How do you check that a data protection consultant is qualified?

Part of the guide How do I choose a data protection or AI governance adviser?

What qualifications should a data protection consultant have?

A data protection consultant needs no single qualification under UK GDPR. The law says an officer is chosen for professional qualities, in particular expert knowledge of data protection law and practices. It also asks for the ability to do the officer's tasks.

The ICO says the law does not specify the precise credentials. It does say that they should fit the type of processing you carry out, and the level of protection the data needs.

The officer can be one of your staff. Or you can contract out the role, under a service contract with a person or a firm.

Is data protection consulting regulated in the UK?

UK GDPR sets rules for the organisation that appoints an officer, and the duty to comply stays with that organisation. The ICO says a data protection officer is not personally liable for data protection compliance.

A certificate does not move that duty either. Under UK GDPR, a certification does not reduce the responsibility of the controller or the processor for compliance.

Is there a register of approved data protection officers?

The Information Commission (the ICO) records the officer that each organisation names, and it publishes a register of fee payers. It has a service to add or update a data protection officer.

An organisation that uses an outside firm gives the ICO the firm's name and contact details.

UK GDPR asks an organisation to publish its officer's contact details and to give them to the ICO. It does not have to include the officer's name.

Which certificates exist, and what does each one show?

The word certificate covers different things, and each one shows something different.

The first is a certificate for a person. For example, the IAPP says its CIPP/E designation shows an understanding of European and national data protection laws, privacy terms and the protection of personal data.

The second is UK GDPR certification. It is meant to show that an organisation's processing operations comply. It is voluntary, and it lasts three years at most.

The third is the registration certificate that the ICO issues when an organisation pays the data protection fee. The ICO says that is different from UK GDPR certification.

Who checks the UK GDPR certification schemes?

The ICO keeps a register of certification schemes whose criteria it approved. The ICO says the approved schemes are under review, because of the Data (Use and Access) Act, which became law on 19 June 2025.

UKAS says the certification bodies that run approved schemes must be accredited to ISO/IEC 17065:2012 and the ICO's extra requirements. UKAS lists them on its website.

One approved scheme is for training companies. It concerns how those companies handle personal data. It does not rate the courses they teach. The ICO's register says no UKAS accredited body can yet issue it.

What do firms publish about their people's qualifications?

102 of the 140 UK and US providers on this site name their credentials. We checked each provider's own website between July and October 2026.

Some firms publish a named team with each person's qualifications. Others name few people, or none. That is plain information about a firm's website, not a verdict on its people.

How can you check a consultant yourself?

Ask who will do the work, and what each person holds. Then check each certificate with the body that issued it.

If a firm says it holds UK GDPR certification, look for the scheme on the ICO's register, and for the certification body on the UKAS list.

If the firm will act as your officer, the contract is the place to set out the work. The ICO says you can contract out the role under a service contract.

What to do

1. Ask every firm who will do your work, and what each person holds.
2. Check each certificate with the body that issued it.
3. Match the experience to your own processing. The ICO says the credentials should fit the type of processing and the level of protection the data needs.
4. If you contract out the role, set out the work in a service contract.
5. Publish your officer's contact details, and give them to the ICO.

Common questions

Is there a register of approved data protection officers in the UK?

The ICO records the officer each organisation names, and it publishes a register of fee payers.

Does a data protection officer need a legal qualification?

UK GDPR does not name one. The ICO says the law does not specify the precise credentials a data protection officer must have.

Is a UK GDPR certificate the same as an ICO registration certificate?

No. The ICO says UK GDPR certification is different from the registration certificate issued when an organisation pays the data protection fee.

Does a certificate make the firm responsible for our compliance?

No. A certification does not reduce the responsibility of the controller or the processor for compliance.

Where next

• First DPO or AI policy
• How do I choose a data protection or AI governance adviser?
• Do you need a data protection officer? UK GDPR sets three tests
• Data protection consultants and indemnity insurance: who pays if advice is wrong?

This is an independent editorial guide, not legal advice.