How do I choose a data protection or AI governance adviser?

Who will do the work, and can I check them?

Ask a data protection adviser to name the people who will do your work. You can check each credential with the body that issued it. 102 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 name their credentials.

What does the fee cover?

What a data protection adviser's fee covers depends on the firm, so ask for the scope in writing. Ask whether it covers help with a data breach, including the first 72 hours after you find one, or whether a day rate applies.

Under UK GDPR, the controller, usually your organisation, must report a personal data breach to the UK regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. You need not report a breach that is unlikely to put people at risk.

32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 publish a price. See who publishes a price and how these services are priced.

Does the firm also sell software?

Some data protection advisers also sell software. Ask whether the firm earns money from any tool it recommends. A software firm can give good advice too, but if it is also your data protection officer, ask how it keeps its sales apart from that role.

The ICO says the officer's other work must not conflict with the officer's main tasks.

Can they show work in my sector?

Ask a data protection adviser for a named person with work in your sector, and a written example. A list of sectors shows where a firm works, and an example shows how. If your sector has its own regulator, ask how the firm handles those rules alongside UK GDPR, and see regulated sectors.

Who carries the risk if the advice is wrong?

Your organisation stays responsible for compliance, whoever advises you. UK GDPR makes the controller responsible for following the data protection principles and for being able to show that it does. The controller is the organisation that, alone or with others, decides why and how personal data is processed.

Ask whether the firm holds professional indemnity insurance, how much, and what the policy covers. 19 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 say on their own pages whether they hold indemnity cover.

Who pays if advice is wrong, and what indemnity insurance does explains the fine, compensation and the contract.

How to check that a consultant is qualified explains what the law asks and which certificates exist.

Can they show me their own AI policy?

Ask a data protection adviser for its AI policy, and which AI tools it uses on client work. 32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 say how they use AI themselves. See what goes in an AI policy.

Ask for a list of every processor it uses, including AI services. Under UK GDPR, a processor, a firm that handles personal data for you, must get your written permission before it brings in another.

What does a clear proposal include?

A clear proposal from a data protection adviser states the price and puts six things in writing: the people and their credentials, the scope of the fee, any income from tools it recommends, an example in your sector, its indemnity cover and its AI policy.

Check any dates against the current rules. Since 27 July 2026, the EU AI Omnibus has moved the EU AI Act rules for high-risk AI in listed areas, such as employment and education, to 2 December 2027. Older material may give an earlier date.

Should I use a law firm or a consultancy?

For a court case in England and Wales, you will usually need a lawyer who is authorised to conduct litigation. Only an authorised or exempt person may do that work. For regulator enforcement or a dispute, ask whether you need legal professional privilege. For day-to-day compliance, a consultancy may be enough, and some matters need both.

Ask a consultancy what happens to privilege if you later need a lawyer. In England and Wales, privilege lets you refuse to hand over certain documents, such as confidential messages between a client and a lawyer made mainly to give or get legal advice.

Check whether the SRA regulates the firm, because its indemnity insurance rules and its Compensation Fund cover only the firms it regulates.

What to do

1. Ask who will do your work, and check each person's credentials with the body that issued them.
2. Get the scope and the price in writing, including whether the fee covers help in the first 72 hours after you find a breach.
3. Ask whether the firm earns money from any software it recommends.
4. Ask for the firm's indemnity cover and its own AI policy.
5. Put each firm's written answers side by side, so you compare the same things.

Common questions

Can an outside firm be our data protection officer?

Yes. Read whether you need a DPO first, then see what to check before a first appointment. The ICO says you can contract out the role to an individual or an organisation on a service contract.

Does an ISO/IEC 27001 certificate mean a firm gives good privacy advice?

No. It shows how a firm runs its own security, not how well it advises you. For a certificate of your own, see getting certified. ISO/IEC 27001 is a standard for information security management.

Can I put these questions to my current adviser?

Yes. Send the same six questions to the firm you use now, and ask for the answers in writing. If you are thinking of a change, see what to check when you switch.

Where next

• First DPO or AI policy
• Seeking ISO 42001 certification
• Switching provider
• Regulated sectors
• After a breach or ICO contact
• Do you need a data protection officer? UK GDPR sets three tests
• How much does an outsourced DPO cost, and what does it cover?
• How do you find an outsourced DPO in the UK?
• Is your GDPR consultant recommending their own software?
• Law firm or consultancy for GDPR advice?

This is an independent editorial guide, not legal advice.