We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Securys logo

Securys review

Advisory firm

A UK privacy and AI-governance consultancy for organisations wanting an outsourced DPO, on a subscription the firm says is nearly always fixed-fee.

Relevant if you want a fixed-fee DPO with breach response and subject access requests included

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Securys scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 4/5
What it publishes about fees 3/5
Knowledge of your sector 3/5
Independence from what it sells 3/5
Who carries the risk if the advice is wrong 2/5

What Securys offers, and what it publishes

You get a DPO on an annual subscription, paid monthly. The firm says nearly all its DPO work is fixed-fee rather than hourly, with subject access requests and breach response included. It also runs audits, breach simulations and an AI-governance practice, aiEthix. Its site shows BSI certification to ISO 27001:2022 and ISO 27701:2019, with certificate numbers.

Securys does not publish a price. The DPO page explains what sets the fee but gives no figures. It does not publish its indemnity cover or case studies. The client evidence on its site is one named testimonial, from PacBio. Its privacy policy does not say how the firm itself uses AI.

The firm says it is a founding supporter of the IAPP AI governance programme. It has its own data-discovery tool, Workscope, and does not explain the tool's role in its advice. Its site lists its group chief executive, Ben Rapp, as an IAPP Fellow of Information Privacy. It has no Trustpilot profile.

Strengths

  • Independently certified to both ISO 27001:2022 and ISO 27701:2019 by BSI, with certificate numbers published (IS707104, PM730987)
  • Unusually clear fee model: fixed-fee annual DPO subscriptions paid monthly, with DSAR and breach response included
  • Dedicated AI-governance practice (aiEthix) covering AI discovery, shadow-AI mapping and EU AI Act-driven governance
  • Named leadership with published IAPP credentials, including an IAPP Fellow of Information Privacy as Group CEO

Things to check

  • No fee figures are published despite the clearly explained fixed-fee model.
  • No published case-study library; client evidence on the site rests on a single named homepage testimonial.
  • Does not disclose professional-indemnity cover or how the firm itself uses AI.

Common questions

How does Securys charge for its DPO service?

By annual subscription, paid monthly. The firm says nearly all its DPO work is fixed-fee rather than hourly, with subject access requests and breach response included. It publishes no figures.

Is Securys itself certified?

Yes, according to its site. It shows BSI certificates for ISO 27001:2022 (IS707104) and ISO 27701:2019 (PM730987) on its about and legal pages.

Does Securys help with AI governance?

Yes, through its aiEthix practice. The firm says it offers AI discovery, including shadow-AI mapping, and AI governance across jurisdictions, with emphasis on the EU AI Act. It mentions no ISO 42001 certification.

Evidence for each Securys score

Show our working

Notes behind each thing to check

  • No fee figures are published despite the clearly explained fixed-fee model. (DPO-as-a-service page describes subscription pricing factors but gives no figures (securys.co.uk/dpo-as-a-service, 2026-07-16))
  • No published case-study library; client evidence on the site rests on a single named homepage testimonial. (No case studies found on pages checked 2026-07-16; homepage carries one named PacBio testimonial (securys.co.uk))
  • Does not disclose professional-indemnity cover or how the firm itself uses AI. (Legal information page has website liability terms only, and the privacy policy contains no own-AI-use statement (securys.co.uk/legal-information and /privacy-policy/, 2026-07-16))
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 Breach response (investigation, recording, crisis communications, mitigation) is included in DPO subscriptions and tabletop breach simulations are offered, but no outcomes are published (securys.co.uk/dpo-as-a-service and /audit-assurance, 2026-07-16)
Qualifications of the people who do the work 4/5 Named leadership with published IAPP credentials including an IAPP Fellow, plus collective team certifications; not all practitioners individually listed (securys.co.uk/about-us/, 2026-07-16)
What it publishes about fees 3/5 Fixed-fee annual subscription model clearly explained, including what is bundled, but no figures published (securys.co.uk/dpo-as-a-service, 2026-07-16)
Knowledge of your sector 3/5 Named sector pages for health tech, financial services and wealth management, but thin published sector-specific work or named sector practitioners (securys.co.uk/, 2026-07-16)
Independence from what it sells 3/5 Mixed model: consultancy plus own tools such as Workscope data discovery; relationships disclosed on its own pages but the product's role in advice is not separately explained (securys.co.uk/, 2026-07-16)
Who carries the risk if the advice is wrong 2/5 Publishes website liability terms and includes breach response within fixed fees, but no PI cover or engagement liability terms disclosed as of 2026-07-16 (securys.co.uk/legal-information)

Sources for Securys

  • Companies House registration: SECURYS LIMITED, company number 09084719, incorporated 12 June 2014, status Active, registered office 91 Goswell Road, London EC1V 7EX (Companies House, checked 16 July 2026)
  • Service scope: DPO-as-a-service, audit and assurance (gap analysis, assurance audits, tabletop breach simulations), DSAR services, data discovery (Workscope), governance and representation, and AI governance via its aiEthix practice (securys.co.uk, checked 16 July 2026)
  • Pricing disclosure: Does not publish fee figures on its public website as of 2026-07-16; the DPO page explains the model, an annual subscription paid monthly, with 'nearly all our DPO engagements... for a fixed fee rather than hours per month', including DSAR and breach response within the subscription (securys.co.uk, checked 16 July 2026)
  • Team credentials: About page names Group CEO Ben Rapp with published credentials (CISSP-ISSMP, CIPP/E, CIPP/US, CIPM, IAPP Fellow of Information Privacy) and MD John Lloyd; the DPO page states team certifications include CIPP/E, CIPP/A, CIPP/US, CIPM, CIPT, AIGP, CISSP and CISA (securys.co.uk, checked 16 July 2026)
  • PI insurance / liability: Does not publish professional-indemnity cover on its public website as of 2026-07-16; its legal information page publishes website terms with liability exclusions but no engagement PI details (securys.co.uk, checked 16 July 2026)
  • Independent accreditation: Holds ISO 27001:2022 (certificate IS707104) and ISO 27701:2019 (certificate PM730987), both certified by BSI, displayed with certificate numbers on its about and legal pages (securys.co.uk, checked 16 July 2026)
  • Named client outcomes: Does not publish a case-study library on the pages checked as of 2026-07-16; the homepage carries a named testimonial from Peter Fromen, Chief Commercial Officer of PacBio (securys.co.uk, checked 16 July 2026)
  • AI-use disclosure: Privacy policy states 'we do not use automated decision making' and describes supplier vetting, but does not disclose the firm's own use of AI tools as of 2026-07-16 (securys.co.uk, checked 16 July 2026)
  • AI-governance services: aiEthix practice offers AI Discovery (including shadow-AI mapping), AI governance across jurisdictions and 'AI by Design'; Securys describes itself as a founding supporter of the IAPP AI governance programme (self-declared) (aiethix.com, checked 16 July 2026)

ISO 27001:2022 certified by BSI, certificate IS707104 (securys.co.uk/about-us/, 2026-07-16) ISO 27701:2019 certified by BSI, certificate PM730987 (securys.co.uk/about-us/, 2026-07-16) IAPP corporate membership (self-declared, securys.co.uk/dpo-as-a-service, 2026-07-16)

First DPO or AI policyExposed to the EU AI ActAfter a breach or ICO contactRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.