# How do you check that a data protection consultant is qualified? A job title says little, so it helps to know what to ask for and what each certificate shows. The Assurance Desk. Published 6 October 2026. Last checked 7 October 2026. Part of the guide [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md). **The short answer.** UK law names no single qualification for a data protection officer. It asks for professional qualities and expert knowledge of data protection law, so you check each person yourself ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/37) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). ## What qualifications should a data protection consultant have? A data protection consultant needs no single qualification under UK GDPR. The law says an officer is chosen for professional qualities, in particular expert knowledge of data protection law and practices. It also asks for the ability to do the officer's tasks ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/37) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). The ICO says the law does not specify the precise credentials. It does say that they should fit the type of processing you carry out, and the level of protection the data needs ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). The officer can be one of your staff. Or you can contract out the role, under a service contract with a person or a firm ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/37) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). > "It doesn’t specify the precise credentials they are expected to have, but it does say that this should be proportionate to the type of processing you carry out, taking into consideration the level of protection the personal data requires." > ICO, DPO guidance > ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 6 October 2026) ## Is data protection consulting regulated in the UK? UK GDPR sets rules for the organisation that appoints an officer, and the duty to comply stays with that organisation. The ICO says a data protection officer is not personally liable for data protection compliance ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). A certificate does not move that duty either. Under UK GDPR, a certification does not reduce the responsibility of the controller or the processor for compliance ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/42), checked 6 October 2026). ## Is there a register of approved data protection officers? The [Information Commission](/news/ico-becomes-the-information-commission) (the ICO) records the officer that each organisation names, and it publishes a register of fee payers. It has a service to add or update a data protection officer ([ICO, Add a Data Protection Officer (DPO)](https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/), checked 6 October 2026). An organisation that uses an outside firm gives the ICO the firm's name and contact details ([ICO, Add a Data Protection Officer (DPO)](https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/), checked 6 October 2026). UK GDPR asks an organisation to publish its officer's contact details and to give them to the ICO. It does not have to include the officer's name ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/37) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). **Two checks that answer different questions** | Check | What it tells you | | --- | --- | | DPO contact record | Who the organisation names as its contact for data protection | | Certificate from an issuing body | What qualification or certification the person or organisation holds | Source: ICO, Add a Data Protection Officer (DPO), https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/ (checked 6 October 2026); IAPP, CIPP/E: Certified Information Privacy Professional/Europe, https://iapp.org/certify/cippe (checked 6 October 2026); ICO, Certification schemes register, https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/ (checked 6 October 2026) ## Which certificates exist, and what does each one show? The word certificate covers different things, and each one shows something different. The first is a certificate for a person. For example, the IAPP says its CIPP/E designation shows an understanding of European and national data protection laws, privacy terms and the protection of personal data ([IAPP, CIPP/E: Certified Information Privacy Professional/Europe](https://iapp.org/certify/cippe), checked 6 October 2026). The second is UK GDPR certification. It is meant to show that an organisation's processing operations comply. It is voluntary, and it lasts three years at most ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/42), checked 6 October 2026). The third is the registration certificate that the ICO issues when an organisation pays the data protection fee. The ICO says that is different from UK GDPR certification ([ICO, Certification schemes register](https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/), checked 6 October 2026). **Certificates and what each one shows** - **A certificate for a person**: Shows an understanding of European and national data protection laws (The IAPP's CIPP/E is one example) - **UK GDPR certification**: Shows that an organisation's processing operations comply (Voluntary, and lasts three years at most) - **The ICO registration certificate**: Shows an organisation is registered and pays the data protection fee (Different from UK GDPR certification) What each kind of certificate is for, from the IAPP, UK GDPR and the ICO. Source: legislation.gov.uk, UK GDPR, Article 42, https://www.legislation.gov.uk/eur/2016/679/article/42 (checked 6 October 2026); ICO, Certification schemes register, https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/ (checked 6 October 2026); IAPP, CIPP/E: Certified Information Privacy Professional/Europe, https://iapp.org/certify/cippe (checked 6 October 2026) ## Who checks the UK GDPR certification schemes? The ICO keeps a register of certification schemes whose criteria it approved. The ICO says the approved schemes are under review, because of the Data (Use and Access) Act, which became law on 19 June 2025 ([ICO, Certification schemes register](https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/), checked 6 October 2026). UKAS says the certification bodies that run approved schemes must be accredited to ISO/IEC 17065:2012 and the ICO's extra requirements. UKAS lists them on its website ([UKAS, UK GDPR, New Programmes](https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/uk-gdpr/), checked 6 October 2026). One approved scheme is for training companies. It concerns how those companies handle personal data. It does not rate the courses they teach. The ICO's register says no UKAS accredited body can yet issue it ([ICO, Provision of Training and Qualifications Services](https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-scheme-register/provision-of-training-and-qualifications-services/), checked 6 October 2026). ## What do firms publish about their people's qualifications? 102 of the 140 UK and US providers on this site name their credentials. We checked each provider's own website between July and October 2026. Some firms publish a named team with each person's qualifications. Others name few people, or none. That is plain information about a firm's website, not a verdict on its people ([The Assurance Desk, The DPO Centre profile](https://theassurancedesk.com/advisers/dpo-centre), [The Assurance Desk, Evalian profile](https://theassurancedesk.com/advisers/evalian), [The Assurance Desk, HewardMills profile](https://theassurancedesk.com/advisers/hewardmills) and [The Assurance Desk, JVR Consultancy profile](https://theassurancedesk.com/advisers/jvr-consultancy), checked 6 October 2026). **What some firms say about their people's qualifications on their own websites, as The Assurance Desk recorded it.** | Firm | What its pages say | | --- | --- | | The DPO Centre | A team page with named staff and each person's qualifications | | Evalian | Named leaders, with each person's qualifications | | HewardMills | Names its team and roles, with no per-person qualifications on the page we read | | Athlex | Names no staff and no individual qualifications | | JVR Consultancy | Names no individual consultants and no individual qualifications | | Data GRC | No named staff or qualifications on the pages we checked | Source: The Assurance Desk, Data GRC Ltd profile, https://theassurancedesk.com/advisers/data-grc (checked 6 October 2026); The Assurance Desk, Athlex profile, https://theassurancedesk.com/advisers/athlex (checked 6 October 2026); The Assurance Desk, The DPO Centre profile, https://theassurancedesk.com/advisers/dpo-centre (checked 6 October 2026); The Assurance Desk, Evalian profile, https://theassurancedesk.com/advisers/evalian (checked 6 October 2026); The Assurance Desk, HewardMills profile, https://theassurancedesk.com/advisers/hewardmills (checked 6 October 2026); The Assurance Desk, JVR Consultancy profile, https://theassurancedesk.com/advisers/jvr-consultancy (checked 6 October 2026) ## How can you check a consultant yourself? Ask who will do the work, and what each person holds. Then check each certificate with the body that issued it. If a firm says it holds UK GDPR certification, look for the scheme on the ICO's register, and for the certification body on the UKAS list ([ICO, Certification schemes register](https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/) and [UKAS, UK GDPR, New Programmes](https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/uk-gdpr/), checked 6 October 2026). If the firm will act as your officer, the contract is the place to set out the work. The ICO says you can contract out the role under a service contract ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). **Questions to put to a consultant** - Who will do the work, and what does each person hold? - Who issued each certificate, and can you check it with them? - Is any UK GDPR certification on the ICO's register, with a UKAS listed body? - What will the service contract say the firm does for you? - Which sectors has the person worked in? Questions to ask before you sign, whoever you choose. Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 6 October 2026); ICO, Certification schemes register, https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/ (checked 6 October 2026); UKAS, UK GDPR, New Programmes, https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/uk-gdpr/ (checked 6 October 2026) ## What to do 1. Ask every firm who will do your work, and what each person holds. 2. Check each certificate with the body that issued it. 3. Match the experience to your own processing. The ICO says the credentials should fit the type of processing and the level of protection the data needs ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). 4. If you contract out the role, set out the work in a service contract ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). 5. Publish your officer's contact details, and give them to the ICO ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/37) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). ## Common questions ### Is there a register of approved data protection officers in the UK? The ICO records the officer each organisation names, and it publishes a register of fee payers ([ICO, Add a Data Protection Officer (DPO)](https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/), checked 6 October 2026). ### Does a data protection officer need a legal qualification? UK GDPR does not name one. The ICO says the law does not specify the precise credentials a data protection officer must have ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 6 October 2026). ### Is a UK GDPR certificate the same as an ICO registration certificate? No. The ICO says UK GDPR certification is different from the registration certificate issued when an organisation pays the data protection fee ([ICO, Certification schemes register](https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/), checked 6 October 2026). ### Does a certificate make the firm responsible for our compliance? No. A certification does not reduce the responsibility of the controller or the processor for compliance ([legislation.gov.uk, UK GDPR, Article 42](https://www.legislation.gov.uk/eur/2016/679/article/42), checked 6 October 2026). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md) ## Sources - legislation.gov.uk, UK GDPR, Article 37: https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 6 October 2026) - ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 6 October 2026) - legislation.gov.uk, UK GDPR, Article 42: https://www.legislation.gov.uk/eur/2016/679/article/42 (checked 6 October 2026) - ICO, Add a Data Protection Officer (DPO): https://ico.org.uk/for-organisations/data-protection-fee/your-data-protection-officer-is/ (checked 6 October 2026) - IAPP, CIPP/E: Certified Information Privacy Professional/Europe: https://iapp.org/certify/cippe (checked 6 October 2026) - ICO, Certification schemes register: https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-schemes-register/ (checked 6 October 2026) - UKAS, UK GDPR, New Programmes: https://www.ukas.com/accreditation/about/developing-new-programmes/development-programmes/uk-gdpr/ (checked 6 October 2026) - ICO, Provision of Training and Qualifications Services: https://ico.org.uk/for-organisations/advice-and-services/certification-schemes/certification-scheme-register/provision-of-training-and-qualifications-services/ (checked 6 October 2026) - The Assurance Desk, The DPO Centre profile: https://theassurancedesk.com/advisers/dpo-centre (checked 6 October 2026) - The Assurance Desk, Evalian profile: https://theassurancedesk.com/advisers/evalian (checked 6 October 2026) - The Assurance Desk, HewardMills profile: https://theassurancedesk.com/advisers/hewardmills (checked 6 October 2026) - The Assurance Desk, JVR Consultancy profile: https://theassurancedesk.com/advisers/jvr-consultancy (checked 6 October 2026) - The Assurance Desk, Data GRC Ltd profile: https://theassurancedesk.com/advisers/data-grc (checked 6 October 2026) - The Assurance Desk, Athlex profile: https://theassurancedesk.com/advisers/athlex (checked 6 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.