# How much does an outsourced DPO cost, and what does it cover?

The lowest monthly fee we found published for an outsourced DPO is £350 plus VAT, for two hours a month.

The Assurance Desk. Published 29 September 2026. Last checked 13 October 2026.

**The short answer.** Of the 140 UK and US providers The Assurance Desk checked between July and October 2026, three publish a monthly fee for an outsourced data protection officer (DPO) ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). Athlex starts at £350 plus VAT for two hours a month. Mishcon de Reya starts at £500 plus VAT. Ametros Group gives a typical range of £900 to £3,500 a month. Whatever the price, check what it covers, including help after a data breach ([Athlex](https://athlex.co.uk/outsourced-dpo/), [Mishcon de Reya](https://www.mishcon.com/products/mishcon-dpo) and [Ametros Group](https://ametrosgroup.com/prices/), checked 2 October 2026).

## In this series

- [Day rate or retainer: how do consultants charge?](https://theassurancedesk.com/guides/data-protection-consultant-day-rate-or-retainer.md)
- [How much does data protection software cost per year?](https://theassurancedesk.com/guides/how-much-does-data-protection-software-cost-per-year.md)

## How do firms charge for DPO, data protection and security work?

The published prices in this guide take three forms: a monthly retainer, a day rate or a project fee. A retainer buys set DPO hours or services each month. Athlex sells 2 hours a month for £350 plus VAT, or 7 hours for £950 plus VAT ([Athlex](https://athlex.co.uk/outsourced-dpo/), checked 29 September 2026).

With a day rate, you pay for each day a consultant works. Arcanum, a cyber security firm, lists day rates of £800, £950 and £1,200 plus VAT, by grade, with travel and subsistence charged on top at the buying department's standard rates. They come from its G-Cloud 14 pricing document (version 5.0), whose file name carries the date 7 May 2024. The document does not mention DPO work ([Arcanum](https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92656/514226994123838-pricing-document-2024-05-07-1215.pdf), checked 29 September 2026).

G-Cloud is a catalogue that UK public sector bodies and charities use to buy cloud services. G-Cloud 14 runs until 28 October 2026, when G-Cloud 15 replaces it ([GCA](https://www.gca.gov.uk/agreements/RM1557.14), checked 29 September 2026).

A project fee covers one defined piece of work, such as a gap analysis, which checks where you fall short of a standard. Kafico prices a gap analysis against ISO 27001, the international standard for managing information security, from £1,000, depending on scope, and says a full certification project typically starts from £10,000 ([Kafico](https://www.kafico.co.uk/iso27001), checked 29 September 2026).

**The three ways of charging in this guide, with one published example of each**

| Way to pay | A published example | What to check |
| --- | --- | --- |
| Monthly retainer | Athlex: £350 a month plus VAT for 2 hours | The hour cap, the work outside the plan and the minimum term |
| Day rate | Arcanum: £800 to £1,200 a day plus VAT, travel and subsistence extra (G-Cloud 14 pricing document, file dated May 2024) | An estimate for each piece of work and a limit before overruns |
| Project fee | Kafico: ISO 27001 gap analysis from £1,000, depending on scope | What the scope covers and what happens if it changes |

## Does a DPO retainer include breach response?

A DPO retainer does not always include breach response. DPO-Service's Professional Plan includes help with security incidents and data breaches. GRC Solutions' DPO as a Service gives guidance on breach reporting, but the reporting itself is not included. Ask which kind you are buying before you sign ([GRC Solutions](https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service) and [DPO-Service](https://dpo-service.co.uk/pricing/), checked 2 October 2026).

UK GDPR, the UK's main data protection law, sets the deadline. You must report a breach to the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO), the UK data protection regulator, without undue delay. Where you can, report within 72 hours of becoming aware of it. You need not report a breach that is unlikely to put people at risk ([UK GDPR Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 2 October 2026).

Help with a breach is simpler to agree at the start than in the 72 hours after you find one.

**Help with a breach in two DPO plans**

- **GRC Solutions, DPO as a Service**
  - Gives guidance on requests for a copy of personal data, and on breach reporting
  - Does not include the work itself, such as reporting a breach, updating policies or drafting contracts
- **DPO-Service, Professional Plan**
  - Includes help with security incidents and data breaches

What two DPO plans say about help with a data breach, from each firm's website.

Source: GRC Solutions: DPO as a Service, https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service (checked 2 October 2026); DPO-Service: pricing, https://dpo-service.co.uk/pricing/ (checked 2 October 2026)

## How much time does a monthly fee buy?

The time a monthly fee for an outsourced DPO buys depends on the plan, so check the hours. Athlex's lowest plan buys 2 hours a month and is aimed at small, low-risk businesses. Athlex counts help with a reply to the ICO against those hours, and sells extra hours ([Athlex](https://athlex.co.uk/outsourced-dpo/), checked 29 September 2026).

The ICO says you must give your DPO enough resources, including enough time, to meet the duties set by UK GDPR (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). A low fee with a small hour cap can cost more in a busy month.

**Compare what the fee buys before comparing the price**

| Ask about | Get this in writing |
| --- | --- |
| Time | Monthly hours and the rate for extra hours |
| Work | What is included, including help with a breach |
| Changes | The charge for work outside the agreed scope |
| Exit | Minimum term, notice period and handover arrangements |

Source: Athlex: Outsourced DPO, https://athlex.co.uk/outsourced-dpo/ (checked 2 October 2026); Bratby Law: Direct legal advice, https://bratby.law/how-we-work/direct-legal-advice/ (checked 29 September 2026); DPO-Service: Pricing, https://dpo-service.co.uk/pricing/ (checked 2 October 2026)

> "Our DPO is sufficiently well resourced to be able to perform their tasks."
> ICO, DPO guidance
> The ICO, a check it lists for organisations with a DPO, in its guidance on data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026)

## Which providers publish a price?

32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 publish a price ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). They publish it on their own website or on a UK government G-Cloud listing. The list of [providers that publish a price](/lists/providers-that-publish-a-price) shows them. A published price is a starting point, not a quote.

## Why do some firms quote instead of publishing a price?

Two firms that do not publish a price for an outsourced data protection officer (DPO) say the price depends on your organisation. The DPO Centre says it depends on how complex your data is and what your organisation needs ([The DPO Centre](https://www.dpocentre.com/services/outsourced-dpo-services/), checked 29 September 2026). GRC Solutions asks you to request a tailored quote ([GRC Solutions](https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service), checked 29 September 2026).

GRC Solutions publishes prices for its documentation toolkits, but shows no figure for its DPO service ([GRC Solutions](https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service) and [its toolkits page](https://uk.grcsolutions.io/category/documentation-toolkits), checked 29 September 2026). Because of those toolkit prices, GRC Solutions is on our list of [providers that publish a price](/lists/providers-that-publish-a-price).

## What should you get in writing?

Get the charges for DPO or data protection work, and what the fee covers, in writing. Bratby Law says its fees are usually fixed or capped, and agreed before work begins. It says it talks through any change of scope with you before it charges more ([Bratby Law](https://bratby.law/how-we-work/direct-legal-advice/), checked 29 September 2026).

**What to get in writing**

- Ask for the monthly hours and the rate for extra hours.
- Ask whether unused hours roll over.
- Ask whether the fee covers help with a data breach.
- Ask whether the fee covers requests for a copy of personal data, and letters from the regulator.
- For day rates, agree an estimate and a spending limit for each job.

## What if you want to switch provider later?

Before you switch DPO provider, check the minimum term and notice period. GRC Solutions sets a one-year minimum term for its DPO service, and the balance stays payable if you cancel in the first year. DPO-Service runs a rolling monthly contract with 30 days' notice and says there are no setup fees or exit charges ([GRC Solutions](https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service) and [DPO-Service](https://dpo-service.co.uk/pricing/), checked 29 September 2026).

Plan the handover before giving notice: ask the outgoing firm for your records, registers and a list of open work. See [what to check when you switch](/best/switching-provider).

## What to do

1. Check whether you need a DPO at all with [do you need a DPO?](/guides/do-you-need-a-dpo), and read [first appointment](/best/first-appointment) if it is your first.
2. If you ask for quotes, ask each firm to price the same scope and to say what the fee covers.
3. Confirm whether each price includes VAT and travel.
4. Check the minimum term and the notice period.

## Common questions

### Can an outside firm be your DPO?

Yes. UK GDPR says a DPO can work under a service contract, and the ICO says an outside DPO should have the same position, tasks and duties as one on your staff ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37) and the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026).

### Do you have to appoint a DPO?

Only in some cases. UK GDPR requires one for most public bodies, and where your core work involves, on a large scale, monitoring people regularly and systematically, or handling sensitive data or data about criminal convictions ([UK GDPR Article 37](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026).

### Do unused retainer hours roll over?

Not usually, at Athlex, the only firm in this guide that says. Unused hours there do not usually roll over from one month to the next ([Athlex](https://athlex.co.uk/outsourced-dpo/), checked 29 September 2026). Get each firm's answer in the contract.

## Where next

- [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md)
- [Switching provider](https://theassurancedesk.com/best/switching-provider.md)
- [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md)
- [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md)
- [Day rate or retainer: how do consultants charge?](https://theassurancedesk.com/guides/data-protection-consultant-day-rate-or-retainer.md)
- [How much does data protection software cost per year?](https://theassurancedesk.com/guides/how-much-does-data-protection-software-cost-per-year.md)

## Sources

- ICO: Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026)
- UK GDPR Article 33, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 2 October 2026)
- UK GDPR Article 37, legislation.gov.uk: https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 29 September 2026)
- GCA: G-Cloud 14 agreement: https://www.gca.gov.uk/agreements/RM1557.14 (checked 29 September 2026)
- Athlex: Outsourced DPO: https://athlex.co.uk/outsourced-dpo/ (checked 2 October 2026)
- Ametros Group: Prices: https://ametrosgroup.com/prices/ (checked 2 October 2026)
- Arcanum: G-Cloud 14 pricing document, version 5.0 (file dated 7 May 2024): https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92656/514226994123838-pricing-document-2024-05-07-1215.pdf (checked 29 September 2026)
- Kafico: ISO 27001: https://www.kafico.co.uk/iso27001 (checked 29 September 2026)
- GRC Solutions: DPO as a Service: https://uk.grcsolutions.io/product/data-protection-officer-dpo-as-a-service (checked 2 October 2026)
- GRC Solutions: Documentation toolkits: https://uk.grcsolutions.io/category/documentation-toolkits (checked 29 September 2026)
- DPO-Service: Pricing: https://dpo-service.co.uk/pricing/ (checked 2 October 2026)
- The DPO Centre: Outsourced DPO services: https://www.dpocentre.com/services/outsourced-dpo-services/ (checked 29 September 2026)
- Bratby Law: Direct legal advice: https://bratby.law/how-we-work/direct-legal-advice/ (checked 29 September 2026)
- The Assurance Desk provider data, read from each provider's own pages and public records between 16 July and 13 October 2026: https://theassurancedesk.com/advisers (checked 13 October 2026)
- Mishcon de Reya: Mishcon DPO: https://www.mishcon.com/products/mishcon-dpo (checked 2 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.