# Data protection consultants and indemnity insurance: who pays if advice is wrong? Knowing who pays, and what insurance covers, helps you ask the right questions before you sign. The Assurance Desk. Published 5 October 2026. Last checked 7 October 2026. Part of the guide [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md). **The short answer.** Your organisation pays first. Under UK data protection law, a fine or a compensation claim goes to the controller or processor. The ICO says a data protection officer is not personally liable for compliance. A consultant's insurance and contract matter if you then claim against the consultant ([legislation.gov.uk, UK GDPR, Article 82](https://www.legislation.gov.uk/eur/2016/679/article/82), [legislation.gov.uk, Data Protection Act 2018, section 155](https://www.legislation.gov.uk/ukpga/2018/12/section/155) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 5 October 2026). ## Do data protection consultants need professional indemnity insurance? Some data protection consultants must hold professional indemnity insurance, and many others say whether they do. [Professional indemnity insurance](/glossary#pi-insurance) covers a firm if a client claims that its advice or work caused a loss. Under the UK's Provision of Services Regulations 2009, a firm that must hold professional liability insurance has to tell its clients about it. That includes the insurer's contact details and where the cover applies ([legislation.gov.uk, The Provision of Services Regulations 2009, regulation 8](https://www.legislation.gov.uk/uksi/2009/2999/regulation/8), checked 5 October 2026). A firm in a regulated profession must also tell you the professional body it is registered with, and its professional title ([legislation.gov.uk, The Provision of Services Regulations 2009, regulation 8](https://www.legislation.gov.uk/uksi/2009/2999/regulation/8), checked 5 October 2026). The firm can give you this information itself. Or it can put it where you can easily reach it electronically, at an address the firm gives you ([legislation.gov.uk, The Provision of Services Regulations 2009, regulation 8](https://www.legislation.gov.uk/uksi/2009/2999/regulation/8), checked 5 October 2026). Law firms are one example. Bird & Bird and Gowling WLG say their cover is above the minimum that the SRA sets. Our [guide to choosing an adviser](/guides/how-to-choose-a-data-protection-adviser) explains what SRA regulation covers. We read this on their own websites in September 2026 ([The Assurance Desk, Bird & Bird LLP profile](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk) and [The Assurance Desk, Gowling WLG (UK) LLP profile](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp), checked 5 October 2026). ## Which data protection firms publish their indemnity cover? 19 of the 140 UK and US providers on this site say on their own pages that they hold indemnity cover. We checked each provider's own website between July and October 2026. Some name their insurer and say where the cover applies. One includes the insurance in its day rate. We read these on each firm's own website between July and September 2026 ([The Assurance Desk, Arcanum Cyber Security (Arcanum Information Security Limited) profile](https://theassurancedesk.com/advisers/arcanum-cyber-security), [The Assurance Desk, Bird & Bird LLP profile](https://theassurancedesk.com/advisers/bird-and-bird-llp-uk), [The Assurance Desk, EY (UK), Ernst & Young LLP profile](https://theassurancedesk.com/advisers/ey-llp-uk), [The Assurance Desk, Gowling WLG (UK) LLP profile](https://theassurancedesk.com/advisers/gowling-wlg-uk-llp), [The Assurance Desk, KPMG LLP (UK) profile](https://theassurancedesk.com/advisers/kpmg-llp-uk) and [The Assurance Desk, Forvis Mazars profile](https://theassurancedesk.com/advisers/forvis-mazars), checked 5 October 2026). Other firms do not publish details of their cover on the pages we checked. That is plain information, not a verdict: you can ask any firm for the details ([The Assurance Desk, Anekanta Consulting profile](https://theassurancedesk.com/advisers/anekanta-consulting), [The Assurance Desk, Athlex profile](https://theassurancedesk.com/advisers/athlex), [The Assurance Desk, Bridewell profile](https://theassurancedesk.com/advisers/bridewell) and [The Assurance Desk, DataGuard profile](https://theassurancedesk.com/advisers/dataguard), checked 5 October 2026). **What some firms publish about their indemnity cover, from each firm's own website, as The Assurance Desk recorded it between July and September 2026.** | Firm | What it publishes | | --- | --- | | Forvis Mazars | Names its lead insurer, under the Provision of Services Regulations 2009 | | EY (UK) | Names its insurer; cover is worldwide | | KPMG LLP (UK) | Names its insurers; cover is worldwide | | Bird & Bird LLP | Cover above the SRA minimum, worldwide; names its primary insurers | | Gowling WLG (UK) LLP | Cover above the SRA minimum, from a Lloyd's consortium, worldwide | | Arcanum Cyber Security | Says indemnity insurance is included in its day rate | Source: The Assurance Desk, Arcanum Cyber Security (Arcanum Information Security Limited) profile, https://theassurancedesk.com/advisers/arcanum-cyber-security (checked 5 October 2026); The Assurance Desk, Bird & Bird LLP profile, https://theassurancedesk.com/advisers/bird-and-bird-llp-uk (checked 5 October 2026); The Assurance Desk, EY (UK), Ernst & Young LLP profile, https://theassurancedesk.com/advisers/ey-llp-uk (checked 5 October 2026); The Assurance Desk, Gowling WLG (UK) LLP profile, https://theassurancedesk.com/advisers/gowling-wlg-uk-llp (checked 5 October 2026); The Assurance Desk, KPMG LLP (UK) profile, https://theassurancedesk.com/advisers/kpmg-llp-uk (checked 5 October 2026); The Assurance Desk, Forvis Mazars profile, https://theassurancedesk.com/advisers/forvis-mazars (checked 5 October 2026) ## If a consultant gives wrong advice, who pays the fine? The fine goes to the organisation that failed, not to its adviser. Under UK data protection law, the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO) can give a penalty notice. It requires a person to pay it an amount in sterling ([legislation.gov.uk, Data Protection Act 2018, section 155](https://www.legislation.gov.uk/ukpga/2018/12/section/155), checked 5 October 2026). When it decides on a penalty, it looks at the degree of responsibility of the controller or processor. It also looks at whether the failure was intentional or negligent. And it looks at what was done to reduce the harm to people ([legislation.gov.uk, Data Protection Act 2018, section 155](https://www.legislation.gov.uk/ukpga/2018/12/section/155), checked 5 October 2026). The ICO says a data protection officer is not personally liable for data protection compliance. Compliance with UK GDPR stays with the controller or processor, even when the officer is from an outside firm ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 5 October 2026). The ICO's fining guidance explains how the amount of a fine is worked out ([ICO, Data Protection Fining Guidance](https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/), checked 5 October 2026). > "The DPO isn’t personally liable for data protection compliance." > ICO, DPO guidance > ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 5 October 2026) ## Who pays compensation if people are harmed? Under UK GDPR, a person who suffers damage because of an infringement can claim compensation from the controller or processor ([legislation.gov.uk, UK GDPR, Article 82](https://www.legislation.gov.uk/eur/2016/679/article/82), checked 5 October 2026). Any controller involved in the processing is liable. A processor is liable only where it did not meet the duties UK GDPR gives processors. It is also liable where it acted outside or against the controller's lawful instructions ([legislation.gov.uk, UK GDPR, Article 82](https://www.legislation.gov.uk/eur/2016/679/article/82), checked 5 October 2026). A controller or processor is not liable if it proves it was not in any way responsible for what caused the damage ([legislation.gov.uk, UK GDPR, Article 82](https://www.legislation.gov.uk/eur/2016/679/article/82), checked 5 October 2026). Sometimes more than one controller or processor is involved. Then one that paid full compensation can claim back the part that matches the others' share of responsibility ([legislation.gov.uk, UK GDPR, Article 82](https://www.legislation.gov.uk/eur/2016/679/article/82), checked 5 October 2026). **Who answers for what** - **Your organisation, as controller**: Responsible for overall compliance, and for showing it (Can be fined, and liable to pay damages) - **A processor**: Processes personal data on your instructions (Liable where it fails its own duties or acts outside your instructions) - **Your adviser or outside data protection officer**: Advises you and helps you monitor compliance (Not personally liable for compliance; must carry out the service with reasonable care and skill) Who UK data protection law holds liable, and what an adviser owes under its contract. Source: legislation.gov.uk, UK GDPR, Article 82, https://www.legislation.gov.uk/eur/2016/679/article/82 (checked 5 October 2026); legislation.gov.uk, Supply of Goods and Services Act 1982, section 13, https://www.legislation.gov.uk/ukpga/1982/29/section/13 (checked 5 October 2026); ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 5 October 2026); ICO, Contracts, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/ (checked 5 October 2026) ## Can you claim back from the consultant? Your contract with the consultant is where that question is settled. This is general information, and a solicitor can advise on your own contract. The Supply of Goods and Services Act 1982 applies in England, Wales and Northern Ireland. It says a business that supplies a service under a relevant contract must use reasonable care and skill ([legislation.gov.uk, Supply of Goods and Services Act 1982, section 13](https://www.legislation.gov.uk/ukpga/1982/29/section/13), checked 5 October 2026). Many contracts limit what a firm will pay. The Unfair Contract Terms Act 1977 applies in England, Wales and Northern Ireland. Under it, a term that limits liability for negligence must be reasonable. That section does not apply to a term in a consumer contract ([legislation.gov.uk, Unfair Contract Terms Act 1977, section 2](https://www.legislation.gov.uk/ukpga/1977/50/section/2), checked 5 October 2026). If the consultant handles personal data for you as a processor, there must also be a written contract. The ICO says the contract helps both sides understand their responsibilities and liabilities ([ICO, Contracts](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/), checked 5 October 2026). This is where indemnity insurance matters. If you claim against a firm, its insurance can help it pay. That is why some buyers ask about it before they sign. **Check the contract alongside the insurance** - What work has the firm agreed to do? - What limit does the contract put on liability? - What does the insurance cover? - Does the cover apply to the work you are buying? Questions for the adviser and, where needed, your solicitor. The policy and contract decide the detail. Source: legislation.gov.uk, Supply of Goods and Services Act 1982, section 13, https://www.legislation.gov.uk/ukpga/1982/29/section/13 (checked 5 October 2026); legislation.gov.uk, Unfair Contract Terms Act 1977, section 2, https://www.legislation.gov.uk/ukpga/1977/50/section/2 (checked 5 October 2026) ## What to do 1. Ask any firm, before you sign, whether it holds professional indemnity insurance and what the policy covers. 2. Read the liability clause in the contract. A term that limits liability for negligence must be reasonable ([legislation.gov.uk, Unfair Contract Terms Act 1977, section 2](https://www.legislation.gov.uk/ukpga/1977/50/section/2), checked 5 October 2026). 3. Keep a record of the advice you were given and the decisions you took. Controllers must be able to show that they comply ([ICO, Contracts](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/), checked 5 October 2026). 4. If the firm handles personal data for you, put a written contract in place ([ICO, Contracts](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/), checked 5 October 2026). 5. If you appoint an outside data protection officer, give them the same position, tasks and duties as an internal one ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 5 October 2026). ## Common questions ### If a data protection consultant gives wrong advice, who pays the fine? The controller or processor. The Commission gives a penalty notice to the organisation that failed. The ICO says a data protection officer is not personally liable for compliance ([legislation.gov.uk, Data Protection Act 2018, section 155](https://www.legislation.gov.uk/ukpga/2018/12/section/155) and [ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 5 October 2026). ### Does a consultant have to tell me about its insurance? A firm that must hold professional liability insurance has to tell its clients about it. That includes the insurer's contact details and where the cover applies ([legislation.gov.uk, The Provision of Services Regulations 2009, regulation 8](https://www.legislation.gov.uk/uksi/2009/2999/regulation/8), checked 5 October 2026). ### Can I hire an outside firm as our data protection officer? Yes. The ICO says you can contract out the role under a service contract with a person or a firm. The outside officer has the same position, tasks and duties as an internal one ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 5 October 2026). ### What should a data protection officer know? UK GDPR says you should appoint one on their professional qualities, in particular experience and expert knowledge of data protection law ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 5 October 2026). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Switching provider](https://theassurancedesk.com/best/switching-provider.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) ## Sources - legislation.gov.uk, UK GDPR, Article 82: https://www.legislation.gov.uk/eur/2016/679/article/82 (checked 5 October 2026) - legislation.gov.uk, Data Protection Act 2018, section 155: https://www.legislation.gov.uk/ukpga/2018/12/section/155 (checked 5 October 2026) - ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 5 October 2026) - legislation.gov.uk, The Provision of Services Regulations 2009, regulation 8: https://www.legislation.gov.uk/uksi/2009/2999/regulation/8 (checked 5 October 2026) - The Assurance Desk, Bird & Bird LLP profile: https://theassurancedesk.com/advisers/bird-and-bird-llp-uk (checked 5 October 2026) - The Assurance Desk, Gowling WLG (UK) LLP profile: https://theassurancedesk.com/advisers/gowling-wlg-uk-llp (checked 5 October 2026) - The Assurance Desk, Arcanum Cyber Security (Arcanum Information Security Limited) profile: https://theassurancedesk.com/advisers/arcanum-cyber-security (checked 5 October 2026) - The Assurance Desk, EY (UK), Ernst & Young LLP profile: https://theassurancedesk.com/advisers/ey-llp-uk (checked 5 October 2026) - The Assurance Desk, KPMG LLP (UK) profile: https://theassurancedesk.com/advisers/kpmg-llp-uk (checked 5 October 2026) - The Assurance Desk, Forvis Mazars profile: https://theassurancedesk.com/advisers/forvis-mazars (checked 5 October 2026) - The Assurance Desk, Anekanta Consulting profile: https://theassurancedesk.com/advisers/anekanta-consulting (checked 5 October 2026) - The Assurance Desk, Athlex profile: https://theassurancedesk.com/advisers/athlex (checked 5 October 2026) - The Assurance Desk, Bridewell profile: https://theassurancedesk.com/advisers/bridewell (checked 5 October 2026) - The Assurance Desk, DataGuard profile: https://theassurancedesk.com/advisers/dataguard (checked 5 October 2026) - ICO, Data Protection Fining Guidance: https://ico.org.uk/about-the-ico/our-information/policies-and-procedures/data-protection-fining-guidance/ (checked 5 October 2026) - legislation.gov.uk, Supply of Goods and Services Act 1982, section 13: https://www.legislation.gov.uk/ukpga/1982/29/section/13 (checked 5 October 2026) - ICO, Contracts: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/ (checked 5 October 2026) - legislation.gov.uk, Unfair Contract Terms Act 1977, section 2: https://www.legislation.gov.uk/ukpga/1977/50/section/2 (checked 5 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.