The Assurance Desk
What Evalian offers, and what it publishes
Evalian sells outsourced-DPO work in three subscriptions: DPO Essentials, DPO Support and DPO Complete. The offer includes ICO registration as your DPO and prioritised breach support. Its about page names its leaders: chief executive Sean Huggett, a barrister, and head of data protection Ray Orife, a solicitor with CIPP/E. It publishes named case studies, including Ithaca Partners and cadDo.
Evalian does not publish a price. It explains three ways to pay: fixed-rate consultancy days, fixed-price projects and 12-month fixed monthly fees, but gives no figures. It does not publish professional indemnity cover or liability terms. It does not say how it uses AI in its own work.
Evalian's about page lists the firm's ISO 9001, ISO 27001 and ISO 22301 certificates, linked through BABcert, plus CREST approval and Cyber Essentials Plus. Trustpilot gives it 4.8 out of 5 from 57 reviews on a claimed profile. The company invites customers to review.
Strengths
- Publishes ISO 9001, ISO 27001 and ISO 22301 certificates, plus CREST approval and Cyber Essentials Plus.
- Named, individually credentialed leadership including a barrister CEO and solicitor head of data protection
- Rated 4.8 out of 5 from 57 reviews on Trustpilot. The company invites customers to review.
- Named client case studies spanning DPO, AI governance and ISO certification outcomes
Things to check
- Engagement models are explained but no fee figures or worked examples are published.
- Does not publish professional-indemnity cover or engagement liability terms on its public site.
- Does not disclose how the firm itself uses AI operationally, beyond stating it makes no solely automated decisions.
Common questions
Does Evalian publish prices?
No. It publishes no figures. It explains three models: fixed-rate consultancy days, fixed-price projects and 12-month fixed monthly fees, quoted on enquiry.
Is Evalian itself certified?
Yes, by its own account. Its about page lists its own ISO 9001, ISO 27001 and ISO 22301 certificates, linked through BABcert, plus CREST approval and Cyber Essentials Plus.
Can Evalian help with the EU AI Act and ISO 42001?
Yes, by its own account. Its AI governance page offers EU AI Act support, ISO/IEC 42001:2023 implementation, gap analysis and AI awareness training.
Evidence for each Evalian score
Show our working
Notes behind each thing to check
- Engagement models are explained but no fee figures or worked examples are published. (Homepage describes consultancy days, fixed-price projects and subscriptions without figures (evalian.co.uk, 2026-07-16))
- Does not publish professional-indemnity cover or engagement liability terms on its public site. (No PI/liability disclosure found on about or service pages checked 2026-07-16 (evalian.co.uk/about-us/))
- Does not disclose how the firm itself uses AI operationally, beyond stating it makes no solely automated decisions. (Privacy notice contains no description of the firm's own AI-tool use as of 2026-07-16 (evalian.co.uk/privacy-notice/))
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | DPO service includes prioritised breach support and a cyber incident response practice with named qualified leaders, but no ICO-engagement outcomes are published (evalian.co.uk/data-protection/, 2026-07-16) | |
| Qualifications of the people who do the work | Named practitioners with published, individually listed legal and IAPP credentials (barrister CEO; solicitor head of data protection with CIPP/E) (evalian.co.uk/about-us/, 2026-07-16) | |
| What it publishes about fees | Three engagement models (day rate, fixed price, subscription) explained but no figures published (evalian.co.uk, 2026-07-16) | |
| Knowledge of your sector | Sector-specific published work exists (e.g. RTS audits for gambling operators, recruitment-sector AI governance case studies) but no named sector practices (evalian.co.uk/case-studies/, 2026-07-16) | |
| Independence from what it sells | Consultancy model with no compliance software product to sell; also acts as a certification/testing provider, roles disclosed on its own pages (evalian.co.uk/about-us/, 2026-07-16) | |
| Who carries the risk if the advice is wrong | Prioritised breach-response commitment published within DPO tiers, but no PI cover or liability terms disclosed as of 2026-07-16 (evalian.co.uk/data-protection/) |
Sources for Evalian
- Companies House registration: EVALIAN LIMITED, company number 11314058, incorporated 17 April 2018, status Active, registered office Unit 5, West Lodge, Nobs Crook, Colden Common, Winchester SO21 1TH (Companies House, checked 16 July 2026)
- Service scope: Outsourced DPO services (tiers: DPO Essentials, DPO Support, DPO Complete), GDPR audits and consultancy, penetration testing, managed SOC, ISO 27001/22301/9001 consultancy, and AI governance including EU AI Act compliance support and ISO/IEC 42001 implementation (evalian.co.uk, checked 16 July 2026)
- Pricing disclosure: Does not publish fee figures on its public website as of 2026-07-16, but explains three engagement models, fixed-rate consultancy days, fixed-price project outcomes and 12-month fixed-monthly-fee subscriptions (evalian.co.uk, checked 16 July 2026)
- Team credentials: About page publishes named leaders with per-person qualifications: CEO Sean Huggett (qualified barrister, called 1998; CISM, CISA, CRISC, CIPP/E, CIPT among others) and Head of Data Protection Ray Orife (qualified solicitor, CIPP/E), with the wider team holding CIPP/E, CIPM and legal qualifications (evalian.co.uk, checked 16 July 2026)
- PI insurance / liability: Does not publish professional-indemnity cover or engagement liability terms on the public pages checked (about, data protection, AI governance) as of 2026-07-16 (evalian.co.uk, checked 16 July 2026)
- Independent accreditation: About page lists firm certifications to ISO 9001, ISO 27001 and ISO 22301 with certificates linked via BABcert, plus CREST approval and Cyber Essentials Plus (evalian.co.uk, checked 16 July 2026)
- Named client outcomes: Publishes named client case studies including Ithaca Partners, Caraffi, Aviator Hotel, cadDo and Grant McGregor, several covering data protection and AI governance work (evalian.co.uk, checked 16 July 2026)
- AI-use disclosure: Privacy notice states 'We do not make any decisions about you based solely on automated decisions or AI-driven profiling' and names tools such as Microsoft 365, Hotjar and ZoomInfo, but does not publish a statement describing the firm's own operational use of AI tools as of 2026-07-16 (evalian.co.uk, checked 16 July 2026)
- EU AI Act / ISO 42001 services: AI governance page offers EU AI Act compliance support, ISO/IEC 42001:2023 implementation, gap analyses, FRIA support and AI awareness training; these service claims are self-declared rather than independently verified (evalian.co.uk, checked 16 July 2026)
- Trustpilot: TrustScore 4.8 out of 5 from 57 reviews. Profile claimed in September 2024; Trustpilot says the company invites customers to review. (Trustpilot, checked 13 October 2026)
ISO 9001, ISO 27001 and ISO 22301 certified, certificates linked via BABcert on its about page (evalian.co.uk/about-us/, 2026-07-16) CREST-approved for penetration testing, vulnerability assessment and SOC services (evalian.co.uk/about-us/, 2026-07-16) Cyber Essentials Plus certified (evalian.co.uk/about-us/, 2026-07-16)
First DPO or AI policySeeking ISO 42001 certificationExposed to the EU AI ActAfter a breach or ICO contactAfter a ransomware or security incident
Where this firm appears
- Do you need a data protection officer?
- Can the firm that prepares you also certify you?
- After a data breach: what UK law asks of you
- Does the EU AI Act apply to a UK firm?
- After a cyber attack: what to report, and to whom
- Compare providers
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.