We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

KPMG LLP (UK) review

Advisory firm

The UK arm of the Big Four firm KPMG. It offers data protection advice through its legal practice and AI-governance advice through its Trusted AI framework.

Relevant if you already use Microsoft Purview and want AI-risk and data protection work from one firm

Price Not published
Indemnity cover Published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

KPMG scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 2/5
Knowledge of your sector 3/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 3/5

What KPMG offers, and what it publishes

You get a named AI-risk lead and a published framework. Douglas Dick heads emerging technology risk and leads KPMG UK's AI risk management work. Its Trusted AI framework has ten pillars, including fairness, transparency and privacy. Data protection work, such as handling requests for personal data and breach response, sits in its legal practice.

KPMG does not publish a price for data protection or AI advice; its transparency report covers audit fees only. It publishes no client case study with figures, and no firm-level data protection or AI accreditation. It does publish its professional indemnity insurers, including Queen Street Mutual Company PCC Limited, with worldwide cover.

KPMG says it delivers data protection work 'partnering with Microsoft' through Microsoft Purview. The former head of its UK data protection legal practice left in December 2024; we found no successor. The UK audit regulator, the Financial Reporting Council, has fined the same firm three times since 2023, including £18,550,000 over Carillion. These fines concern audit work.

Strengths

  • Long-established UK entity: KPMG LLP has been registered at Companies House since 2002 (OC301540) as an active limited liability partnership.
  • Publishes a structured 'Trusted AI' ethical framework (ten pillars) with a named UK emerging-technology-risk lead, Douglas Dick.
  • Publicly discloses professional indemnity insurance details, including insurer name and worldwide territorial cover, on its own regulatory-information page.
  • Operates a dedicated UK 'Data, Digital and Technology' legal-services practice publishing specific data-protection service lines, including SAR management and breach-response coordination.

Things to check

  • The FRC fined KPMG LLP £18,550,000 (discounted from £26,500,000) on 12 October 2023 for 'fundamental' deficiencies in its Carillion plc statutory audits.
  • The FRC sanctioned KPMG LLP again in 2025 over its N Brown Group plc audit, with KPMG admitting serious breaches of International Standards on Auditing and paying a discounted penalty of £710,937.50.
  • KPMG's own UK data-protection advisory page promotes delivery 'partnering with Microsoft' using Microsoft Purview, rather than describing vendor-neutral advisory delivery.
  • The US audit regulator PCAOB censured KPMG LLP (UK) and fined it $600,000 on 11 March 2025 for repeatedly failing to disclose other accounting firms' audit participation (13 inaccurate Form APs across seven issuers, 2020-2023) and failing to make required audit-committee communications in 10 issuer audits, alongside related quality-control violations.

Common questions

Does KPMG publish its fees for data protection or AI advice?

No. Its UK transparency report covers statutory audit fees only, a separate disclosure required by regulators. We found no fees for advisory work.

Who leads KPMG's UK AI governance work?

Douglas Dick, Head of Emerging Technology Risk, who leads its AI risk management service line. His KPMG profile lists an MA (Hons) from the University of St Andrews and membership of the Institute of Internal Auditors.

Has KPMG been fined by regulators?

Yes, for audit work. The UK Financial Reporting Council has fined it three times since 2023: £18,550,000 over Carillion, £710,937.50 over N Brown and £690,625 over Carr's Group. The US PCAOB fined it $600,000 on 11 March 2025. We found no UK ICO action.

Evidence for each KPMG score

Show our working

Notes behind each thing to check

  • The FRC fined KPMG LLP £18,550,000 (discounted from £26,500,000) on 12 October 2023 for 'fundamental' deficiencies in its Carillion plc statutory audits. (FRC published decision notice, 12 October 2023 (frc.org.uk), a primary regulatory register.)
  • The FRC sanctioned KPMG LLP again in 2025 over its N Brown Group plc audit, with KPMG admitting serious breaches of International Standards on Auditing and paying a discounted penalty of £710,937.50. (FRC published sanctions announcement, June 2025 (frc.org.uk), a primary regulatory register.)
  • KPMG's own UK data-protection advisory page promotes delivery 'partnering with Microsoft' using Microsoft Purview, rather than describing vendor-neutral advisory delivery. (KPMG's own published webpage, kpmg.com/uk/en, dated content read 19 Sep 2026.)
  • The US audit regulator PCAOB censured KPMG LLP (UK) and fined it $600,000 on 11 March 2025 for repeatedly failing to disclose other accounting firms' audit participation (13 inaccurate Form APs across seven issuers, 2020-2023) and failing to make required audit-committee communications in 10 issuer audits, alongside related quality-control violations. (PCAOB Release No. 105-2025-012, In the Matter of KPMG LLP (United Kingdom), 11 March 2025, https://assets.pcaobus.org/pcaob-dev/docs/default-source/enforcement/decisions/documents/105-2025-012---kpmg-uk.pdf)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 FRC issued three separate sanctions against KPMG LLP since 2023 (Carillion £18.55m, N Brown £710,937.50, Carr's Group £690,625); no independently verified case study of KPMG defending a client through an ICO data-protection investigation was found.
Qualifications of the people who do the work 4/5 Long-established Big Four LLP (Companies House OC301540, incorporated 2002); named UK emerging-technology-risk lead (Douglas Dick, MA Hons, IIA member, PRINCE2) publicly profiled, though no verified DP-specific individual credential such as CIPP/E was found.
What it publishes about fees 2/5 No published fee rates or fee model for the DP/AI advisory practice were found; the UK Transparency Report discloses only statutory audit fee information, which is a different, regulator-mandated disclosure.
Knowledge of your sector 3/5 Named UK leads and published pages exist (Rajvir Cheema, Tim Colclough on data-protection advisory; Douglas Dick on Trusted AI); but the prior named UK data-protection legal-practice lead left the firm in December 2024, leaving current continuity unconfirmed.
Independence from what it sells 2/5 KPMG's own UK data-protection advisory page promotes delivery 'partnering with Microsoft' via Microsoft Purview, indicating engagements are structured around a specific vendor's software stack.
Who carries the risk if the advice is wrong 3/5 KPMG LLP publicly discloses professional indemnity insurance (Queen Street Mutual Company PCC Limited and others, worldwide territorial cover) on its own regulatory-information page; the LLP structure limits individual partner liability.

Sources for KPMG

  • KPMG LLP is registered as an active limited liability partnership at Companies House. (Company number OC301540, incorporated 22 February 2002, status Active, registered office 15 Canada Square, London E14 5GL) (Companies House, checked 19 September 2026)
  • The FRC sanctioned KPMG LLP over its audits of Carillion plc. (£18,550,000 financial sanction (discounted from £26,500,000), decision announced 12 October 2023) (frc.org.uk, checked 19 September 2026)
  • KPMG LLP publicly discloses its professional indemnity insurance arrangements. (Insurers include Queen Street Mutual Company PCC Limited and others; territorial coverage worldwide) (kpmg.com, checked 19 September 2026)
  • KPMG UK publishes a 'Trusted AI' advisory framework structured around ten ethical pillars. (Pillars include fairness, transparency, explainability, accountability, data integrity, security, privacy and sustainability) (kpmg.com, checked 19 September 2026)
  • Douglas Dick is named as KPMG's Head of Emerging Technology Risk, leading its AI risk management service line. (MA (Hons) University of St Andrews; Member, Institute of Internal Auditors; PRINCE2 Change accreditation) (kpmg.com, checked 19 September 2026)
  • KPMG UK's data-protection advisory work sits within its Legal Services technology practice. (Offers data risk compliance strategies, subject-access-request management, and cyber breach-response coordination) (kpmg.com, checked 19 September 2026)
  • The US audit regulator PCAOB censured KPMG LLP (UK) and imposed a $600,000 civil penalty for violating PCAOB quality-control standards, failing to make required audit-committee communications in 10 issuer audits (2020-2023), and filing 13 inaccurate Form APs across seven issuers. (Censure + $600,000 penalty, PCAOB Release No. 105-2025-012, 11 March 2025) (assets.pcaobus.org, checked 20 September 2026)
  • The ICO's public enforcement action list was checked by firm name and contains no entry for KPMG LLP. (No ICO enforcement action found for KPMG) (ico.org.uk, checked 20 September 2026)
  • Trustpilot: KPMG's Trustpilot page (www.kpmg.com) shows a 1.5/5 TrustScore from 61 reviews, claimed by the business since January 2022, most recent review dated 25 May 2026. Reviews span many KPMG member firms globally (Netherlands, Germany, Ireland, Singapore, France, Australia, Canada, etc.) and are mostly about recruitment, workplace conduct and general service complaints, not specifically UK data-protection advisory work; this is a global brand page, not a UK-specific one, and KPMG has not replied to the negative reviews on it. (Trustpilot, checked 20 September 2026)

Exposed to the EU AI ActAfter a breach or ICO contactRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.