# GRCI Law - **Type:** Advisory firm - **Website:** https://www.grcilaw.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) The data protection legal arm of GRC International Group, now part of GRC Solutions, offering an outsourced DPO, consultancy, subject access handling and EU and UK representative services. ## GRCI Law scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Group pages reference breach management within the DPO service GRCI Law is associated with, but the current GRCI Law page publishes no incident or ICO-engagement detail, outcomes or named practitioners (checked 2026-07-16). ### Qualifications of the people who do the work: 2/5 Group service pages claim delivery by 'data protection officers, lawyers and barristers', but no named GRCI Law staff or verifiable credentials are currently published; the former team page redirects (checked 2026-07-16). ### What it publishes about fees: 3/5 No figures published anywhere; the associated group DPO product explains the fee model, one-year minimum contract billed monthly, tailored quote, which meets 'model explained, no figures' (uk.grcsolutions.io, checked 2026-07-16). ### Knowledge of your sector: 2/5 Current public presence is a single brand-transition page with no sector practices, sector practitioners or sector-specific published work (grcsolutions.io/grci-law/, checked 2026-07-16). ### Independence from what it sells: 3/5 Part of a group that sells its own toolkits, training and software under the same brand; the group relationship is openly disclosed on the transition page and privacy notice (checked 2026-07-16). ### Who carries the risk if the advice is wrong: 2/5 No PI cover disclosed; group purchase terms with a liability cap exist but name IT Governance Limited as contracting entity, so GRCI Law-specific engagement terms are unclear (grcsolutions.io/legal/, checked 2026-07-16). ## Sources for GRCI Law Every line carries the page it was read on and the date it was checked. - Companies House registration: GRCI Law Limited, company number 11311669, incorporated 16 April 2018, status Active, registered office Unit 3 Bartholomew's Walk, Clive Court, Ely CB7 4EA, SIC 69109 (other legal activities) - Source: https://find-and-update.company-information.service.gov.uk/company/11311669 - Checked: 2026-07-16 - Brand absorbed into GRC Solutions: grcilaw.com returns a 301 redirect to grcsolutions.io/grci-law/, which states 'GRCI Law is now part of GRC Solutions' and that its core services continue within the wider organisation - Source: https://grcsolutions.io/grci-law/ - Checked: 2026-07-16 - Common ownership with IT Governance: The group privacy notice names IT Governance Ltd as data controller for group companies including GRCI Law Limited and GRC International Group Ltd; GRCI Law Limited shares the same Ely registered office as IT Governance Limited (04418178) at Companies House - Source: https://grcsolutions.io/legal/privacy-notice/ - Checked: 2026-07-16 - Service scope: Data privacy consultancy, DPO as a Service, EU and UK GDPR representative services, and DSAR as a Service, now delivered under GRC Solutions with access to the group's cyber security, AI governance and ISO 27001 offerings - Source: https://grcsolutions.io/grci-law/ - Checked: 2026-07-16 - Pricing disclosure: Publishes no fees, day rates or worked examples; the group's DPO as a Service product page, which references GRCI Law in its service description and testimonials, is quote-only with a one-year minimum contract billed monthly - Source: https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service - Checked: 2026-07-16 - Named practitioner credentials: Does not publish named lawyers or individual credentials on its current public page as of 2026-07-16; the former grcilaw.com meet-the-team page now redirects to the GRC Solutions transition page - Source: https://grcsolutions.io/grci-law/ - Checked: 2026-07-16 - PI insurance / liability disclosure: Does not publish professional indemnity insurance on the pages checked as of 2026-07-16; the group's published purchase terms (liability capped at twice fees) name IT Governance Limited as the contracting entity - Source: https://grcsolutions.io/legal/terms-for-buying-goods-and-services-on-our-site/ - Checked: 2026-07-16 - AI-use disclosure: The group privacy notice covering GRCI Law Limited does not disclose any AI tools the business itself uses or name AI processors handling personal data, as of 2026-07-16 - Source: https://grcsolutions.io/legal/privacy-notice/ - Checked: 2026-07-16 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Not published - Client results: Not published - How it uses AI: Not published ## Strengths - Legal-services specialism within an established group: the GRC Solutions transition page describes GRCI Law bringing 'specialist data protection legal advice', representative services and consultancy into the wider organisation - Clients gain access to the wider group's capabilities, cyber security, AI governance, ISO 27001 consulting, training and toolkits, through one relationship - The legal entity is verifiable and current: GRCI Law Limited, Companies House 11311669, active, incorporated 2018, registered under legal-activities SIC code 69109 ## Things to check Each one carries the factual basis it rests on. - The GRCI Law page now introduces GRC Solutions. It does not name the lawyers or list their qualifications. - Basis: grcilaw.com/topic/meet-the-team returns a 301 redirect to grcsolutions.io/grci-law/, which names no staff (checked 2026-07-16). - Publishes no pricing of any kind; the group DPO product it is associated with is quote-only with a one-year minimum contract. - Basis: grcsolutions.io/grci-law/ and uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service show no figures (checked 2026-07-16). - As part of the GRC International Group, its services sit alongside the group's own toolkit, training and software sales under the GRC Solutions brand. - Basis: Group privacy notice lists GRCI Law Limited among IT Governance Ltd group companies; the same brand sells toolkits at listed prices (grcsolutions.io, checked 2026-07-16). - Ask about insurance for advice and how it uses AI. These were not explained in the group policies we checked. - Basis: Group privacy notice and purchase terms contain no PI or own-AI-use disclosure (grcsolutions.io/legal/, checked 2026-07-16). ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.