The Assurance Desk
What IT Governance offers, and what it publishes
IT Governance lists product prices: the GDPR documentation toolkit costs £295 and the ISO 27001 toolkit £395 for the first year, before VAT. Its purchase terms cap its liability at twice what the client paid. It publishes a named case study: MyC, a cloud medical services platform, reached ISO 27001 certification in under three months.
IT Governance does not publish consultancy prices. Its DPO service is quote-only, on a one-year minimum contract paid monthly, with the balance due if you cancel in the first year. It names no DPO consultants, calling its team 'seasoned data protection officers, lawyers and barristers'. Its terms do not mention professional indemnity insurance.
Advice and products come from the same business. Its independence statement covers vendors and certification bodies, not its own products. The firm says Bloom Equity Partners bought it in 2024. Trustpilot shows 4.2 out of 5 from 287 reviews. Companies House now shows accounts filed to March 2025, with the next accounts due in December 2026. It does not say how it uses AI itself.
Strengths
- Long-established provider, IT Governance Limited incorporated 16 April 2002 (Companies House 04418178), with a broad one-stop portfolio spanning GDPR, ISO 27001, PCI DSS, penetration testing and training
- Extensive published pricing on products and training, e.g. GDPR Documentation Toolkit £295 and ISO 27001 Toolkit £395 ex VAT
- Publishes clear engagement terms including a liability cap of twice fees paid, and a named DPO client case study (MyC) with attributed outcomes
- Dedicated ISO 42001 and EU AI Act service line, including an AI Act & ISO 42001 gap analysis tool, plus a Trustpilot profile scoring 4.2 from 287 reviews
Things to check
- Its consultancy sits alongside a shop selling the group's own toolkits, training and tools, so advice and product sales come from the same business, a factor for buyers weighing independence.
- Its DPO service page describes the team but does not name the consultants or list their qualifications.
- Publishes no consultancy prices, DPO as a Service is quote-only with a one-year minimum contract.
Common questions
Is IT Governance still trading under that name?
No. IT Governance Limited is still active at Companies House, but the brand is now GRC Solutions. The itgovernance.co.uk site redirects to grcsolutions.io.
Who owns GRC Solutions?
Its About page says Bloom Equity Partners bought the business in 2024 and added BSI Group's Digital Trust Consulting division. It sits within the GRC International Group, a plc until August 2024.
Does GRC Solutions publish its prices?
Partly. Products and training carry listed prices, such as £295 before VAT for the first year of the GDPR documentation toolkit. Consultancy is quote-only; its DPO service runs on a one-year minimum contract billed monthly.
Evidence for each IT Governance score
Show our working
Notes behind each thing to check
- Its consultancy sits alongside a shop selling the group's own toolkits, training and tools, so advice and product sales come from the same business, a factor for buyers weighing independence. (Toolkits sold at listed prices on uk.grcsolutions.io while the same brand sells implementation consultancy (both checked 2026-07-16); the firm's published independence statement covers vendors and certification bodies, not its own products (grcsolutions.io/accredited-certification/).)
- Its DPO service page describes the team but does not name the consultants or list their qualifications. (DPO as a Service pages describe 'seasoned data protection officers, lawyers and barristers' without naming anyone (grcsolutions.io/dpo-as-a-service/, checked 2026-07-16).)
- Publishes no consultancy prices, DPO as a Service is quote-only with a one-year minimum contract. (Product page states tailored quote required, one-year minimum paid monthly (uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service, checked 2026-07-16).)
| Criterion | Score | Evidence |
|---|---|---|
| Help when things go wrong | Describes breach management within its DPO service and incident-response consultancy, with one named client case study, but publishes no named practitioners or ICO-engagement outcomes (grcsolutions.io, checked 2026-07-16). | |
| Qualifications of the people who do the work | Claims 'seasoned data protection officers, lawyers and barristers' but publishes no named consultants or verifiable individual qualifications on the service pages checked 2026-07-16. | |
| What it publishes about fees | Product and training prices fully published (toolkits £195 to £495 ex VAT) and the DPO contract model is explained (one-year minimum, monthly billing), but no consultancy figures are published (checked 2026-07-16). | |
| Knowledge of your sector | Portfolio is organised by framework (ISO 27001, GDPR, PCI DSS, ISO 42001) rather than sector; a health/life-sciences DPO product exists in the group shop but little sector-specific published work was found (checked 2026-07-16). | |
| Independence from what it sells | Mixed model, openly operated: consultancy alongside the group's own toolkit/training shop with listed prices; site states independence from vendors and certification bodies but not from its own product range (grcsolutions.io/accredited-certification/, checked 2026-07-16). | |
| Who carries the risk if the advice is wrong | Published purchase terms with a clear liability cap of twice fees paid (clause 14.1) and statutory carve-outs, but no professional indemnity cover disclosed (grcsolutions.io/legal/, checked 2026-07-16). |
Sources for IT Governance
- Companies House registration and accounts (IT Governance Limited, company number 04418178, incorporated 16 April 2002, status Active. Accounts are filed to 31 March 2025. The next accounts, to 31 March 2026, are due by 31 December 2026. No accounts-overdue notice is displayed.) (Companies House, checked 13 October 2026)
- Rebrand to GRC Solutions: itgovernance.co.uk returns a 301 redirect to grcsolutions.io, whose homepage states 'IT Governance Ltd is now GRC Solutions', merging IT Governance Ltd, DQM GRC and GRCI Law under one brand (grcsolutions.io, checked 16 July 2026)
- Group ownership: The group privacy notice names IT Governance Ltd as data controller for group companies including GRC International Group Ltd, GRCI Law Limited, DQM GRC, IT Governance Europe Ltd and IT Governance Publishing Ltd; Companies House shows GRC International Group Limited (11036180, incorporated 27 October 2017, active, same Ely address) was GRC International Group PLC until 14 August 2024; the About page states the business was acquired by Bloom Equity Partners in 2024 and expanded via acquisition of BSI Group's Digital Trust Consulting division (grcsolutions.io, checked 16 July 2026)
- Product prices published: Sells its own documentation toolkits at listed prices, e.g. ISO 27001 Toolkit £395, GDPR Documentation Toolkit £295, ISO 27701 Toolkit £195, ISO 22301 Toolkit £495 (all ex VAT, annual subscription year 1) (uk.grcsolutions.io, checked 16 July 2026)
- Consultancy pricing disclosure: DPO as a Service page publishes no price, customers must request a tailored quote, but discloses the contract model: one-year minimum contract paid monthly, with balance due if cancelled within the first year; the page references GRCI Law in its service description and testimonials (uk.grcsolutions.io, checked 16 July 2026)
- Named practitioner credentials: Does not publish named consultants or individual credentials on its DPO service pages as of 2026-07-16; describes its team as 'seasoned data protection officers, lawyers and barristers' without names (grcsolutions.io, checked 16 July 2026)
- Liability terms published: Published purchase terms cap total liability at 'twice the total amount paid by you under that contract' (clause 14.1), with statutory exclusions preserved; the contracting entity is IT Governance Limited; professional indemnity insurance is not mentioned (grcsolutions.io, checked 16 July 2026)
- Named client case study: Publishes a DPO as a Service case study naming client MyC (cloud medical-services platform), with a quote from Dr Laurent Bonnardot, Cofounder and Chairman, and outcomes including ISO 27001 certification in under 3 months (grcsolutions.io, checked 16 July 2026)
- AI-use disclosure: The group privacy notice does not disclose any AI tools GRC Solutions itself uses, nor name AI processors handling personal data, as of 2026-07-16 (grcsolutions.io, checked 16 July 2026)
- AI-governance service claims: Offers ISO 42001 and EU AI Act services (readiness assessment, framework design, AI red teaming, audit preparation), self-declared capability; the page makes no claim that GRC Solutions itself holds ISO 42001 certification (grcsolutions.io, checked 16 July 2026)
- Position on certification independence: States it is not a certification body: 'GRC Solutions is independent of vendors and certification bodies, and we encourage our clients to select the best-fit supplier of accredited certification services' (grcsolutions.io, checked 16 July 2026)
- Trustpilot: TrustScore 4.2 from 287 reviews; the profile now displays the name 'GRC Solutions' (80% 5-star, 5% 1-star per Trustpilot listing data) (Trustpilot, checked 16 July 2026)
CREST member (self-stated on grcsolutions.io, checked 2026-07-16) CHECK assured provider (self-stated on grcsolutions.io, checked 2026-07-16)
Seeking ISO 42001 certificationFirst DPO or AI policyExposed to the EU AI ActAfter a breach or ICO contactAfter a ransomware or security incident
Where this firm appears
- Do you need a data protection officer?
- Can the firm that prepares you also certify you?
- After a data breach: what UK law asks of you
- Does the EU AI Act apply to a UK firm?
- After a cyber attack: what to report, and to whom
- Which data protection, AI governance and cyber security providers publish a price?
- Compare providers
If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.
This is an independent editorial guide, not legal advice.