# Deloitte LLP - **Type:** Advisory firm - **Website:** https://www.deloitte.com/uk/en - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A large UK professional services firm whose Digital Trust & Privacy practice advises on data protection and AI governance, alongside audit, tax and wider consulting. ## Deloitte scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 FRC opened a statutory investigation (23 Jul 2025) into Deloitte's Glencore audits, FY2013-2020; outcome unresolved as of Sep 2026. ### Qualifications of the people who do the work: 4/5 Deloitte LLP publishes ICAEW audit registration (C009201919), FCA authorisation (213218) and SRA registration (646135) on its own regulators page. ### What it publishes about fees: 2/5 Deloitte's UK GDPR/privacy advisory page publishes no fee rates, pricing model or cost information; terms given on request only. ### Knowledge of your sector: 4/5 Named Partner Peter Gooch leads Digital Trust & Privacy, specialising in consumer Privacy, Data Protection and cyber security, alongside a dedicated AI Institute UK. ### Independence from what it sells: 4/5 No evidence found that Deloitte's DP/AI-governance advice is contingent on selling a proprietary compliance software product to clients. ### Who carries the risk if the advice is wrong: 3/5 Deloitte LLP holds an SRA-recorded professional indemnity insurance waiver with bespoke terms; cover level and policy details are not publicly disclosed. ## Sources for Deloitte Every line carries the page it was read on and the date it was checked. - Deloitte LLP is an active limited liability partnership incorporated on 10 January 2003, registered office 1 New Street Square, London EC4A 3HQ. - Source: https://find-and-update.company-information.service.gov.uk/company/OC303675 - Checked: 2026-09-19 - Deloitte LLP publishes its own regulatory registrations: registered to carry on audit work by the ICAEW (ref C009201919), authorised and regulated by the FCA (ref 213218), and authorised and regulated by the SRA as a multi-disciplinary practice (ref 646135). - Source: https://www.deloitte.com/uk/en/legal/regulators-and-provision-service-regulations.html - Checked: 2026-09-19 - The Financial Reporting Council announced on 23 July 2025 that it had opened a statutory investigation into Deloitte LLP's audits of Glencore plc and Glencore Energy UK Limited for the financial years ended 31 December 2013 to 31 December 2020, examining whether Deloitte gave sufficient consideration to the risk of non-compliance with laws and regulations. - Source: https://www.frc.org.uk/news-and-events/news/2025/07/investigation-regarding-the-audit-of-glencore-plc-and-its-subsidiary-glencore-energy-uk-limited-by-deloitte-llp/ - Checked: 2026-09-19 - Deloitte UK's Digital Trust & Privacy practice, which covers GDPR and data-protection advisory, is led by named Partner Peter Gooch, who the firm states 'specialises in consumer Privacy, Data Protection and information/cyber security'. - Source: https://www.deloitte.com/uk/en/services/consulting/services/digital-trust-and-privacy.html - Checked: 2026-09-19 - Deloitte UK appointed Hayley McKelvey as its first firm-wide Chief AI Officer in 2026; separately the Deloitte AI Institute UK, led by Sulabh Soral, publishes research on AI governance and enterprise AI adoption. - Source: https://www.deloitte.com/uk/en/about/press-room/deloitte-uk-appoints-first-chief-ai-officer-2026.html - Checked: 2026-09-19 - Deloitte's 2024 UK privacy statement discloses that data used for its own AI processing may be routed through Airtable's US servers before being sent to EU-hosted large language models (Microsoft Copilot, Google Gemini, OpenAI ChatGPT), and states customer data is not retained or used for model training. - Source: https://www.deloitte.com/uk/en/legal/privacy-statement-2024.html - Checked: 2026-09-19 - In January 2020 the ICAEW ordered Deloitte to pay a £925,000 fine plus £890,000 in ICAEW costs, via a consent order concluding a five-year investigation into conflicts of interest in Deloitte's 2012 administration of Comet Group. The ICAEW found Deloitte's client take-on procedure failed to address threats to the independence of its administrators, who had previously advised Comet's owners; two former Deloitte partners (Neville Kahn, Christopher Farrington) were separately fined and reprimanded. - Source: https://www.cityam.com/deloitte-fined-1-8m-and-reprimanded-over-comet-administration-failures/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Published ## Strengths - Digital Trust & Privacy practice has a named, dedicated Partner lead (Peter Gooch) with a stated privacy/data-protection specialism, not a generalist claim. - Operates a dedicated Deloitte AI Institute UK plus a firm-wide Chief AI Officer role (Hayley McKelvey, appointed 2026), both producing published AI research. - Publishes an unusually specific account of its own AI data-processing practice, including cross-border data flow and a no-model-training commitment, in its 2024 UK privacy statement. ## Things to check Each one carries the factual basis it rests on. - An FRC statutory investigation into Deloitte's historic statutory audits of Glencore is open and unresolved. - Basis: FRC's own notice (23 Jul 2025): investigation into Deloitte LLP's audits of Glencore plc/Glencore Energy UK, FY2013-2020; no findings published as of 19 Sep 2026. - No fee rates, pricing model, or cost information is published for Deloitte UK's GDPR/privacy/AI-governance advisory services. - Basis: Deloitte's own GDPR/privacy-advisory service page (deloitte.com) contains no pricing or fee information; engagement terms given on request only. - In January 2020 the ICAEW fined Deloitte £925,000 (plus £890,000 costs) after a five-year investigation found its client take-on process failed to identify a conflict-of-interest threat to the independence of its Comet Group administrators. - Basis: https://www.cityam.com/deloitte-fined-1-8m-and-reprimanded-over-comet-administration-failures/ ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.