We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Kafico logo

Kafico review

Advisory firm

A UK data protection consultancy focused on GP practices and health. It offers a retained data protection officer, ISO 27001 help, AI assurance and training.

Relevant if you run a GP practice or health business and want a named, qualified DPO

Price Published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Kafico scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 4/5
What it publishes about fees 4/5
Knowledge of your sector 4/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 1/5

What Kafico offers, and what it publishes

Kafico's clearest focus is GP practices. The firm says its primary-care service supports 110+ GP practices, with NHS incident scoring and DSP Toolkit support. Its lead DPO, Emma Cooper, lists a master's degree in information rights law and practice (LLM); its security lead, Jeff Pullen, lists CISSP and CCSP.

Kafico publishes some prices. An ISO 27001 mini audit costs £199, fast-track work from £1,000 and full certification help typically from £10,000. Its Ask Kafico service charges £20 a question at a pilot rate. It gives no price for its retained DPO service. It does not say whether it holds professional indemnity insurance.

Kafico sells AI assurance and its own platforms, LENS and myKafico, alongside its advice. It does not say how it uses AI itself or where client data goes. It does not say it holds ISO 27001 itself, and publishes no IAPP qualifications for its staff.

Strengths

  • Publishes actual consultancy figures, ISO 27001 Mini Audit £199, fast-track from £1,000, certification partnership from £10,000, and £20-per-question advisory, which is unusual in this market
  • Deep, evidenced primary-care specialism: a dedicated DPO platform serving 110+ GP practices with NHS incident scoring and DSP Toolkit support
  • Named team with published credentials, including a Lead DPO holding an LLM in Information Rights Law and Practice and a security lead holding CISSP and CCSP
  • Publishes testimonials from named clients including an NHS GP practice (Thorpewood Medical Group)

Things to check

  • Ask for its insurance cover and contract terms. These were not set out on the pages we checked.
  • Does not disclose how it itself uses AI or where client data goes in AI processing, despite selling AI-assurance services and its own LENS platform.
  • No IAPP certifications (CIPP/E, CIPM) are published for any staff, and no firm-held ISO certification is claimed.
  • Retained DPO pricing is not published, only ISO 27001 packages and the per-question service carry figures.

Common questions

Does Kafico publish its prices?

Partly. ISO 27001 work has prices: £199 for a mini audit, from £1,000 for fast-track work and typically from £10,000 for full certification help. Its Ask Kafico service costs £20 a question at a pilot rate. Retained DPO work is quoted on request.

Does Kafico work with GP practices?

Yes. The firm says its primary-care DPO service supports 110+ GP practices, with NHS incident scoring and DSP Toolkit support. Thorpewood Medical Group, an NHS GP practice, gives a named testimonial.

Does Kafico say how it uses AI?

No. It sells AI assurance and its own LENS platform, but its AI page and privacy policy do not say how it uses AI itself or where client data goes.

Evidence for each Kafico score

Show our working

Notes behind each thing to check

  • Ask for its insurance cover and contract terms. These were not set out on the pages we checked. (Privacy/policies page (kafico.co.uk/privacy) and service pages checked 2026-07-16 contain no PI or liability disclosure.)
  • Does not disclose how it itself uses AI or where client data goes in AI processing, despite selling AI-assurance services and its own LENS platform. (AI page (kafico.co.uk/ai) and privacy policy checked 2026-07-16 contain no own-AI-use statement.)
  • No IAPP certifications (CIPP/E, CIPM) are published for any staff, and no firm-held ISO certification is claimed. (Team page lists BCS, CISSP/CCSP and LLM credentials only; ISO 27001 page does not state Kafico itself is certified (both checked 2026-07-16).)
  • Retained DPO pricing is not published, only ISO 27001 packages and the per-question service carry figures. (DPO services page directs to a quote form with no fees shown (kafico.co.uk/dpo-services, checked 2026-07-16).)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 Breach and incident support offered via retained DPO, Ask Kafico and platform incident reporting with NHS scoring, delivered by named qualified staff, but no ICO-engagement outcomes published (kafico.co.uk, checked 2026-07-16).
Qualifications of the people who do the work 4/5 Named team with published credentials, Lead DPO with LLM in Information Rights Law, CISSP/CCSP security lead, BCS practitioners, though no IAPP certifications published (kafico.co.uk/meettheteam, 2026-07-16).
What it publishes about fees 4/5 Publishes real figures: ISO 27001 Mini Audit £199, fast-track from £1,000, certification partnership from £10,000, Ask Kafico £20/question; DPO retainer remains quote-only and exclusions are not itemised (checked 2026-07-16).
Knowledge of your sector 4/5 Dedicated primary-care DPO platform serving 110+ GP practices with NHS DSP Toolkit support, sector training, and a named NHS GP client testimonial (kafico.co.uk, checked 2026-07-16).
Independence from what it sells 3/5 Sells its own LENS AI-assurance and myKafico platforms alongside advice; product ownership is clearly branded but the advice/product boundary is not separately disclosed (checked 2026-07-16).
Who carries the risk if the advice is wrong 1/5 No PI insurance, liability terms or breach-response commitments published on the public site as of 2026-07-16.

Sources for Kafico

  • Companies House registration: Kafico Limited, company number 10313938, incorporated 5 August 2016, status Active, registered office 26 Den Hill, Eastbourne BN20 8SZ, SIC 63990 (Companies House, checked 16 July 2026)
  • ICO registration: Registered with the Information Commissioner as a data controller, registration number ZA422651 (stated in its privacy policy) (kafico.co.uk, checked 16 July 2026)
  • Service scope: Retained DPO services, Primary Care DPO platform serving 110+ GP practices, ISO 27001 implementation consultancy, AI governance and the LENS AI-assurance platform, GDPR training, and 'Ask Kafico' advisory service (kafico.co.uk, checked 16 July 2026)
  • Published consultancy pricing: ISO 27001 page publishes figures: Mini Audit (Express) £199, 'Gap & Go' fast-track from £1,000, full certification partnership typically from £10,000 depending on scope, with annual maintenance noted as similar to Year 1 (kafico.co.uk, checked 16 July 2026)
  • Published advisory pricing: 'Ask Kafico' service publishes a pilot rate of £20 per straightforward data protection question, answered within 2 working days (kafico.co.uk, checked 16 July 2026)
  • Published team credentials: Named team page lists Emma Cooper (Director and Lead DPO, LLM Information Rights Law and Practice, BCS DPO and FOI), Jeff Pullen (Info Security and Accreditations Lead, CISSP, CCSP, ISO 27001), and BCS Foundation-qualified staff (kafico.co.uk, checked 16 July 2026)
  • Named client testimonials: DPO services page carries testimonials attributed to named clients: Sawyer & Co (block and estate management), ImproveWell, and Thorpewood Medical Group (NHS GP practice) (kafico.co.uk, checked 16 July 2026)
  • PI insurance disclosure: Does not publish professional indemnity insurance details on its public website as of 2026-07-16 (privacy/policies page checked) (kafico.co.uk, checked 16 July 2026)
  • AI-use disclosure: Does not disclose how Kafico itself uses AI tools or where client data goes in AI processing, on its AI services page or privacy policy, as of 2026-07-16 (kafico.co.uk, checked 16 July 2026)
  • Own AI product: LENS is Kafico's proprietary AI-assurance platform for healthcare (assessing AI systems for governance, clinical safety and accountability); no third-party certification of the platform is claimed on the page (kafico.co.uk, checked 16 July 2026)

ICO-registered data controller, registration ZA422651 (per kafico.co.uk/privacy, checked 2026-07-16)

First DPO or AI policySeeking ISO 42001 certificationRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.