# How do I choose a data protection or AI governance adviser? Your organisation stays responsible for complying with UK GDPR whoever you hire, so it helps to know exactly what an adviser will do. The Assurance Desk. Published 29 September 2026. Last checked 13 October 2026. **The short answer.** Ask each firm the same six questions. Who will do the work, and can you check their credentials? What does the fee cover? Does the firm also sell software? Has the firm done work in your sector? What indemnity cover does it hold? What is its own AI policy? Written answers let you compare firms on the same terms. ## In this series - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md) - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md) - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md) - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md) ## Who will do the work, and can I check them? Ask a data protection adviser to name the people who will do your work. You can check each credential with the body that issued it. 102 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 name their credentials ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). **Where to check a credential** - **IAPP** - A not-for-profit association for people who work in privacy and AI governance - Issues privacy and AI governance certifications - Confirms whether a person holds one if you give its customer support team the certificate number - **Solicitors Regulation Authority** - Regulates solicitors and law firms in England and Wales - Its register shows whether someone is a solicitor and whether it regulates a firm - **UKAS CertCheck** - A free online service from UKAS, the UK's national accreditation body - Checks certificates for standards such as ISO/IEC 27001, issued by certification bodies that UKAS accredits A privacy or AI governance certification, a solicitor, or an ISO certificate. Source: IAPP, about, https://iapp.org/about/ (checked 29 September 2026); IAPP, certification FAQs, https://iapp.org/certify/faqs (checked 29 September 2026); SRA, how we work, https://www.sra.org.uk/sra/how-we-work/ (checked 29 September 2026); SRA, the Solicitors Register, https://www.sra.org.uk/consumers/register/ (checked 29 September 2026); UKAS, about us, https://www.ukas.com/about-us/ (checked 29 September 2026); UKAS, UKAS launches CertCheck (16 June 2022), https://www.ukas.com/resources/latest-news/ukas-launches-certcheck/ (checked 29 September 2026) ## What does the fee cover? What a data protection adviser's fee covers depends on the firm, so ask for the scope in writing. Ask whether it covers help with a data breach, including the first 72 hours after you find one, or whether a day rate applies. Under UK GDPR, the controller, usually your organisation, must report a personal data breach to the UK regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. You need not report a breach that is unlikely to put people at risk ([UK GDPR, Article 33](https://www.legislation.gov.uk/eur/2016/679/article/33), checked 29 September 2026). 32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 publish a price ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). See [who publishes a price](/lists/providers-that-publish-a-price) and [how these services are priced](/guides/how-dpo-and-data-protection-services-are-priced). ## Does the firm also sell software? Some data protection advisers also sell software. Ask whether the firm earns money from any tool it recommends. A software firm can give good advice too, but if it is also your data protection officer, ask how it keeps its sales apart from that role. The ICO says the officer's other work must not conflict with the officer's main tasks (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). **Questions when an adviser also sells software** | Ask | What you want to understand | | --- | --- | | Do you earn from this tool? | Any income from a product the adviser recommends | | Who makes the recommendation? | How the advice and the sales role are kept apart | | Will you also be our DPO? | How the firm checks and manages possible conflicts | Source: ICO, data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026) ## Can they show work in my sector? Ask a data protection adviser for a named person with work in your sector, and a written example. A list of sectors shows where a firm works, and an example shows how. If your sector has its own regulator, ask how the firm handles those rules alongside UK GDPR, and see [regulated sectors](/best/sector-regulated). ## Who carries the risk if the advice is wrong? Your organisation stays responsible for compliance, whoever advises you. UK GDPR makes the controller responsible for following the data protection principles and for being able to show that it does. The controller is the organisation that, alone or with others, decides why and how personal data is processed (UK GDPR, [Article 5](https://www.legislation.gov.uk/eur/2016/679/article/5) and [Article 4](https://www.legislation.gov.uk/eur/2016/679/article/4), checked 29 September 2026). Ask whether the firm holds professional indemnity insurance, how much, and what the policy covers. 19 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 say on their own pages whether they hold indemnity cover ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). [Who pays if advice is wrong, and what indemnity insurance does](/guides/data-protection-consultants-indemnity-insurance) explains the fine, compensation and the contract. [How to check that a consultant is qualified](/guides/check-a-data-protection-consultant-is-qualified) explains what the law asks and which certificates exist. > "As the controller or processor it remains your responsibility to comply with the UK GDPR." > ICO, DPO guidance > The ICO, guidance on data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026) ## Can they show me their own AI policy? Ask a data protection adviser for its AI policy, and which AI tools it uses on client work. 32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 say how they use AI themselves ([The Assurance Desk provider data](https://theassurancedesk.com/advisers), checked 13 October 2026). See [what goes in an AI policy](/guides/the-ai-governance-gap). Ask for a list of every processor it uses, including AI services. Under UK GDPR, a processor, a firm that handles personal data for you, must get your written permission before it brings in another ([UK GDPR, Article 28](https://www.legislation.gov.uk/eur/2016/679/article/28), checked 29 September 2026). ## What does a clear proposal include? A clear proposal from a data protection adviser states the price and puts six things in writing: the people and their credentials, the scope of the fee, any income from tools it recommends, an example in your sector, its indemnity cover and its AI policy. Check any dates against the current rules. Since 27 July 2026, the EU AI Omnibus has moved the EU AI Act rules for high-risk AI in listed areas, such as employment and education, to 2 December 2027. Older material may give an earlier date (the European Commission's [AI Omnibus notice](https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force) and [AI Act page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai), checked 29 September 2026). **Six things to see in writing** - The people, and their credentials. - What the fee covers, including help with a data breach. - Any income from tools it recommends. - An example of work in your sector. - The indemnity cover. - The firm's own AI policy. ## Should I use a law firm or a consultancy? For a court case in England and Wales, you will usually need a lawyer who is authorised to conduct litigation. Only an authorised or exempt person may do that work ([Legal Services Act 2007, section 12](https://www.legislation.gov.uk/ukpga/2007/29/section/12) and [section 13](https://www.legislation.gov.uk/ukpga/2007/29/section/13), checked 29 September 2026). For regulator enforcement or a dispute, ask whether you need legal professional privilege. For day-to-day compliance, a consultancy may be enough, and some matters need both. Ask a consultancy what happens to privilege if you later need a lawyer. In England and Wales, privilege lets you refuse to hand over certain documents, such as confidential messages between a client and a lawyer made mainly to give or get legal advice (the [SRA](https://www.sra.org.uk/solicitors/guidance/professional-privilege-in-house/), checked 29 September 2026). Check whether the SRA regulates the firm, because its indemnity insurance rules and its Compensation Fund cover only the firms it regulates (the SRA on [unregulated businesses](https://www.sra.org.uk/solicitors/guidance/unregulated-organisations-giving-information-clients/) and its [Compensation Fund](https://www.sra.org.uk/consumers/compensation-fund/) and [who can apply](https://www.sra.org.uk/consumers/compensation-fund/claims-process/), checked 29 September 2026). **What SRA regulation covers** | Question | SRA-regulated firm | Not regulated by the SRA | | --- | --- | --- | | Must carry indemnity insurance under SRA rules? | Yes | No | | Client can apply to the SRA Compensation Fund? | Only if the firm owes you money and your business has annual turnover or assets under £2 million | No | ## What to do 1. Ask who will do your work, and check each person's credentials with the body that issued them. 2. Get the scope and the price in writing, including whether the fee covers help in the first 72 hours after you find a breach. 3. Ask whether the firm earns money from any software it recommends. 4. Ask for the firm's indemnity cover and its own AI policy. 5. Put each firm's written answers side by side, so you compare the same things. ## Common questions ### Can an outside firm be our data protection officer? Yes. Read [whether you need a DPO](/guides/do-you-need-a-dpo) first, then see [what to check before a first appointment](/best/first-appointment). The ICO says you can contract out the role to an individual or an organisation on a service contract (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 29 September 2026). ### Does an ISO/IEC 27001 certificate mean a firm gives good privacy advice? No. It shows how a firm runs its own security, not how well it advises you. For a certificate of your own, see [getting certified](/best/certification-seeking). ISO/IEC 27001 is a standard for information security management ([UKAS](https://www.ukas.com/accreditation/sectors/digital/info-sec/), checked 29 September 2026). ### Can I put these questions to my current adviser? Yes. Send the same six questions to the firm you use now, and ask for the answers in writing. If you are thinking of a change, see [what to check when you switch](/best/switching-provider). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Seeking ISO 42001 certification](https://theassurancedesk.com/best/certification-seeking.md) - [Switching provider](https://theassurancedesk.com/best/switching-provider.md) - [Regulated sectors](https://theassurancedesk.com/best/sector-regulated.md) - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) - [How do you find an outsourced DPO in the UK?](https://theassurancedesk.com/guides/how-to-find-an-outsourced-dpo.md) - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md) - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md) ## Sources - IAPP, certification FAQs: https://iapp.org/certify/faqs (checked 29 September 2026) - SRA, how we work: https://www.sra.org.uk/sra/how-we-work/ (checked 29 September 2026) - SRA, the Solicitors Register: https://www.sra.org.uk/consumers/register/ (checked 29 September 2026) - UKAS, UKAS launches CertCheck (16 June 2022): https://www.ukas.com/resources/latest-news/ukas-launches-certcheck/ (checked 29 September 2026) - UK GDPR, Article 33: https://www.legislation.gov.uk/eur/2016/679/article/33 (checked 29 September 2026) - ICO, data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 29 September 2026) - UK GDPR, Article 5: https://www.legislation.gov.uk/eur/2016/679/article/5 (checked 29 September 2026) - UK GDPR, Article 4: https://www.legislation.gov.uk/eur/2016/679/article/4 (checked 29 September 2026) - UK GDPR, Article 28: https://www.legislation.gov.uk/eur/2016/679/article/28 (checked 29 September 2026) - European Commission, AI Omnibus enters into force: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force (checked 29 September 2026) - Legal Services Act 2007 (England and Wales), section 12: https://www.legislation.gov.uk/ukpga/2007/29/section/12 (checked 29 September 2026) - SRA, legal professional privilege: https://www.sra.org.uk/solicitors/guidance/professional-privilege-in-house/ (checked 29 September 2026) - SRA, unregulated businesses: information for clients: https://www.sra.org.uk/solicitors/guidance/unregulated-organisations-giving-information-clients/ (checked 29 September 2026) - SRA, Compensation Fund: https://www.sra.org.uk/consumers/compensation-fund/ (checked 29 September 2026) - UKAS, information security accreditation: https://www.ukas.com/accreditation/sectors/digital/info-sec/ (checked 29 September 2026) - Legal Services Act 2007 (England and Wales), section 13: https://www.legislation.gov.uk/ukpga/2007/29/section/13 (checked 29 September 2026) - SRA, Compensation Fund: who can apply: https://www.sra.org.uk/consumers/compensation-fund/claims-process/ (checked 29 September 2026) - IAPP, about: https://iapp.org/about/ (checked 29 September 2026) - UKAS, about us: https://www.ukas.com/about-us/ (checked 29 September 2026) - European Commission, the EU AI Act: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai (checked 29 September 2026) - The Assurance Desk provider data, read from each provider's own pages and public records between 16 July and 13 October 2026: https://theassurancedesk.com/advisers (checked 13 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.