# Day rate or retainer: how do consultants charge?

Compare the work, access and limits in the proposal before comparing the headline fee.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

Part of the guide [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md).

**The short answer.** Compare proposals for the same work before choosing a day rate or retainer. Ask what time, support and deliverables are included, what costs extra and how you can leave. If the service includes a formal DPO, its duties and independence need checking too ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

## What are you paying for?

Start with the job you need done. Is it a defined project, occasional expert help, or an ongoing data protection officer service? Ask each firm to price the same brief.

The table below is a set of buying questions. It does not say which model will cost least for your organisation.

**Questions for each charging model**

| Model in the proposal | Ask before agreeing |
| --- | --- |
| Day rate | How long is a day, who does the work, how many days are expected and who approves more? |
| Fixed project fee | Which outputs, meetings and revisions are included, and what counts as a change? |
| Retainer | What time and support are included each period, what carries over and what is charged separately? |
| Formal DPO service | Does the contract provide the expertise, independence, resources and access the role needs? |

Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)

## What do published prices show?

The Desk’s Athlex profile records monthly DPO packages with different amounts of support time. Its Ametros Group profile records ranges for projects and outsourced roles. These are dated records from July, not fresh quotes for work today ([theassurancedesk.com, Athlex review: prices, credentials and cover, The Assurance Desk](https://theassurancedesk.com/advisers/athlex) and [theassurancedesk.com, Ametros Group review: prices, credentials and cover, The Assurance Desk](https://theassurancedesk.com/advisers/ametros-group), checked 7 October 2026).

The figures show why the unit matters. A monthly price with limited support hours is a different offer from a defined project. Ask for a current proposal and the full terms before using either as a budget ([theassurancedesk.com, Athlex review: prices, credentials and cover, The Assurance Desk](https://theassurancedesk.com/advisers/athlex) and [theassurancedesk.com, Ametros Group review: prices, credentials and cover, The Assurance Desk](https://theassurancedesk.com/advisers/ametros-group), checked 7 October 2026).

**Examples in the Desk’s recorded provider reviews, not a market average**

| Recorded offer | Price in the record | What to keep in view |
| --- | --- | --- |
| Athlex DPO packages | £350, £650 or £950 a month plus VAT | Two, five or seven hours of support respectively. Record checked 16 July 2026. |
| Ametros advisory projects | £2,000 to £15,000 per project | A range, requiring a tailored quote. Record checked 17 July 2026. |
| Ametros outsourced roles | £900 to £3,500 a month | A different service and unit from the project range. Record checked 17 July 2026. |

Source: theassurancedesk.com, Athlex review: prices, credentials and cover, The Assurance Desk, https://theassurancedesk.com/advisers/athlex (checked 7 October 2026); theassurancedesk.com, Ametros Group review: prices, credentials and cover, The Assurance Desk, https://theassurancedesk.com/advisers/ametros-group (checked 7 October 2026)

## What if the retainer includes your DPO?

An external DPO can be an individual or an organisation under a service contract. The role still needs the same position, tasks and duties as an internal DPO. Ask how the package provides enough time, expertise and access to senior management ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

The DPO advises, monitors compliance and acts as a contact point. Your organisation remains responsible for complying with UK data protection law. Check that the proposal says who does the practical work as well as who advises on it ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

**Read the support promise before the price**

- Who is the named person doing the work?
- What time and tasks are included?
- When is support available?
- What work triggers an extra charge?
- How are urgent matters and absence covered?
- What happens to the work and records when the service ends?

Use the answers to compare written proposals. These are questions, not assumptions about a particular supplier.

Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)

## How do you compare the total cost?

Ask for a costed version of the work you actually expect. Keep the setup, ongoing support, optional tools and extra work on separate lines. Check tax, notice periods and renewal terms.

For a day rate, ask for the expected time and a point at which further work needs approval. For a retainer, ask what happens when the included time runs out. These answers make the comparison more useful than a price alone.

## What to do

1. Write one brief and send the same scope to each firm.
2. Ask for named people, outputs, included time and support availability.
3. Check the DPO requirements separately if that formal role is included ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).
4. Request current prices, extra charges and exit terms in writing.

## Common questions

### Is a retainer always cheaper than a day rate?

Compare the total for the work and support you need. Ask what happens if you use less or more time than expected. This guide does not establish a general price ranking.

### Does a monthly DPO fee transfer responsibility to the consultant?

No. The controller or processor remains responsible for compliance. An external DPO has the same role requirements as an internal one ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026).

### Are the published examples quotes for my organisation?

No. They are dated Desk profile records: Athlex from 16 July 2026 and Ametros from 17 July 2026. Ask the firms for current proposals and terms ([theassurancedesk.com, Athlex review: prices, credentials and cover, The Assurance Desk](https://theassurancedesk.com/advisers/athlex) and [theassurancedesk.com, Ametros Group review: prices, credentials and cover, The Assurance Desk](https://theassurancedesk.com/advisers/ametros-group), checked 7 October 2026).

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [Switching provider](https://theassurancedesk.com/best/switching-provider.md)
- [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md)
- [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)

## Sources

- ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026)
- theassurancedesk.com, Athlex review: prices, credentials and cover, The Assurance Desk: https://theassurancedesk.com/advisers/athlex (checked 7 October 2026)
- theassurancedesk.com, Ametros Group review: prices, credentials and cover, The Assurance Desk: https://theassurancedesk.com/advisers/ametros-group (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.