The Assurance Desk
Part of the guide How much does an outsourced DPO cost, and what does it cover?
What do published software prices tell you?
The examples below come from supplier listings under G-Cloud 14, a government purchasing framework. Treat them as examples of how prices are stated. Ask the supplier for a current written quote covering your organisation and the features you need.
A per licence charge needs a licence count before it becomes an annual budget. An instance price needs a definition of what the instance includes. Ask what increases the bill and whether VAT is included.
| Software listing | Published price | What else to check |
|---|---|---|
| Get Swarms, Privacy Management platform | £5 a licence a month | Licence count and annual terms. Email or ticket support and onsite training are listed as extra costs. |
| TMC3, OneTrust UK GDPR Compliance Platform | £18,090 to £48,222 an instance a year | Which modules and implementation work are included. Onsite support is listed as an extra cost. |
Read the price and its charging unit together
The listing states £18,090 to £48,222 an instance a year. An instance is the unit being charged for. Ask what that instance includes before comparing it with a price per licence.
GOV.UK Digital Marketplace, supplier submission, cropped under the Open Government Licence. Captured 7 October 2026. View full size
What work do you need the software to cover?
Start with the work you need to do. TMC3’s OneTrust listing covers privacy risk checks, policies, data mapping and records of processing. Check which of those features your quote includes.
Bring examples from your organisation to the demonstration. Ask the supplier to show how you would keep a processing record current, assign work to a colleague and find the result later. Include the people who will use it.
Write down any work the package leaves with your team or another adviser. Ask separately about requests from individuals, incident support, training and reviews of the documents you produce. A feature name is a starting point for that conversation.
What belongs in the annual budget?
Ask for a total for the first year and a separate total for renewal. Use the checklist below to make the scope clear. An empty line needs an answer, even if the answer is that the item is included.
Support and training are worth separating. Get Swarms’ listing prices email or ticket support and onsite training separately. TMC3’s OneTrust listing also identifies an extra charge for onsite support.
| Budget item | Question for the supplier |
|---|---|
| Software subscription | What package, licence count, modules and usage limits does the annual total cover? |
| Setup and moving existing records | Who prepares the records, sets up the service and checks that the information arrived correctly? |
| Connections to other systems | Which connections are included, and who will maintain them? |
| Training and support | What help is included, at what times, and what is charged separately? |
| Data protection advice | Does the fee include advice or a data protection officer (DPO) service, and who provides it? |
| Renewal and leaving | What changes at renewal, and what would it cost to export records and finish the contract? |
Build the budget beyond the subscription
- Licence Package, usage limits and charging unit.plus
- Setup Moving records and configuring the service.plus
- People and support Training, advice and help when needed.then check
- Renewal and exit Future fees and the handover of your records.
Can you start with templates instead?
The ICO provides basic templates for recording how personal data is used. The records must be written, kept up to date and reflect what your organisation does. The ICO says most organisations will benefit from keeping them electronically.
That gives you a useful starting question: can your team maintain the required records with the tools it already has? Compare that workload with the software demonstration. Templates are a way to document work, not an answer to every data protection task.
Buying software does not transfer your organisation’s responsibility to comply with the UK GDPR. Budget for the people who will check the information, make decisions and keep the work current.
We have developed basic templates to help you document your processing activities.
What should you settle before signing?
Ask for a written description of the setup work and the ongoing service. The OneTrust listing describes a statement of work setting out responsibilities, milestones and client expectations. That is useful detail to request in your own proposal.
Check how you would leave. The same listing says its end of contract process has no additional cost and that the customer receives a copy of its data. Do not assume another quote has the same terms.
Ask to see a sample export and confirm what it contains. Settle the format, access after cancellation, help with the move and the rights to keep using your documents. Then compare the full annual totals for the packages that can do the job.
What to do
- List the data protection work you need the software to support.
- Ask for a written annual total with the charging unit, features, limits and VAT position clearly stated.
- Separate setup, training, advice and support from the licence price.
- Ask for renewal and exit terms, then compare proposals covering the same work.
Common questions
Is the published software price the whole annual cost?
Check the scope. The listings reviewed here identify extra costs for some support and training. The advertised software charge should not be treated as an all inclusive budget.
Does the licence include a DPO?
Ask explicitly whether the proposal includes a DPO appointment, advice on request, technical support or just access to the software. Have the supplier name who does the work and put the included service in writing.
Are these prices a typical UK market range?
No. They are selected published examples with different charging units and scopes. Use them to understand the questions to ask, then obtain current quotes for comparable packages.
Where next
Sources
- applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace, checked 8 October 2026
- applytosupply.digitalmarketplace.service.gov.uk, Privacy Management platform, Digital Marketplace, checked 8 October 2026
- ICO, Documentation, checked 8 October 2026
- ICO, Data protection officers, checked 8 October 2026
This is an independent editorial guide, not legal advice.