# Evalian - **Type:** Advisory firm - **Website:** https://evalian.co.uk - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A UK consultancy combining outsourced DPO work with cyber security, penetration testing, ISO certification support and AI governance. ## Evalian scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 DPO service includes prioritised breach support and a cyber incident response practice with named qualified leaders, but no ICO-engagement outcomes are published (evalian.co.uk/data-protection/, 2026-07-16) ### Qualifications of the people who do the work: 5/5 Named practitioners with published, individually listed legal and IAPP credentials (barrister CEO; solicitor head of data protection with CIPP/E) (evalian.co.uk/about-us/, 2026-07-16) ### What it publishes about fees: 3/5 Three engagement models (day rate, fixed price, subscription) explained but no figures published (evalian.co.uk, 2026-07-16) ### Knowledge of your sector: 3/5 Sector-specific published work exists (e.g. RTS audits for gambling operators, recruitment-sector AI governance case studies) but no named sector practices (evalian.co.uk/case-studies/, 2026-07-16) ### Independence from what it sells: 4/5 Consultancy model with no compliance software product to sell; also acts as a certification/testing provider, roles disclosed on its own pages (evalian.co.uk/about-us/, 2026-07-16) ### Who carries the risk if the advice is wrong: 2/5 Prioritised breach-response commitment published within DPO tiers, but no PI cover or liability terms disclosed as of 2026-07-16 (evalian.co.uk/data-protection/) ## Sources for Evalian Every line carries the page it was read on and the date it was checked. - Companies House registration: EVALIAN LIMITED, company number 11314058, incorporated 17 April 2018, status Active, registered office Unit 5, West Lodge, Nobs Crook, Colden Common, Winchester SO21 1TH - Source: https://find-and-update.company-information.service.gov.uk/company/11314058 - Checked: 2026-07-16 - Service scope: Outsourced DPO services (tiers: DPO Essentials, DPO Support, DPO Complete), GDPR audits and consultancy, penetration testing, managed SOC, ISO 27001/22301/9001 consultancy, and AI governance including EU AI Act compliance support and ISO/IEC 42001 implementation - Source: https://evalian.co.uk/data-protection/ - Checked: 2026-07-16 - Pricing disclosure: Does not publish fee figures on its public website as of 2026-07-16, but explains three engagement models, fixed-rate consultancy days, fixed-price project outcomes and 12-month fixed-monthly-fee subscriptions - Source: https://evalian.co.uk - Checked: 2026-07-16 - Team credentials: About page publishes named leaders with per-person qualifications: CEO Sean Huggett (qualified barrister, called 1998; CISM, CISA, CRISC, CIPP/E, CIPT among others) and Head of Data Protection Ray Orife (qualified solicitor, CIPP/E), with the wider team holding CIPP/E, CIPM and legal qualifications - Source: https://evalian.co.uk/about-us/ - Checked: 2026-07-16 - PI insurance / liability: Does not publish professional-indemnity cover or engagement liability terms on the public pages checked (about, data protection, AI governance) as of 2026-07-16 - Source: https://evalian.co.uk/about-us/ - Checked: 2026-07-16 - Independent accreditation: About page lists firm certifications to ISO 9001, ISO 27001 and ISO 22301 with certificates linked via BABcert, plus CREST approval and Cyber Essentials Plus - Source: https://evalian.co.uk/about-us/ - Checked: 2026-07-16 - Named client outcomes: Publishes named client case studies including Ithaca Partners, Caraffi, Aviator Hotel, cadDo and Grant McGregor, several covering data protection and AI governance work - Source: https://evalian.co.uk/case-studies/ - Checked: 2026-07-16 - AI-use disclosure: Privacy notice states 'We do not make any decisions about you based solely on automated decisions or AI-driven profiling' and names tools such as Microsoft 365, Hotjar and ZoomInfo, but does not publish a statement describing the firm's own operational use of AI tools as of 2026-07-16 - Source: https://evalian.co.uk/privacy-notice/ - Checked: 2026-07-16 - EU AI Act / ISO 42001 services: AI governance page offers EU AI Act compliance support, ISO/IEC 42001:2023 implementation, gap analyses, FRIA support and AI awareness training; these service claims are self-declared rather than independently verified - Source: https://evalian.co.uk/ai-governance-services/ - Checked: 2026-07-16 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - Publishes ISO 9001, ISO 27001 and ISO 22301 certificates, plus CREST approval and Cyber Essentials Plus. - Named, individually credentialed leadership including a barrister CEO and solicitor head of data protection - Rated 4.8 out of 5 from 57 reviews on Trustpilot. The company invites customers to review. - Named client case studies spanning DPO, AI governance and ISO certification outcomes ## Things to check Each one carries the factual basis it rests on. - Engagement models are explained but no fee figures or worked examples are published. - Basis: Homepage describes consultancy days, fixed-price projects and subscriptions without figures (evalian.co.uk, 2026-07-16) - Does not publish professional-indemnity cover or engagement liability terms on its public site. - Basis: No PI/liability disclosure found on about or service pages checked 2026-07-16 (evalian.co.uk/about-us/) - Does not disclose how the firm itself uses AI operationally, beyond stating it makes no solely automated decisions. - Basis: Privacy notice contains no description of the firm's own AI-tool use as of 2026-07-16 (evalian.co.uk/privacy-notice/) ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.