# Kafico - **Type:** Advisory firm - **Website:** https://www.kafico.co.uk - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A UK data protection consultancy focused on GP practices and health. It offers a retained data protection officer, ISO 27001 help, AI assurance and training. ## Kafico scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Breach and incident support offered via retained DPO, Ask Kafico and platform incident reporting with NHS scoring, delivered by named qualified staff, but no ICO-engagement outcomes published (kafico.co.uk, checked 2026-07-16). ### Qualifications of the people who do the work: 4/5 Named team with published credentials, Lead DPO with LLM in Information Rights Law, CISSP/CCSP security lead, BCS practitioners, though no IAPP certifications published (kafico.co.uk/meettheteam, 2026-07-16). ### What it publishes about fees: 4/5 Publishes real figures: ISO 27001 Mini Audit £199, fast-track from £1,000, certification partnership from £10,000, Ask Kafico £20/question; DPO retainer remains quote-only and exclusions are not itemised (checked 2026-07-16). ### Knowledge of your sector: 4/5 Dedicated primary-care DPO platform serving 110+ GP practices with NHS DSP Toolkit support, sector training, and a named NHS GP client testimonial (kafico.co.uk, checked 2026-07-16). ### Independence from what it sells: 3/5 Sells its own LENS AI-assurance and myKafico platforms alongside advice; product ownership is clearly branded but the advice/product boundary is not separately disclosed (checked 2026-07-16). ### Who carries the risk if the advice is wrong: 1/5 No PI insurance, liability terms or breach-response commitments published on the public site as of 2026-07-16. ## Sources for Kafico Every line carries the page it was read on and the date it was checked. - Companies House registration: Kafico Limited, company number 10313938, incorporated 5 August 2016, status Active, registered office 26 Den Hill, Eastbourne BN20 8SZ, SIC 63990 - Source: https://find-and-update.company-information.service.gov.uk/company/10313938 - Checked: 2026-07-16 - ICO registration: Registered with the Information Commissioner as a data controller, registration number ZA422651 (stated in its privacy policy) - Source: https://www.kafico.co.uk/privacy - Checked: 2026-07-16 - Service scope: Retained DPO services, Primary Care DPO platform serving 110+ GP practices, ISO 27001 implementation consultancy, AI governance and the LENS AI-assurance platform, GDPR training, and 'Ask Kafico' advisory service - Source: https://www.kafico.co.uk - Checked: 2026-07-16 - Published consultancy pricing: ISO 27001 page publishes figures: Mini Audit (Express) £199, 'Gap & Go' fast-track from £1,000, full certification partnership typically from £10,000 depending on scope, with annual maintenance noted as similar to Year 1 - Source: https://www.kafico.co.uk/iso27001 - Checked: 2026-07-16 - Published advisory pricing: 'Ask Kafico' service publishes a pilot rate of £20 per straightforward data protection question, answered within 2 working days - Source: https://www.kafico.co.uk/askkafico - Checked: 2026-07-16 - Published team credentials: Named team page lists Emma Cooper (Director and Lead DPO, LLM Information Rights Law and Practice, BCS DPO and FOI), Jeff Pullen (Info Security and Accreditations Lead, CISSP, CCSP, ISO 27001), and BCS Foundation-qualified staff - Source: https://www.kafico.co.uk/meettheteam - Checked: 2026-07-16 - Named client testimonials: DPO services page carries testimonials attributed to named clients: Sawyer & Co (block and estate management), ImproveWell, and Thorpewood Medical Group (NHS GP practice) - Source: https://www.kafico.co.uk/dpo-services - Checked: 2026-07-16 - PI insurance disclosure: Does not publish professional indemnity insurance details on its public website as of 2026-07-16 (privacy/policies page checked) - Source: https://www.kafico.co.uk/privacy - Checked: 2026-07-16 - AI-use disclosure: Does not disclose how Kafico itself uses AI tools or where client data goes in AI processing, on its AI services page or privacy policy, as of 2026-07-16 - Source: https://www.kafico.co.uk/ai - Checked: 2026-07-16 - Own AI product: LENS is Kafico's proprietary AI-assurance platform for healthcare (assessing AI systems for governance, clinical safety and accountability); no third-party certification of the platform is claimed on the page - Source: https://www.kafico.co.uk/about-3 - Checked: 2026-07-16 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Publishes actual consultancy figures, ISO 27001 Mini Audit £199, fast-track from £1,000, certification partnership from £10,000, and £20-per-question advisory, which is unusual in this market - Deep, evidenced primary-care specialism: a dedicated DPO platform serving 110+ GP practices with NHS incident scoring and DSP Toolkit support - Named team with published credentials, including a Lead DPO holding an LLM in Information Rights Law and Practice and a security lead holding CISSP and CCSP - Publishes testimonials from named clients including an NHS GP practice (Thorpewood Medical Group) ## Things to check Each one carries the factual basis it rests on. - Ask for its insurance cover and contract terms. These were not set out on the pages we checked. - Basis: Privacy/policies page (kafico.co.uk/privacy) and service pages checked 2026-07-16 contain no PI or liability disclosure. - Does not disclose how it itself uses AI or where client data goes in AI processing, despite selling AI-assurance services and its own LENS platform. - Basis: AI page (kafico.co.uk/ai) and privacy policy checked 2026-07-16 contain no own-AI-use statement. - No IAPP certifications (CIPP/E, CIPM) are published for any staff, and no firm-held ISO certification is claimed. - Basis: Team page lists BCS, CISSP/CCSP and LLM credentials only; ISO 27001 page does not state Kafico itself is certified (both checked 2026-07-16). - Retained DPO pricing is not published, only ISO 27001 packages and the per-question service carry figures. - Basis: DPO services page directs to a quote form with no fees shown (kafico.co.uk/dpo-services, checked 2026-07-16). ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.