# Guides Plain answers to common questions about data protection, AI governance and cyber security. ## [Data protection](https://theassurancedesk.com/data-protection.md) - [UK GDPR’s seven principles, in plain English](https://theassurancedesk.com/guides/uk-gdpr-seven-principles.md): Guide, 9 October 2026. Turn the rules into everyday checks on the information your organisation uses. - In this series - [Data protection training: what should staff learn?](https://theassurancedesk.com/guides/data-protection-training-for-staff.md) - [Keeping personal data secure: what Article 32 requires](https://theassurancedesk.com/guides/keeping-personal-data-secure-article-32.md) - [A subject access request arrives: what should you do?](https://theassurancedesk.com/guides/subject-access-request-what-to-do.md) - [UK GDPR versus EU GDPR: which rules apply?](https://theassurancedesk.com/guides/uk-gdpr-vs-eu-gdpr.md) - [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md) - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md): Guide, 7 October 2026. Start with the personal data you hold, then check your duties, fee and need for a DPO separately. - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md): Guide, 7 October 2026. Follow the decisions about the data, rather than the label on the contract. - In this series - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md) - [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md): Guide, 7 October 2026. The law has changed, but your old data protection duties have not disappeared. - In this series - [Automated decisions: what UK GDPR now requires](https://theassurancedesk.com/guides/automated-decisions-uk-gdpr.md) - [Do you have to pay the ICO fee?](https://theassurancedesk.com/guides/ico-data-protection-fee.md): Guide, 7 October 2026. Check the exemption first, then the right fee band, before paying a letter or invoice. - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md): Guide, 7 October 2026. Ask this before you hire anyone, because the answer changes what you need to buy. - In this series - [Can your IT manager be your DPO?](https://theassurancedesk.com/guides/can-your-it-manager-be-your-dpo.md) - [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md) - [Is a data protection officer a senior role?](https://theassurancedesk.com/guides/is-a-data-protection-officer-a-senior-role.md) - [Schools and academies: who can be your DPO?](https://theassurancedesk.com/guides/schools-and-academies-who-can-be-your-dpo.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md): Guide, 7 October 2026. The lowest monthly fee we found published for an outsourced DPO is £350 plus VAT, for two hours a month. - In this series - [Day rate or retainer: how do consultants charge?](https://theassurancedesk.com/guides/data-protection-consultant-day-rate-or-retainer.md) - [How much does data protection software cost per year?](https://theassurancedesk.com/guides/how-much-does-data-protection-software-cost-per-year.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md): Guide, 7 October 2026. Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do. - In this series - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md) - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md) - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md) - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md): Guide, 7 October 2026. Get the right people involved, contain the breach and keep the reporting decisions clear. - In this series - [A data breach compensation claim: what should businesses know?](https://theassurancedesk.com/guides/data-breach-compensation-claim.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md): Guide, 7 October 2026. Most letters from the regulator have a clear next step, and a calm first week makes the rest easier. - [How much can the ICO fine you under UK GDPR?](https://theassurancedesk.com/guides/uk-gdpr-fines.md): Guide, 7 October 2026. The legal maximum is a ceiling, not a prediction of what a business will pay. ## [AI governance](https://theassurancedesk.com/ai-governance.md) - [What is AI governance, in plain words?](https://theassurancedesk.com/guides/what-is-ai-governance.md): Guide, 7 October 2026. Give people a clear way to choose, use and check AI at work. - In this series - [AI agents: what to check before they act](https://theassurancedesk.com/guides/ai-agents-permissions-and-approvals.md) - [Does your UK business need an AI policy, and what goes in it?](https://theassurancedesk.com/guides/the-ai-governance-gap.md): Guide, 7 October 2026. If staff use AI tools at work, a policy is how your business decides what goes into them. - In this series - [Can staff paste client data into ChatGPT or Copilot?](https://theassurancedesk.com/guides/staff-client-data-chatgpt-copilot.md) - [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md) - [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md) - [Do you need AI governance software, or is an adviser enough?](https://theassurancedesk.com/guides/ai-governance-software-or-adviser.md): Guide, 7 October 2026. Knowing what each one does helps you buy the help you need, and only that. - In this series - [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy.md) - [Is there a qualification or certification for AI governance?](https://theassurancedesk.com/guides/ai-governance-qualifications-and-certification.md): Guide, 7 October 2026. A qualification for a person and a certificate for an organisation answer different questions. - [How does the UK regulate AI?](https://theassurancedesk.com/guides/uk-ai-regulation.md): Guide, 7 October 2026. AI is covered by laws your firm may already follow, and the UK rules on automated decisions changed in 2026. - [What does the EU AI Act ask of a UK business?](https://theassurancedesk.com/guides/eu-ai-act-uk-business.md): Guide, 7 October 2026. Some of its rules already apply, and your role decides which ones reach your firm. - In this series - [EU AI Act timeline: the key dates after the July 2026 changes](https://theassurancedesk.com/guides/eu-ai-act-timeline.md) - [Who can help a UK firm with the EU AI Act?](https://theassurancedesk.com/guides/who-can-help-uk-firm-eu-ai-act.md) - [ISO 42001 in the UK: who certifies you, and what does it cost?](https://theassurancedesk.com/guides/iso-42001-certification-and-who-can-certify-you.md): Guide, 7 October 2026. A certificate is worth what the body behind it is accredited to do, so check the body before you choose. - In this series - [ISO 42001 or ISO 27001: which do you need, and which first?](https://theassurancedesk.com/guides/iso-42001-or-iso-27001.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md): Guide, 7 October 2026. Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do. - In this series - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md) - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md) - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md) - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md) ## [Cyber security](https://theassurancedesk.com/cyber-security.md) - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md): Guide, 7 October 2026. Know what the fee buys before you book an assessment or pay for help. - In this series - [Cyber Essentials Plus: what does the technical test add?](https://theassurancedesk.com/guides/cyber-essentials-plus-technical-test.md) - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md): Guide, 7 October 2026. Knowing the steps, and who may do each one, helps you plan the time and choose the right firms. - In this series - [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md) - [How much does ISO 27001 certification cost in the UK?](https://theassurancedesk.com/guides/iso-27001-certification-cost-uk.md) - [How to find UKAS accredited ISO 27001 certification bodies](https://theassurancedesk.com/guides/ukas-accredited-iso-27001-certification-bodies.md) - [How long does ISO 27001 take?](https://theassurancedesk.com/guides/how-long-does-iso-27001-take.md) - [ISO 27001 or SOC 2: which does your customer want?](https://theassurancedesk.com/guides/iso-27001-or-soc-2.md) - [The ISO 27000 family: which standard does what?](https://theassurancedesk.com/guides/iso-27000-family-explained.md) - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md): Guide, 7 October 2026. A clear response connects each answer to the service, the evidence and any work still to do. - In this series - [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md) - [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md) - [SOC 2: what is it, and who asks for it?](https://theassurancedesk.com/guides/soc-2-what-it-is-and-who-asks-for-it.md): Guide, 8 October 2026. A customer wants your SOC 2 report, so start by checking what they need it to show. - [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md): Guide, 8 October 2026. Give your team a plan they can find, read and use when something goes wrong. - In this series - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md) ## Lists - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price.md): A published price lets you see a figure before you speak to a firm, and this list gives every one we found. --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.