# How do you change your data protection provider? Most of the work is paperwork: getting your records back and keeping breach cover in place. **The short answer.** Get your records back first. Then agree who covers a breach during the handover. The records are yours to keep: UK law puts the duty to keep your record of processing on your organisation, not on your adviser (the [UK GDPR, Article 30](https://www.legislation.gov.uk/eur/2016/679/article/30), checked 29 September 2026). If your provider is also your data protection officer (DPO), the change has legal steps. UK law says you must publish your DPO's contact details and give them to the UK data protection regulator. Your privacy notice must carry them too. You can update the regulator's copy online ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and [Article 13](https://www.legislation.gov.uk/eur/2016/679/article/13), and the [ICO](https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/), checked 29 September 2026). Write down what you need from the next provider before you look. Your needs may have grown since the last contract, for example with a first AI policy or a new sector rule. The guide to [how these services are priced](/guides/how-dpo-and-data-protection-services-are-priced) explains the usual ways of charging, and what a retainer tends to cover. **What to ask for back** - Your record of processing - Data protection impact assessments - Policies and privacy notices - Your breach log - Staff training records - Letters to and from the regulator - Written confirmation that any personal data the provider held is returned or deleted The records that stay with your organisation when your provider changes. Source: UK GDPR Article 30, https://www.legislation.gov.uk/eur/2016/679/article/30 (checked 29 September 2026); UK GDPR Article 28, https://www.legislation.gov.uk/eur/2016/679/article/28 (checked 29 September 2026) > "Records must be kept up to date and reflect your current processing activities." > ICO, Keeping processing records > The ICO, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/documentation/ (checked 29 September 2026) ## How to change data protection provider: the handover steps 1. Ask for your records back first. That means your record of processing, impact assessments, policies, breach log, training records and any letters to and from the regulator. 2. Read your contract for the notice period and any charge for handing over files before you give notice. 3. Check the new provider's named people and their qualifications with the body that issued them. 4. Overlap the two contracts by a few weeks, so someone answers for a breach on every day of the switch. 5. Ask the new provider to read what you already have before it proposes any changes. 6. Update your DPO's details with the UK data protection regulator and in your privacy notice on the day the new appointment starts. ## The 18 providers for this situation Grouped by type, alphabetical inside each type. ### Advisory firms (2) - [Ametros Group](https://theassurancedesk.com/advisers/ametros-group.md): Advisory firm - [DPO-Service](https://theassurancedesk.com/advisers/dpo-service.md): Advisory firm ### Certification bodies (7) - [Amtivo](https://theassurancedesk.com/advisers/amtivo.md): Certification body - [Bureau Veritas](https://theassurancedesk.com/advisers/bureau-veritas.md): Certification body - [Centre for Assessment](https://theassurancedesk.com/advisers/centre-for-assessment.md): Certification body - [DNV](https://theassurancedesk.com/advisers/dnv.md): Certification body - [Intertek](https://theassurancedesk.com/advisers/intertek.md): Certification body - [NQA](https://theassurancedesk.com/advisers/nqa.md): Certification body - [TÜV UK Limited (TÜV NORD Group)](https://theassurancedesk.com/advisers/tuv-uk.md): Certification body ### Software products (9) - [Credo AI](https://theassurancedesk.com/advisers/credo-ai.md): Software product - [Drata](https://theassurancedesk.com/advisers/drata.md): Software product - [Enzai](https://theassurancedesk.com/advisers/enzai.md): Software product - [Holistic AI](https://theassurancedesk.com/advisers/holistic-ai.md): Software product - [IBM watsonx.governance](https://theassurancedesk.com/advisers/ibm-watsonx-governance.md): Software product - [OneTrust AI Governance](https://theassurancedesk.com/advisers/onetrust-ai-governance.md): Software product - [Secureframe](https://theassurancedesk.com/advisers/secureframe.md): Software product - [Strike Graph](https://theassurancedesk.com/advisers/strike-graph.md): Software product - [Vanta](https://theassurancedesk.com/advisers/vanta.md): Software product ## Changing data protection provider: common questions ### Do we have to tell the regulator we changed provider? You must tell the regulator if the provider is your data protection officer. UK law says you must give the UK data protection regulator your DPO's contact details, so a new DPO means new details. An outside firm can hold the role ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/), checked 29 September 2026). ### Will we get our data back? You can choose to have your data returned, if the provider handled personal data for you. UK law says your contract must make the provider return or delete that data when the service ends, at your choice ([UK GDPR, Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28), checked 29 September 2026). Say which you want in writing, and ask for confirmation that copies are deleted. ### Who handles a breach during the handover? Agree in writing who handles a breach before the switch, so someone is on call every day. Under UK law, a breach that must be reported goes to the UK data protection regulator without undue delay. Where feasible, it must arrive within 72 hours of you becoming aware of it (the [UK GDPR, Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 29 September 2026). ### Our provider also sells software. Does that matter? Selling software can matter if the provider is also your DPO. UK rules say a DPO must operate independently, with no conflict of interests (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). ## Where next - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.