Data protection consultants and indemnity insurance: who pays if advice is wrong?

Part of the guide How do I choose a data protection or AI governance adviser?

Do data protection consultants need professional indemnity insurance?

Some data protection consultants must hold professional indemnity insurance, and many others say whether they do. Professional indemnity insurance covers a firm if a client claims that its advice or work caused a loss.

Under the UK's Provision of Services Regulations 2009, a firm that must hold professional liability insurance has to tell its clients about it. That includes the insurer's contact details and where the cover applies.

A firm in a regulated profession must also tell you the professional body it is registered with, and its professional title.

The firm can give you this information itself. Or it can put it where you can easily reach it electronically, at an address the firm gives you.

Law firms are one example. Bird & Bird and Gowling WLG say their cover is above the minimum that the SRA sets. Our guide to choosing an adviser explains what SRA regulation covers. We read this on their own websites in September 2026.

Which data protection firms publish their indemnity cover?

19 of the 140 UK and US providers on this site say on their own pages that they hold indemnity cover. We checked each provider's own website between July and October 2026.

Some name their insurer and say where the cover applies. One includes the insurance in its day rate. We read these on each firm's own website between July and September 2026.

Other firms do not publish details of their cover on the pages we checked. That is plain information, not a verdict: you can ask any firm for the details.

If a consultant gives wrong advice, who pays the fine?

The fine goes to the organisation that failed, not to its adviser. Under UK data protection law, the Information Commission (the ICO) can give a penalty notice. It requires a person to pay it an amount in sterling.

When it decides on a penalty, it looks at the degree of responsibility of the controller or processor. It also looks at whether the failure was intentional or negligent. And it looks at what was done to reduce the harm to people.

The ICO says a data protection officer is not personally liable for data protection compliance. Compliance with UK GDPR stays with the controller or processor, even when the officer is from an outside firm.

The ICO's fining guidance explains how the amount of a fine is worked out.

Who pays compensation if people are harmed?

Under UK GDPR, a person who suffers damage because of an infringement can claim compensation from the controller or processor.

Any controller involved in the processing is liable. A processor is liable only where it did not meet the duties UK GDPR gives processors. It is also liable where it acted outside or against the controller's lawful instructions.

A controller or processor is not liable if it proves it was not in any way responsible for what caused the damage.

Sometimes more than one controller or processor is involved. Then one that paid full compensation can claim back the part that matches the others' share of responsibility.

Can you claim back from the consultant?

Your contract with the consultant is where that question is settled. This is general information, and a solicitor can advise on your own contract.

The Supply of Goods and Services Act 1982 applies in England, Wales and Northern Ireland. It says a business that supplies a service under a relevant contract must use reasonable care and skill.

Many contracts limit what a firm will pay. The Unfair Contract Terms Act 1977 applies in England, Wales and Northern Ireland. Under it, a term that limits liability for negligence must be reasonable. That section does not apply to a term in a consumer contract.

If the consultant handles personal data for you as a processor, there must also be a written contract. The ICO says the contract helps both sides understand their responsibilities and liabilities.

This is where indemnity insurance matters. If you claim against a firm, its insurance can help it pay. That is why some buyers ask about it before they sign.

What to do

1. Ask any firm, before you sign, whether it holds professional indemnity insurance and what the policy covers.
2. Read the liability clause in the contract. A term that limits liability for negligence must be reasonable.
3. Keep a record of the advice you were given and the decisions you took. Controllers must be able to show that they comply.
4. If the firm handles personal data for you, put a written contract in place.
5. If you appoint an outside data protection officer, give them the same position, tasks and duties as an internal one.

Common questions

If a data protection consultant gives wrong advice, who pays the fine?

The controller or processor. The Commission gives a penalty notice to the organisation that failed. The ICO says a data protection officer is not personally liable for compliance.

Does a consultant have to tell me about its insurance?

A firm that must hold professional liability insurance has to tell its clients about it. That includes the insurer's contact details and where the cover applies.

Can I hire an outside firm as our data protection officer?

Yes. The ICO says you can contract out the role under a service contract with a person or a firm. The outside officer has the same position, tasks and duties as an internal one.

What should a data protection officer know?

UK GDPR says you should appoint one on their professional qualities, in particular experience and expert knowledge of data protection law.

Where next

• First DPO or AI policy
• Switching provider
• How do I choose a data protection or AI governance adviser?
• Do you need a data protection officer? UK GDPR sets three tests
• How much does an outsourced DPO cost, and what does it cover?

This is an independent editorial guide, not legal advice.