The Assurance Desk
What GRCI Law offers, and what it publishes
GRCI Law's old website, grcilaw.com, now redirects to a page saying 'GRCI Law is now part of GRC Solutions'. The page says its services continue in the group: an outsourced DPO, privacy consultancy, subject access handling and EU and UK representative services. Clients can also use the group's cyber security, AI governance and ISO 27001 work.
GRCI Law does not publish a price. The group's DPO service, which refers to GRCI Law, is quote-only on a one-year minimum contract billed monthly. It names no lawyers and gives no credentials; its old team page now redirects. It does not publish indemnity cover or say how it uses AI.
GRCI Law sits in a group that also sells toolkits, training and software under the same brand. It shares an Ely registered office with IT Governance Limited, which the group privacy notice names as data controller for GRCI Law. The group's purchase terms cap liability at twice the fees but name IT Governance Limited, not GRCI Law, as the contracting party.
Strengths
- Legal-services specialism within an established group: the GRC Solutions transition page describes GRCI Law bringing 'specialist data protection legal advice', representative services and consultancy into the wider organisation
- Clients gain access to the wider group's capabilities, cyber security, AI governance, ISO 27001 consulting, training and toolkits, through one relationship
- The legal entity is verifiable and current: GRCI Law Limited, Companies House 11311669, active, incorporated 2018, registered under legal-activities SIC code 69109
Things to check
- The GRCI Law page now introduces GRC Solutions. It does not name the lawyers or list their qualifications.
- Publishes no pricing of any kind; the group DPO product it is associated with is quote-only with a one-year minimum contract.
- As part of the GRC International Group, its services sit alongside the group's own toolkit, training and software sales under the GRC Solutions brand.
- Ask about insurance for advice and how it uses AI. These were not explained in the group policies we checked.
Common questions
Does GRCI Law publish its prices?
No. The group's DPO service, which refers to GRCI Law, is quote-only on a one-year minimum contract billed monthly. No figures are published.
Is GRCI Law still a separate firm?
Not as a brand. GRCI Law Limited is still an active company, but its website redirects to a page saying 'GRCI Law is now part of GRC Solutions'. It sits in the same group as IT Governance.
Who are its lawyers?
It does not say. Its old team page redirects to a transition page that names no staff. Ask who would do your work and what qualifications they hold.
Evidence for each GRCI Law score
Show our working
Notes behind each thing to check
- The GRCI Law page now introduces GRC Solutions. It does not name the lawyers or list their qualifications. (grcilaw.com/topic/meet-the-team returns a 301 redirect to grcsolutions.io/grci-law/, which names no staff (checked 2026-07-16).)
- Publishes no pricing of any kind; the group DPO product it is associated with is quote-only with a one-year minimum contract. (grcsolutions.io/grci-law/ and uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service show no figures (checked 2026-07-16).)
- As part of the GRC International Group, its services sit alongside the group's own toolkit, training and software sales under the GRC Solutions brand. (Group privacy notice lists GRCI Law Limited among IT Governance Ltd group companies; the same brand sells toolkits at listed prices (grcsolutions.io, checked 2026-07-16).)
- Ask about insurance for advice and how it uses AI. These were not explained in the group policies we checked. (Group privacy notice and purchase terms contain no PI or own-AI-use disclosure (grcsolutions.io/legal/, checked 2026-07-16).)
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | Group pages reference breach management within the DPO service GRCI Law is associated with, but the current GRCI Law page publishes no incident or ICO-engagement detail, outcomes or named practitioners (checked 2026-07-16). | |
| Qualifications of the people who do the work | Group service pages claim delivery by 'data protection officers, lawyers and barristers', but no named GRCI Law staff or verifiable credentials are currently published; the former team page redirects (checked 2026-07-16). | |
| What it publishes about fees | No figures published anywhere; the associated group DPO product explains the fee model, one-year minimum contract billed monthly, tailored quote, which meets 'model explained, no figures' (uk.grcsolutions.io, checked 2026-07-16). | |
| Knowledge of your sector | Current public presence is a single brand-transition page with no sector practices, sector practitioners or sector-specific published work (grcsolutions.io/grci-law/, checked 2026-07-16). | |
| Independence from what it sells | Part of a group that sells its own toolkits, training and software under the same brand; the group relationship is openly disclosed on the transition page and privacy notice (checked 2026-07-16). | |
| Who carries the risk if the advice is wrong | No PI cover disclosed; group purchase terms with a liability cap exist but name IT Governance Limited as contracting entity, so GRCI Law-specific engagement terms are unclear (grcsolutions.io/legal/, checked 2026-07-16). |
Sources for GRCI Law
- Companies House registration: GRCI Law Limited, company number 11311669, incorporated 16 April 2018, status Active, registered office Unit 3 Bartholomew's Walk, Clive Court, Ely CB7 4EA, SIC 69109 (other legal activities) (Companies House, checked 16 July 2026)
- Brand absorbed into GRC Solutions: grcilaw.com returns a 301 redirect to grcsolutions.io/grci-law/, which states 'GRCI Law is now part of GRC Solutions' and that its core services continue within the wider organisation (grcsolutions.io, checked 16 July 2026)
- Common ownership with IT Governance: The group privacy notice names IT Governance Ltd as data controller for group companies including GRCI Law Limited and GRC International Group Ltd; GRCI Law Limited shares the same Ely registered office as IT Governance Limited (04418178) at Companies House (grcsolutions.io, checked 16 July 2026)
- Service scope: Data privacy consultancy, DPO as a Service, EU and UK GDPR representative services, and DSAR as a Service, now delivered under GRC Solutions with access to the group's cyber security, AI governance and ISO 27001 offerings (grcsolutions.io, checked 16 July 2026)
- Pricing disclosure: Publishes no fees, day rates or worked examples; the group's DPO as a Service product page, which references GRCI Law in its service description and testimonials, is quote-only with a one-year minimum contract billed monthly (uk.grcsolutions.io, checked 16 July 2026)
- Named practitioner credentials: Does not publish named lawyers or individual credentials on its current public page as of 2026-07-16; the former grcilaw.com meet-the-team page now redirects to the GRC Solutions transition page (grcsolutions.io, checked 16 July 2026)
- PI insurance / liability disclosure: Does not publish professional indemnity insurance on the pages checked as of 2026-07-16; the group's published purchase terms (liability capped at twice fees) name IT Governance Limited as the contracting entity (grcsolutions.io, checked 16 July 2026)
- AI-use disclosure: The group privacy notice covering GRCI Law Limited does not disclose any AI tools the business itself uses or name AI processors handling personal data, as of 2026-07-16 (grcsolutions.io, checked 16 July 2026)
First DPO or AI policyAfter a breach or ICO contact
Where this firm appears
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.