# Do you need a data protection officer? The answer tells you whether the role is a legal duty or your own choice. **The short answer.** UK law makes you appoint a data protection officer (DPO) in three cases only. You are a public body. Your core work tracks people regularly and at scale. Or your core work uses sensitive data at scale, such as health data or criminal records. If none applies, appointing one is your choice ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). If you appoint a DPO by choice, the same duties apply as if UK law required one. The officer reports directly to the highest level of management and takes no instructions on how to do the job. The officer cannot be dismissed or penalised for doing it ([UK GDPR Article 38](https://www.legislation.gov.uk/eur/2016/679/article/38) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). The [guide to whether you need a DPO](/guides/do-you-need-a-dpo) has more detail. Outside help comes in two main forms. An outside DPO service fills the formal role. A fixed project, such as a first AI policy or a one-off review, suits an organisation that does not need the role. Firms charge by monthly retainer, day rate or project fee, and the [guide to pricing](/guides/how-dpo-and-data-protection-services-are-priced) explains each. **Must you appoint a DPO?** Must you appoint a data protection officer? - You are a public authority or body: for example, a council or a state school, but not a court or tribunal deciding a case OR - Your core work tracks people regularly and at scale: for example, a large retail website that tracks searches and purchases to suggest products OR - Your core work uses sensitive data at scale: for example, a health insurer that holds medical details on many people Yes, if any one applies. If none applies, it is your choice. Appoint one anyway and the same rules apply. Under UK law, any one of these three cases makes the role compulsory. Source: ICO, data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026); UK GDPR Article 37, https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 29 September 2026); UK Freedom of Information Act 2000, Schedule 1, https://www.legislation.gov.uk/ukpga/2000/36/schedule/1 (checked 29 September 2026) > "The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level." > ICO, DPO guidance > The ICO, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026) ## How to decide whether to appoint a DPO, step by step 1. Check whether UK law makes you appoint a DPO, using the [ICO's checker](https://ico.org.uk/for-organisations/data-protection-fee/does-my-organisation-need-a-data-protection-officer-dpo/). 2. Write down the answer and your reasons, whichever way it goes. 3. Name one person who looks after data protection day to day. 4. Decide what help you want, if any: an officer, a first AI policy or a one-off review. 5. If you bring in outside help, ask who will do the work, and check their qualifications with the body that issued them. 6. If you do hire help, ask what the fee covers, and whether it includes help with a data breach. ## The 67 providers for this situation Grouped by type, alphabetical inside each type. ### Advisory firms (58) - [AARC-360](https://theassurancedesk.com/advisers/aarc-360.md): Advisory firm - [Aleada Consulting](https://theassurancedesk.com/advisers/aleada-consulting.md): Advisory firm - [Amethyst Risk Management Limited](https://theassurancedesk.com/advisers/amethyst-risk-management.md): Advisory firm - [Ametros Group](https://theassurancedesk.com/advisers/ametros-group.md): Advisory firm - [AMSA InfoSec Ltd](https://theassurancedesk.com/advisers/amsa-infosec.md): Advisory firm - [Apache Consulting (Apache Consults / Vadasz Ventures)](https://theassurancedesk.com/advisers/apache-consulting.md): Advisory firm - [Arcanum Cyber Security (Arcanum Information Security Limited)](https://theassurancedesk.com/advisers/arcanum-cyber-security.md): Advisory firm - [Athlex](https://theassurancedesk.com/advisers/athlex.md): Advisory firm - [AvISO Consultancy](https://theassurancedesk.com/advisers/aviso-consultancy.md): Advisory firm - [BD Emerson LLC](https://theassurancedesk.com/advisers/bd-emerson.md): Advisory firm - [Bird & Bird LLP](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk.md): Advisory firm - [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm - [C3IA Solutions Limited](https://theassurancedesk.com/advisers/c3ia-solutions.md): Advisory firm - [CBIZ Pivot Point Security](https://theassurancedesk.com/advisers/cbiz-pivot-point-security.md): Advisory firm - [Compass IT Compliance, LLC](https://theassurancedesk.com/advisers/compass-it-compliance.md): Advisory firm - [Cyber Defense Group](https://theassurancedesk.com/advisers/cyber-defense-group.md): Advisory firm - [CyPro](https://theassurancedesk.com/advisers/cypro.md): Advisory firm - [Data GRC Ltd](https://theassurancedesk.com/advisers/data-grc.md): Advisory firm - [Data Privacy & Security Advisors, LLC (The DPSA)](https://theassurancedesk.com/advisers/data-privacy-security-advisors-dpsa.md): Advisory firm - [Data Protection People](https://theassurancedesk.com/advisers/data-protection-people.md): Advisory firm - [DataGuard](https://theassurancedesk.com/advisers/dataguard.md): Advisory firm - [Debbie Reynolds Consulting LLC](https://theassurancedesk.com/advisers/debbie-reynolds-consulting-llc.md): Advisory firm - [Deloitte LLP](https://theassurancedesk.com/advisers/deloitte-llp-uk.md): Advisory firm - [DPO-Service](https://theassurancedesk.com/advisers/dpo-service.md): Advisory firm - [Enterprivacy Consulting Group](https://theassurancedesk.com/advisers/enterprivacy-consulting-group.md): Advisory firm - [Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.)](https://theassurancedesk.com/advisers/eticas-ai.md): Advisory firm - [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm - [Fast Data Science](https://theassurancedesk.com/advisers/fast-data-science.md): Advisory firm - [Fieldfisher LLP](https://theassurancedesk.com/advisers/fieldfisher-llp-uk.md): Advisory firm - [Forvis Mazars](https://theassurancedesk.com/advisers/forvis-mazars.md): Advisory firm - [Fractional CISO, LLC](https://theassurancedesk.com/advisers/fractional-ciso.md): Advisory firm - [GDPR Advisor (PSA Professional Solutions)](https://theassurancedesk.com/advisers/gdpr-advisor.md): Advisory firm - [GRCI Law](https://theassurancedesk.com/advisers/grci-law.md): Advisory firm - [Handley Gill](https://theassurancedesk.com/advisers/handley-gill.md): Advisory firm - [HewardMills](https://theassurancedesk.com/advisers/hewardmills.md): Advisory firm - [Hope & May](https://theassurancedesk.com/advisers/hope-and-may.md): Advisory firm - [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm - [JBW Group International, LLC](https://theassurancedesk.com/advisers/jbw-group-international-llc.md): Advisory firm - [JVR Consultancy](https://theassurancedesk.com/advisers/jvr-consultancy.md): Advisory firm - [Kafico](https://theassurancedesk.com/advisers/kafico.md): Advisory firm - [Kuma (Kimble and Associates, LLC)](https://theassurancedesk.com/advisers/kuma.md): Advisory firm - [Logiq Consulting Ltd](https://theassurancedesk.com/advisers/logiq-consulting.md): Advisory firm - [Mishcon de Reya LLP](https://theassurancedesk.com/advisers/mishcon-de-reya-llp.md): Advisory firm - [Pembroke Privacy](https://theassurancedesk.com/advisers/pembroke-privacy.md): Advisory firm - [Privacy Ref, Inc.](https://theassurancedesk.com/advisers/privacy-ref.md): Advisory firm - [Red Clover Advisors, LLC](https://theassurancedesk.com/advisers/red-clover-advisors.md): Advisory firm - [Rhymetec LLC](https://theassurancedesk.com/advisers/rhymetec.md): Advisory firm - [RightCue Consulting Services Ltd](https://theassurancedesk.com/advisers/rightcue.md): Advisory firm - [Rocket-Hire LLC](https://theassurancedesk.com/advisers/rocket-hire.md): Advisory firm - [Samurai Digital Security Limited](https://theassurancedesk.com/advisers/samurai-digital-security-limited.md): Advisory firm - [Securys](https://theassurancedesk.com/advisers/securys.md): Advisory firm - [SideChannel, Inc.](https://theassurancedesk.com/advisers/sidechannel.md): Advisory firm - [SME Comply](https://theassurancedesk.com/advisers/sme-comply.md): Advisory firm - [Strategic Management Services, LLC](https://theassurancedesk.com/advisers/strategic-management-services.md): Advisory firm - [The DPO Centre](https://theassurancedesk.com/advisers/dpo-centre.md): Advisory firm - [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm - [vCISO Services, LLC](https://theassurancedesk.com/advisers/vciso-services.md): Advisory firm - [VeraSafe, LLC](https://theassurancedesk.com/advisers/verasafe.md): Advisory firm ### Certification bodies (6) - [Amtivo](https://theassurancedesk.com/advisers/amtivo.md): Certification body - [Bureau Veritas](https://theassurancedesk.com/advisers/bureau-veritas.md): Certification body - [Centre for Assessment](https://theassurancedesk.com/advisers/centre-for-assessment.md): Certification body - [DNV](https://theassurancedesk.com/advisers/dnv.md): Certification body - [Intertek](https://theassurancedesk.com/advisers/intertek.md): Certification body - [ISOQAR (formerly Alcumus ISOQAR)](https://theassurancedesk.com/advisers/isoqar.md): Certification body ### Software products (3) - [CookieYes](https://theassurancedesk.com/advisers/cookieyes.md): Software product - [Hicomply](https://theassurancedesk.com/advisers/hicomply.md): Software product - [Osano](https://theassurancedesk.com/advisers/osano.md): Software product ## DPOs and first AI policies: common questions ### Can an outside firm be our DPO? Yes. Under UK GDPR, your DPO can be a member of staff, or can work for you under a service contract. Once you appoint one, you must publish the officer's contact details and give them to the UK data protection regulator ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026). ### What if we decide we do not need one? Record the decision not to appoint a DPO, and your reasons. The ICO says a written record helps you show you meet your duties under UK data protection law (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). It is still worth naming one person who looks after data protection day to day. ### Do we need an AI policy if we barely use AI? You probably need an AI policy if staff put work information into AI tools. 41% of UK businesses that handle digital data said they use AI, and 17% of those said they have a policy or guidelines (the [UK Business Data Survey 2026](https://www.gov.uk/government/statistics/uk-business-data-survey-2026/uk-business-data-survey-2026), checked 29 September 2026). A short first policy names the tools staff may use and the data that must stay out. ### How do providers set out their prices? Some providers publish a price on their website, and [this list](/lists/providers-that-publish-a-price) shows them. Others quote once they know what you need. A written quote usually sets out the scope, what sits outside it and the renewal terms. ## Where next - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.