# HewardMills - **Type:** Advisory firm - **Website:** https://hewardmills.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A founder-led privacy consultancy selling outsourced DPO services. It says it covers more than 70 jurisdictions and is a certified B Corporation. ## HewardMills scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Describes a data breach and incident response service including managing reporting obligations, but publishes no outcomes or named case evidence (hewardmills.com/services/, 2026-07-16) ### Qualifications of the people who do the work: 2/5 Team named with roles but per-person IAPP/legal qualifications are not published on the site as of 2026-07-16 (hewardmills.com/about-us/) ### What it publishes about fees: 2/5 Two DPO packages described but no fee model, figures or worked examples published; only a 25% B Corp discount is stated (hewardmills.com, 2026-07-16) ### Knowledge of your sector: 3/5 Claims focus on life sciences, technology, retail and banking with anonymised sector case studies but no named sector practitioners (hewardmills.com/about-us/ and /services/, 2026-07-16) ### Independence from what it sells: 4/5 Published statement of exclusive data-protection focus without conflicts of interest and no software product observed; statement is self-declared (hewardmills.com/dpo-essentials/, 2026-07-16) ### Who carries the risk if the advice is wrong: 2/5 Breach-response support is described as a service, but no PI cover or engagement liability terms are published as of 2026-07-16 (hewardmills.com/services/) ## Sources for HewardMills Every line carries the page it was read on and the date it was checked. - Companies House registration: HEWARDMILLS LTD, company number 11211970, incorporated 19 February 2018, status Active, registered office 77 Farringdon Road, London EC1M 3JU - Source: https://find-and-update.company-information.service.gov.uk/company/11211970 - Checked: 2026-07-16 - Service scope: Outsourced DPO services in two packages (DPO Essentials and DPO Advanced) plus information security and data protection consultancy, GDPR compliance and data mapping, international transfers, data breach and incident response, and training, claimed across 70+ jurisdictions - Source: https://hewardmills.com/services/ - Checked: 2026-07-16 - Pricing disclosure: Does not publish prices, retainers or day rates on its public website as of 2026-07-16; the homepage advertises a 25% discount for other certified B Corporations but no base figures - Source: https://hewardmills.com - Checked: 2026-07-16 - Team credentials: About page names its team and roles, including CEO/DPO Dyann Heward-Mills and a Chief Operating Officer who is also AI Governance and Ethics Lead, but does not publish per-person IAPP or legal qualifications on that page as of 2026-07-16 - Source: https://hewardmills.com/about-us/ - Checked: 2026-07-16 - PI insurance / liability: Does not publish professional-indemnity cover or engagement liability terms on the public pages checked (homepage, services, about, privacy notice) as of 2026-07-16 - Source: https://hewardmills.com/services/ - Checked: 2026-07-16 - Independent accreditation: Describes itself as a certified B Corporation on its about page; no ISO certifications for the firm itself are published on the pages checked as of 2026-07-16 - Source: https://hewardmills.com/about-us/ - Checked: 2026-07-16 - Named client outcomes: Case studies on the services page are anonymised (e.g. 'a global biotechnology company', 'a global leader in battery recycling'); no named client case studies were found on the pages checked as of 2026-07-16 - Source: https://hewardmills.com/services/ - Checked: 2026-07-16 - AI-use disclosure: Privacy notice (last updated 25/03/2026) covers CRM and Google Analytics use and states no automated decision-making with legal effects, but does not publish a statement on the firm's own use of AI tools as of 2026-07-16 - Source: https://hewardmills.com/privacy-notice/ - Checked: 2026-07-16 - Independence statement: DPO Essentials page states 'We focus exclusively on Data Protection and Privacy, delivering expert advice and solutions without conflicts of interest' - Source: https://hewardmills.com/dpo-essentials/ - Checked: 2026-07-16 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Not published - Client results: Not published - How it uses AI: Not published ## Strengths - Focuses exclusively on data protection and privacy, with a published no-conflicts statement and no software product to sell - Global DPO coverage claimed across 70+ jurisdictions with offices in the USA, Europe, Africa and Asia - Publishes a substantive, recently updated privacy notice (last updated 25/03/2026) covering international transfers and marketing data - Values-led positioning: self-declared B Corp certification and a published breach and incident response service ## Things to check Each one carries the factual basis it rests on. - No prices, fee models or worked examples are published beyond a 25% B Corp discount offer. - Basis: Homepage and DPO package pages contain no figures or fee-model detail as of 2026-07-16 (hewardmills.com) - Team members are named but individual IAPP or legal qualifications are not published on the site. - Basis: About page lists names and roles only, without per-person credentials (hewardmills.com/about-us/, 2026-07-16) - Published case studies are anonymised, so client outcomes cannot be independently checked. - Basis: Services page case studies refer to 'a global biotechnology company' and 'our client' without names (hewardmills.com/services/, 2026-07-16) - Does not disclose how the firm itself uses AI, and does not publish PI insurance or liability terms. - Basis: Privacy notice contains no AI-tool statement and no PI/liability disclosure found on pages checked 2026-07-16 (hewardmills.com/privacy-notice/) ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.