Is your GDPR consultant recommending their own software?

Part of the guide How do I choose a data protection or AI governance adviser?

Where can you find the relationship?

Check the product page, proposal and licence. Match the name of the software owner with the firm selling it and the organisation providing support.

The example below shows a clear reseller disclosure. TMC3’s public listing identifies the supplier as a reseller providing extra support and names OneTrust. That explains the relationship; it does not judge the advice.

What a published reseller relationship looks like

Does selling software make the advice unsuitable?

The relationship is something to understand and assess. Ask why the proposed product fits your needs and what other options the adviser considered. Check whether their fee changes if you choose another tool.

Owning a product is different from reselling one. The Desk’s July review recorded that AvISO paired its advice with its own ISOvA software. Check the current proposal rather than assuming the relationship has stayed the same.

For example, ask what the proposal would look like using your existing systems. The ICO provides templates for processing records and says those records must be written and kept current. Use that as a starting point for discussing the work, rather than assuming a particular product is the only way to keep records.

Keep the comparison specific. Ask for a demonstration using one of your tasks and a written account of what your team will still need to do.

Are you buying advice, software or both?

Ask the proposal to name the service as well as the product. Who reviews your decisions? Who checks the documents? Who handles a difficult request? Who answers when the software does not work? Have those responsibilities stated separately.

The OneTrust listing describes a statement of work covering implementation responsibilities, milestones and client expectations. Request that level of detail for the work you are buying, alongside the licence terms.

Keep a named owner inside your organisation. Your organisation remains responsible for complying with the UK GDPR, even when outside firms help.

What if the consultant is also your DPO?

Check the DPO arrangement separately. The ICO says a DPO must be independent and cannot hold a position that determines the purposes and means of processing personal data. In plain terms, that concerns decisions about why and how personal data is used.

Do not use a product relationship alone to decide that legal question. Ask who chooses the processing and who monitors it. Check how the DPO’s independence is protected and whether any other duties conflict with the role.

The same conversation should cover the DPO’s resources and access to the highest management level. A statement about software ownership does not answer those requirements.

Can you keep your records if you leave?

Ask for a sample export before signing. Confirm which records, attachments, histories and documents it includes, who can download them and what help is available. Check the rights to continue using templates and documents separately from access to the software.

Where the supplier processes personal data on your behalf, the processing contract has its own requirements. The ICO says it must require the processor to follow your documented instructions unless UK law requires otherwise.

When the service ends, the contract must provide for return or deletion of personal data at your choice. It must also provide for deletion of existing copies unless UK law requires retention. Those personal data requirements do not answer every commercial question about software access or rights to use a document.

As an example of a published exit provision, the OneTrust listing says a copy of customer data is provided on termination. Ask what your own supplier’s promise covers and how the handover would work.

What to do

1. Ask for the consultant’s ownership, reseller or referral relationship in writing.
2. Request separate prices and scopes for advice, software and setup.
3. Ask why the proposed tool fits your work and what alternatives were considered.
4. Check any DPO appointment against the ICO’s independence requirements.
5. See a sample export and agree the access, handover and document rights before signing.

Common questions

How can I tell whether a GDPR consultant owns the software?

Ask for the legal name of the product owner and compare it with the licence, proposal and published product page. Request a clear statement of any ownership, reseller or referral relationship.

Can a law firm also supply compliance software?

The Assurance Desk checked Lawcadia’s website on 19 September 2026. It recorded that Fieldfisher offered Data Compliance Manager modules powered by Lawcadia’s platform alongside advisory work. Check the current proposal to see which firm provides each part.

Should I reject a consultant who recommends a product they sell?

Assess the proposed work and the disclosed relationship. Ask whether the advice can be bought separately and why the tool fits your needs. Check how the adviser is paid and what happens if you choose another option.

Where next

• First DPO or AI policy
• Switching provider
• How do I choose a data protection or AI governance adviser?
• How much does an outsourced DPO cost, and what does it cover?
• Do you need a data protection officer? UK GDPR sets three tests
• Do you need AI governance software, or is an adviser enough?
• Article 28: what must a processor contract say?
• Law firm or consultancy for GDPR advice?

This is an independent editorial guide, not legal advice.