# IT Governance (now GRC Solutions) - **Type:** Advisory firm - **Website:** https://grcsolutions.io - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A UK compliance firm, now trading as GRC Solutions, that sells consultancy, penetration testing and training alongside its own documentation toolkits and courses. ## IT Governance scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Describes breach management within its DPO service and incident-response consultancy, with one named client case study, but publishes no named practitioners or ICO-engagement outcomes (grcsolutions.io, checked 2026-07-16). ### Qualifications of the people who do the work: 2/5 Claims 'seasoned data protection officers, lawyers and barristers' but publishes no named consultants or verifiable individual qualifications on the service pages checked 2026-07-16. ### What it publishes about fees: 3/5 Product and training prices fully published (toolkits £195 to £495 ex VAT) and the DPO contract model is explained (one-year minimum, monthly billing), but no consultancy figures are published (checked 2026-07-16). ### Knowledge of your sector: 2/5 Portfolio is organised by framework (ISO 27001, GDPR, PCI DSS, ISO 42001) rather than sector; a health/life-sciences DPO product exists in the group shop but little sector-specific published work was found (checked 2026-07-16). ### Independence from what it sells: 3/5 Mixed model, openly operated: consultancy alongside the group's own toolkit/training shop with listed prices; site states independence from vendors and certification bodies but not from its own product range (grcsolutions.io/accredited-certification/, checked 2026-07-16). ### Who carries the risk if the advice is wrong: 3/5 Published purchase terms with a clear liability cap of twice fees paid (clause 14.1) and statutory carve-outs, but no professional indemnity cover disclosed (grcsolutions.io/legal/, checked 2026-07-16). ## Sources for IT Governance Every line carries the page it was read on and the date it was checked. - Companies House registration and accounts - Source: https://find-and-update.company-information.service.gov.uk/company/04418178 - Checked: 2026-10-13 - Rebrand to GRC Solutions: itgovernance.co.uk returns a 301 redirect to grcsolutions.io, whose homepage states 'IT Governance Ltd is now GRC Solutions', merging IT Governance Ltd, DQM GRC and GRCI Law under one brand - Source: https://grcsolutions.io/ - Checked: 2026-07-16 - Group ownership: The group privacy notice names IT Governance Ltd as data controller for group companies including GRC International Group Ltd, GRCI Law Limited, DQM GRC, IT Governance Europe Ltd and IT Governance Publishing Ltd; Companies House shows GRC International Group Limited (11036180, incorporated 27 October 2017, active, same Ely address) was GRC International Group PLC until 14 August 2024; the About page states the business was acquired by Bloom Equity Partners in 2024 and expanded via acquisition of BSI Group's Digital Trust Consulting division - Source: https://grcsolutions.io/legal/privacy-notice/ - Checked: 2026-07-16 - Product prices published: Sells its own documentation toolkits at listed prices, e.g. ISO 27001 Toolkit £395, GDPR Documentation Toolkit £295, ISO 27701 Toolkit £195, ISO 22301 Toolkit £495 (all ex VAT, annual subscription year 1) - Source: https://uk.grcsolutions.io/category/documentation-toolkits - Checked: 2026-07-16 - Consultancy pricing disclosure: DPO as a Service page publishes no price, customers must request a tailored quote, but discloses the contract model: one-year minimum contract paid monthly, with balance due if cancelled within the first year; the page references GRCI Law in its service description and testimonials - Source: https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service - Checked: 2026-07-16 - Named practitioner credentials: Does not publish named consultants or individual credentials on its DPO service pages as of 2026-07-16; describes its team as 'seasoned data protection officers, lawyers and barristers' without names - Source: https://grcsolutions.io/dpo-as-a-service/ - Checked: 2026-07-16 - Liability terms published: Published purchase terms cap total liability at 'twice the total amount paid by you under that contract' (clause 14.1), with statutory exclusions preserved; the contracting entity is IT Governance Limited; professional indemnity insurance is not mentioned - Source: https://grcsolutions.io/legal/terms-for-buying-goods-and-services-on-our-site/ - Checked: 2026-07-16 - Named client case study: Publishes a DPO as a Service case study naming client MyC (cloud medical-services platform), with a quote from Dr Laurent Bonnardot, Cofounder and Chairman, and outcomes including ISO 27001 certification in under 3 months - Source: https://grcsolutions.io/dpo-as-a-service-case-study/ - Checked: 2026-07-16 - AI-use disclosure: The group privacy notice does not disclose any AI tools GRC Solutions itself uses, nor name AI processors handling personal data, as of 2026-07-16 - Source: https://grcsolutions.io/legal/privacy-notice/ - Checked: 2026-07-16 - AI-governance service claims: Offers ISO 42001 and EU AI Act services (readiness assessment, framework design, AI red teaming, audit preparation), self-declared capability; the page makes no claim that GRC Solutions itself holds ISO 42001 certification - Source: https://grcsolutions.io/iso-42001-ai-governance/ - Checked: 2026-07-16 - Position on certification independence: States it is not a certification body: 'GRC Solutions is independent of vendors and certification bodies, and we encourage our clients to select the best-fit supplier of accredited certification services' - Source: https://grcsolutions.io/accredited-certification/ - Checked: 2026-07-16 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Not published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - Long-established provider, IT Governance Limited incorporated 16 April 2002 (Companies House 04418178), with a broad one-stop portfolio spanning GDPR, ISO 27001, PCI DSS, penetration testing and training - Extensive published pricing on products and training, e.g. GDPR Documentation Toolkit £295 and ISO 27001 Toolkit £395 ex VAT - Publishes clear engagement terms including a liability cap of twice fees paid, and a named DPO client case study (MyC) with attributed outcomes - Dedicated ISO 42001 and EU AI Act service line, including an AI Act & ISO 42001 gap analysis tool, plus a Trustpilot profile scoring 4.2 from 287 reviews ## Things to check Each one carries the factual basis it rests on. - Its consultancy sits alongside a shop selling the group's own toolkits, training and tools, so advice and product sales come from the same business, a factor for buyers weighing independence. - Basis: Toolkits sold at listed prices on uk.grcsolutions.io while the same brand sells implementation consultancy (both checked 2026-07-16); the firm's published independence statement covers vendors and certification bodies, not its own products (grcsolutions.io/accredited-certification/). - Its DPO service page describes the team but does not name the consultants or list their qualifications. - Basis: DPO as a Service pages describe 'seasoned data protection officers, lawyers and barristers' without naming anyone (grcsolutions.io/dpo-as-a-service/, checked 2026-07-16). - Publishes no consultancy prices, DPO as a Service is quote-only with a one-year minimum contract. - Basis: Product page states tailored quote required, one-year minimum paid monthly (uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service, checked 2026-07-16). ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [After a cyber attack: what to report, and to whom](https://theassurancedesk.com/best/security-incident) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.