We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Do you need a data protection officer?

The answer tells you whether the role is a legal duty or your own choice.

UK law makes you appoint a data protection officer (DPO) in three cases only. You are a public body. Your core work tracks people regularly and at scale. Or your core work uses sensitive data at scale, such as health data or criminal records. If none applies, appointing one is your choice.

On this page
  1. How to decide whether to appoint a DPO, step by step
  2. DPOs and first AI policies: common questions
  3. Where next
  4. The 67 providers

If you appoint a DPO by choice, the same duties apply as if UK law required one. The officer reports directly to the highest level of management and takes no instructions on how to do the job. The officer cannot be dismissed or penalised for doing it. The guide to whether you need a DPO has more detail.

Outside help comes in two main forms. An outside DPO service fills the formal role. A fixed project, such as a first AI policy or a one-off review, suits an organisation that does not need the role. Firms charge by monthly retainer, day rate or project fee, and the guide to pricing explains each.

Must you appoint a DPO?

Must you appoint a data protection officer?

  • You are a public authority or body For example: a council or a state school, but not a court or tribunal deciding a case
  • or Your core work tracks people regularly and at scale For example: a large retail website that tracks searches and purchases to suggest products
  • or Your core work uses sensitive data at scale For example: a health insurer that holds medical details on many people

Yes, if any one applies.

If none applies, it is your choice. Appoint one anyway and the same rules apply.

Under UK law, any one of these three cases makes the role compulsory.

The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level.

ICO DPO guidance
Read original

How to decide whether to appoint a DPO, step by step

  1. Check whether UK law makes you appoint a DPO, using the ICO's checker.
  2. Write down the answer and your reasons, whichever way it goes.
  3. Name one person who looks after data protection day to day.
  4. Decide what help you want, if any: an officer, a first AI policy or a one-off review.
  5. If you bring in outside help, ask who will do the work, and check their qualifications with the body that issued them.
  6. If you do hire help, ask what the fee covers, and whether it includes help with a data breach.

DPOs and first AI policies: common questions

Can an outside firm be our DPO?

Yes. Under UK GDPR, your DPO can be a member of staff, or can work for you under a service contract. Once you appoint one, you must publish the officer's contact details and give them to the UK data protection regulator.

What if we decide we do not need one?

Record the decision not to appoint a DPO, and your reasons. The ICO says a written record helps you show you meet your duties under UK data protection law. It is still worth naming one person who looks after data protection day to day.

Do we need an AI policy if we barely use AI?

You probably need an AI policy if staff put work information into AI tools. 41% of UK businesses that handle digital data said they use AI, and 17% of those said they have a policy or guidelines. A short first policy names the tools staff may use and the data that must stay out.

How do providers set out their prices?

Some providers publish a price on their website, and this list shows them. Others quote once they know what you need. A written quote usually sets out the scope, what sits outside it and the renewal terms.

Sources

  1. ICO, data protection officers, checked 29 September 2026
  2. UK GDPR Article 37, checked 29 September 2026
  3. UK Freedom of Information Act 2000, Schedule 1, checked 29 September 2026
  4. UK GDPR Article 38, checked 29 September 2026
  5. UK Business Data Survey 2026, checked 29 September 2026

The 67 providers for this situation

Grouped by type, alphabetical inside each type. Three of the six scores are shown here. Each profile has all six, with the evidence for each.

Advisory firms (58)

Provider Qualifications Fee information Help when things go wrong
AARC-360 Advisory firm Relevant if you are a US group that wants one adviser across the EU GDPR, HIPAA and CCPA
2/5 1/5 2/5
Aleada Consulting Advisory firm Relevant if you are a US tech or finance company appointing a first privacy adviser
4/5 3/5 2/5
Amethyst Risk Management Limited Advisory firm Relevant if you need a Cyber Assessment Framework audit from an NCSC-listed firm, or ISO/IEC 27001 help
4/5 2/5 2/5
Ametros Group Advisory firm Relevant if you want a budget figure before you call, and a DPO the firm says it employs
1/5 4/5 2/5
AMSA InfoSec Ltd Advisory firm Relevant if you buy through G-Cloud and want a published day rate and a named consultant
3/5 3/5 1/5
Apache Consulting (Apache Consults / Vadasz Ventures) Advisory firm Relevant if you want outsourced Chief Privacy Officer help and will confirm the firm's legal entity first
1/5 1/5 1/5
Arcanum Cyber Security (Arcanum Information Security Limited) Advisory firm Relevant if you need NCSC-assured audit, risk management or security architecture work in a regulated sector
5/5 4/5 2/5
Athlex Advisory firm Relevant if you are a start-up or small business and want a DPO at a known monthly price
2/5 4/5 3/5
AvISO Consultancy Advisory firm Relevant if you are already working towards several ISO certificates and want DPO support alongside
2/5 1/5 2/5
BD Emerson LLC Advisory firm Relevant if you want a named privacy lead with IAPP credentials for DPO or AI-governance work
4/5 2/5 2/5
Bird & Bird LLP Advisory firm Relevant if you face a breach, a regulator investigation or EU AI Act exposure and need lawyers
5/5 2/5 4/5
Bridewell Advisory firm Relevant if you run critical infrastructure or a regulated business and want privacy help inside a security firm
3/5 1/5 3/5
C3IA Solutions Limited Advisory firm Relevant if you need NCSC-assured audit or risk work for a public-sector or defence body
4/5 3/5 2/5
CBIZ Pivot Point Security Advisory firm Relevant if you want an outsourced security chief with published monthly prices, or help towards ISO 27001
4/5 4/5 2/5
Compass IT Compliance, LLC Advisory firm Relevant if you want help preparing for SOC 2, PCI DSS or CMMC from named practice leads
4/5 2/5 3/5
Cyber Defense Group Advisory firm Relevant if you are a growing company that wants a part-time security leader and help preparing for audits
3/5 4/5 3/5
CyPro Advisory firm Relevant if you want cyber security and GDPR work together from named founders with checkable credentials
5/5 1/5 3/5
Data GRC Ltd Advisory firm Relevant if you want a 30-minute advice call at a fixed price before committing to a retainer
1/5 3/5 2/5
Data Privacy & Security Advisors, LLC (The DPSA) Advisory firm Relevant if you need an outsourced US privacy contact for CCPA/CPRA, HIPAA and state privacy laws
3/5 2/5 2/5
Data Protection People Advisory firm Relevant if you want DPO support and subject access request handling from one firm with named staff
4/5 1/5 3/5
DataGuard Advisory firm Relevant if you want software with consultants attached for ISO 27001 or several frameworks at once
2/5 3/5 2/5
Debbie Reynolds Consulting LLC Advisory firm Relevant if you want a first conversation about privacy or AI governance risk with one named practitioner
3/5 2/5 2/5
Deloitte LLP Advisory firm Relevant if you are a large organisation with EU AI Act duties and want a named privacy partner
4/5 2/5 3/5
DPO-Service Advisory firm Relevant if you want a DPO within 48 hours on a 30-day rolling contract
2/5 3/5 3/5
Enterprivacy Consulting Group Advisory firm Relevant if you want a privacy-by-design review done personally by a named, qualified privacy specialist
4/5 2/5 1/5
Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.) Advisory firm Relevant if you want an outside audit of a specific AI system, such as a hiring tool
4/5 1/5 3/5
Evalian Advisory firm Relevant if you want data protection, cyber security and ISO support from one firm with named, qualified leaders
5/5 3/5 3/5
Fast Data Science Advisory firm Relevant if you need hands-on AI delivery with governance advice built in, not a DPO
3/5 3/5 1/5
Fieldfisher LLP Advisory firm Relevant if you want regulated solicitors whose data protection team has run a High Court claim
4/5 2/5 3/5
Forvis Mazars Advisory firm Relevant if you want privacy and AI governance advice from a large firm that names its indemnity insurer
3/5 1/5 3/5
Fractional CISO, LLC Advisory firm Relevant if you are preparing for a SOC 2 or ISO 27001 audit and want named, qualified staff
4/5 3/5 2/5
GDPR Advisor (PSA Professional Solutions) Advisory firm Relevant if you want an outsourced DPO and training from one firm, and will check its company number
1/5 1/5 2/5
GRCI Law Advisory firm Relevant if you want data protection help alongside a group's wider cyber and ISO 27001 services
2/5 3/5 2/5
Handley Gill Advisory firm Relevant if you need data protection and AI governance support, including information-rights tribunal appeals
4/5 3/5 4/5
HewardMills Advisory firm Relevant if you need an outsourced DPO across several countries from a firm that sells no software
2/5 2/5 3/5
Hope & May Advisory firm Relevant if you run a charity and want a named DPO team from an NCVO trusted supplier
3/5 2/5 3/5
IT Governance (now GRC Solutions) Advisory firm Relevant if you want advice and ready-made compliance documents from one supplier, with published product prices
2/5 3/5 3/5
JBW Group International, LLC Advisory firm Relevant if you run a regulated US business and want named, qualified people for privacy or ISO work
4/5 2/5 2/5
JVR Consultancy Advisory firm Relevant if you want UK GDPR help alongside rail, construction or utilities accreditation work
1/5 3/5 2/5
Kafico Advisory firm Relevant if you run a GP practice or health business and want a named, qualified DPO
4/5 4/5 3/5
Kuma (Kimble and Associates, LLC) Advisory firm Relevant if you run a US public body and want a named, qualified part-time privacy officer
4/5 2/5 2/5
Logiq Consulting Ltd Advisory firm Relevant if you are a public body buying through G-Cloud and need NCSC-assured cyber audit work
4/5 3/5 2/5
Mishcon de Reya LLP Advisory firm Relevant if you face a cyber incident, or want an outsourced DPO from a law firm
3/5 2/5 4/5
Pembroke Privacy Advisory firm Relevant if you need one adviser for EU and UK GDPR work and want named, qualified staff
4/5 3/5 3/5
Privacy Ref, Inc. Advisory firm Relevant if you want a small US firm for privacy or AI governance work, not a large one
4/5 2/5 2/5
Red Clover Advisors, LLC Advisory firm Relevant if you want help building a US privacy or AI governance programme, not incident response
4/5 2/5 2/5
Rhymetec LLC Advisory firm Relevant if your SaaS company needs SOC 2, ISO 27001 and a virtual CISO from one firm
3/5 2/5 2/5
RightCue Consulting Services Ltd Advisory firm Relevant if you are a small firm seeking Cyber Essentials or appointing a first virtual CISO
4/5 2/5 3/5
Rocket-Hire LLC Advisory firm Relevant if you need a bias audit of an automated hiring tool and want the starting price upfront
3/5 4/5 2/5
Samurai Digital Security Limited Advisory firm Relevant if you are appointing a first virtual CISO or working towards ISO 27001 or Cyber Essentials
4/5 1/5 2/5
Securys Advisory firm Relevant if you want a fixed-fee DPO with breach response and subject access requests included
4/5 3/5 3/5
SideChannel, Inc. Advisory firm Relevant if you want a virtual CISO or SOC 2 readiness help and a published price range
3/5 4/5 2/5
SME Comply Advisory firm Relevant if you run a small business and want DPO support and legal advice from one place
3/5 2/5 2/5
Strategic Management Services, LLC Advisory firm Relevant if you run a US healthcare organisation and need an interim HIPAA privacy officer or breach help
4/5 1/5 3/5
The DPO Centre Advisory firm Relevant if you are appointing a first DPO and want named, qualified people and sector case studies
5/5 3/5 3/5
URM Consulting Advisory firm Relevant if you want DPO support and ISO 27001 or 22301 certification help from one firm
3/5 1/5 3/5
vCISO Services, LLC Advisory firm Relevant if you are a smaller US business preparing for SOC 2, ISO 27001 or CMMC audits
2/5 2/5 2/5
VeraSafe, LLC Advisory firm Relevant if you need an outsourced DPO or advice on California privacy law or the EU AI Act
4/5 2/5 2/5

Certification bodies (6)

Provider Qualifications Fee information Help when things go wrong
Amtivo Certification body Relevant if you want UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification, not ISO 42001
3/5 2/5 3/5
Bureau Veritas Certification body Relevant if you need UKAS-accredited ISO 27001, ISO 9001 or nuclear supply-chain certification, not ISO 42001
3/5 1/5 3/5
Centre for Assessment Certification body Relevant if you want UKAS-accredited ISO 9001 or 27001 certification, or a Lexcel assessment for a law firm
2/5 4/5 3/5
DNV Certification body Relevant if you need UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification from a large international group
3/5 1/5 3/5
Intertek Certification body Relevant if you need a UKAS-accredited ISO 27001, ISO 9001 or ISO 37001 certificate from a large group
3/5 1/5 3/5
ISOQAR (formerly Alcumus ISOQAR) Certification body Relevant if you want a UKAS-accredited ISO 42001 certificate, audited alongside ISO 9001 or ISO 27001
5/5 3/5 4/5

Software products (3)

Provider Qualifications Fee information Help when things go wrong
CookieYes Software product Relevant if you want a self-serve cookie banner with published monthly prices and a free plan to start
4/5 5/5 3/5
Hicomply Software product Relevant if you want compliance software with prices on the website before you speak to sales
1/5 5/5 2/5
Osano Software product Relevant if you want self-service cookie consent software with published starter prices and a dated SOC 2 report
3/5 2/5 4/5

This is an independent editorial guide, not legal advice.