135) on its own regulators page.
What it publishes about fees 2/5 Deloitte's UK GDPR/privacy advisory page publishes no fee rates, pricing model or cost information; terms given on request only.
Knowledge of your sector 4/5 Named Partner Peter Gooch leads Digital Trust & Privacy, specialising in consumer Privacy, Data Protection and cyber security, alongside a dedicated AI Institute UK.
Independence from what it sells 4/5 No evidence found that Deloitte's DP/AI-governance advice is contingent on selling a proprietary compliance software product to clients.
Who carries the risk if the advice is wrong 3/5 Deloitte LLP holds an SRA-recorded professional indemnity insurance waiver with bespoke terms; cover level and policy details are not publicly disclosed.

Sources for Deloitte

  • Deloitte LLP is an active limited liability partnership incorporated on 10 January 2003, registered office 1 New Street Square, London EC4A 3HQ. (Company number OC303675, active LLP, incorporated 10 Jan 2003) (Companies House, checked 19 September 2026)
  • Deloitte LLP publishes its own regulatory registrations: registered to carry on audit work by the ICAEW (ref C009201919), authorised and regulated by the FCA (ref 213218), and authorised and regulated by the SRA as a multi-disciplinary practice (ref 646135). (ICAEW C009201919; FCA 213218; SRA 646135) (deloitte.com, checked 19 September 2026)
  • The Financial Reporting Council announced on 23 July 2025 that it had opened a statutory investigation into Deloitte LLP's audits of Glencore plc and Glencore Energy UK Limited for the financial years ended 31 December 2013 to 31 December 2020, examining whether Deloitte gave sufficient consideration to the risk of non-compliance with laws and regulations. (FRC investigation opened 23 Jul 2025, FY2013-2020 audits) (frc.org.uk, checked 19 September 2026)
  • Deloitte UK's Digital Trust & Privacy practice, which covers GDPR and data-protection advisory, is led by named Partner Peter Gooch, who the firm states 'specialises in consumer Privacy, Data Protection and information/cyber security'. (Named practice lead: Peter Gooch, Partner) (deloitte.com, checked 19 September 2026)
  • Deloitte UK appointed Hayley McKelvey as its first firm-wide Chief AI Officer in 2026; separately the Deloitte AI Institute UK, led by Sulabh Soral, publishes research on AI governance and enterprise AI adoption. (First UK Chief AI Officer appointed 2026; AI Institute UK led by Soral) (deloitte.com, checked 19 September 2026)
  • Deloitte's 2024 UK privacy statement discloses that data used for its own AI processing may be routed through Airtable's US servers before being sent to EU-hosted large language models (Microsoft Copilot, Google Gemini, OpenAI ChatGPT), and states customer data is not retained or used for model training. (Firm discloses own AI data flow, incl. US-to-EU routing and no model-training use) (deloitte.com, checked 19 September 2026)
  • In January 2020 the ICAEW ordered Deloitte to pay a £925,000 fine plus £890,000 in ICAEW costs, via a consent order concluding a five-year investigation into conflicts of interest in Deloitte's 2012 administration of Comet Group. The ICAEW found Deloitte's client take-on procedure failed to address threats to the independence of its administrators, who had previously advised Comet's owners; two former Deloitte partners (Neville Kahn, Christopher Farrington) were separately fined and reprimanded. (£925,000 fine + £890,000 costs (ICAEW consent order, concluded 30 January 2020)) (cityam.com, checked 20 September 2026)
  • Trustpilot: Deloitte's Trustpilot page is for deloitte.com globally, not a UK-specific profile. It shows a 1.3-star TrustScore from 225 reviews (about 90% one-star), with reviewers describing tax/administrative errors, unprofessional consultants and workplace complaints from engagements across the US, UK, Germany, Australia, Sri Lanka, Israel and Luxembourg. The profile is unclaimed by Deloitte, so the firm has not responded to reviews on the platform. G2/Capterra/Clutch were not checked, Deloitte is an advisory firm, not a software product. (Trustpilot, checked 20 September 2026)

Registered by the ICAEW to carry on audit work, reference C009201919 (stated on deloitte.com) Authorised and regulated by the FCA, reference 213218 (stated on deloitte.com) Authorised and regulated by the SRA as a multi-disciplinary practice, reference 646135 (stated on deloitte.com)

Exposed to the EU AI ActFirst DPO or AI policy

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.