# Is your GDPR consultant recommending their own software? Ask who owns the product, how the adviser is paid and what happens if you choose a different tool. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md). **The short answer.** Ask the consultant to state in writing whether they own the recommended software, resell it or receive payment for introducing customers. Then ask whether you can buy the advice without the software. Compare that answer with the proposal, licence terms and published product information. ## Where can you find the relationship? Check the product page, proposal and licence. Match the name of the software owner with the firm selling it and the organisation providing support. The example below shows a clear reseller disclosure. TMC3’s public listing identifies the supplier as a reseller providing extra support and names OneTrust. That explains the relationship; it does not judge the advice ([applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782), checked 7 October 2026). **What a published reseller relationship looks like** ![The listing says the supplier is a reseller providing extra support and names OneTrust as the organisation whose services are resold.](https://theassurancedesk.com/images/editorial/tmc3-reseller-disclosure.png) Read both rows together. Supplier type describes the seller’s role. The next row names the company whose service is being resold, here OneTrust. Ask for the same clarity in your proposal. GOV.UK Digital Marketplace, supplier submission, cropped under the Open Government Licence. Captured 7 October 2026. Source: applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782 (checked 7 October 2026) ## Does selling software make the advice unsuitable? The relationship is something to understand and assess. Ask why the proposed product fits your needs and what other options the adviser considered. Check whether their fee changes if you choose another tool. Owning a product is different from reselling one. The Desk’s July review recorded that AvISO paired its advice with its own ISOvA software. Check the current proposal rather than assuming the relationship has stayed the same ([The Assurance Desk, AvISO Consultancy profile](https://theassurancedesk.com/advisers/aviso-consultancy), checked 7 October 2026). For example, ask what the proposal would look like using your existing systems. The ICO provides templates for processing records and says those records must be written and kept current. Use that as a starting point for discussing the work, rather than assuming a particular product is the only way to keep records ([ICO, Documentation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/documentation/), checked 7 October 2026). Keep the comparison specific. Ask for a demonstration using one of your tasks and a written account of what your team will still need to do. **Ask about the product, the sale and the payment** - **Who owns it?** - Name the product owner. - Ask whether it is the consultant’s own software. - **Who sells it?** - Name the firm issuing the licence and invoice. - Ask whether it acts as a reseller. - **Who earns from it?** - Ask about referral payments and other incentives. - Ask whether the advice fee changes if you choose another tool. These are questions for the proposal. A commercial relationship alone is not a verdict on the quality of the advice. Source: applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782 (checked 7 October 2026); The Assurance Desk, AvISO Consultancy profile, https://theassurancedesk.com/advisers/aviso-consultancy (checked 7 October 2026) ## Are you buying advice, software or both? Ask the proposal to name the service as well as the product. Who reviews your decisions? Who checks the documents? Who handles a difficult request? Who answers when the software does not work? Have those responsibilities stated separately. The OneTrust listing describes a statement of work covering implementation responsibilities, milestones and client expectations. Request that level of detail for the work you are buying, alongside the licence terms ([applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782), checked 7 October 2026). Keep a named owner inside your organisation. Your organisation remains responsible for complying with the UK GDPR, even when outside firms help ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). **What to request before agreeing to the software** | Request | Question it should answer | | --- | --- | | A written product relationship statement | Does the adviser own the product, resell it or receive a referral payment? | | A proposal separating advice and software | What does each part cost, and can you buy the advice alone? | | A named plan for the work | Who sets up the system, supplies the information and keeps it current? | | A comparison with alternatives | Why does this tool fit the work better than the other options considered? | | Licence and exit terms | Who controls the account, what can you export and what can you keep using? | Source: applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782 (checked 7 October 2026); ICO, Documentation, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/documentation/ (checked 7 October 2026); The Assurance Desk, AvISO Consultancy profile, https://theassurancedesk.com/advisers/aviso-consultancy (checked 7 October 2026) **Separate the jobs before agreeing the package** - **Your organisation**: Keeps responsibility for complying with UK GDPR. - **The adviser**: Ask who reviews decisions, checks documents and gives specialist help. - **The software supplier**: Ask who sets up the service, supports it and provides the exit handover. Have the proposal name who does each job and what each part costs. Source: applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782 (checked 7 October 2026); ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026) ## What if the consultant is also your DPO? Check the DPO arrangement separately. The ICO says a DPO must be independent and cannot hold a position that determines the purposes and means of processing personal data. In plain terms, that concerns decisions about why and how personal data is used ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). Do not use a product relationship alone to decide that legal question. Ask who chooses the processing and who monitors it. Check how the DPO’s independence is protected and whether any other duties conflict with the role ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). The same conversation should cover the DPO’s resources and access to the highest management level. A statement about software ownership does not answer those requirements ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). ## Can you keep your records if you leave? Ask for a sample export before signing. Confirm which records, attachments, histories and documents it includes, who can download them and what help is available. Check the rights to continue using templates and documents separately from access to the software. Where the supplier processes personal data on your behalf, the processing contract has its own requirements. The ICO says it must require the processor to follow your documented instructions unless UK law requires otherwise ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026). When the service ends, the contract must provide for return or deletion of personal data at your choice. It must also provide for deletion of existing copies unless UK law requires retention. Those personal data requirements do not answer every commercial question about software access or rights to use a document ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026). As an example of a published exit provision, the OneTrust listing says a copy of customer data is provided on termination. Ask what your own supplier’s promise covers and how the handover would work ([applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782), checked 7 October 2026). > "In the event of contract termination, a copy of customer data is provided to the customer" > TMC3, OneTrust service listing > applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782 (checked 7 October 2026) ## What to do 1. Ask for the consultant’s ownership, reseller or referral relationship in writing. 2. Request separate prices and scopes for advice, software and setup. 3. Ask why the proposed tool fits your work and what alternatives were considered. 4. Check any DPO appointment against the ICO’s independence requirements ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). 5. See a sample export and agree the access, handover and document rights before signing. ## Common questions ### How can I tell whether a GDPR consultant owns the software? Ask for the legal name of the product owner and compare it with the licence, proposal and published product page. Request a clear statement of any ownership, reseller or referral relationship. ### Can a law firm also supply compliance software? The Assurance Desk checked Lawcadia’s website on 19 September 2026. It recorded that Fieldfisher offered Data Compliance Manager modules powered by Lawcadia’s platform alongside advisory work. Check the current proposal to see which firm provides each part ([The Assurance Desk, Fieldfisher LLP profile](https://theassurancedesk.com/advisers/fieldfisher-llp-uk), checked 7 October 2026). ### Should I reject a consultant who recommends a product they sell? Assess the proposed work and the disclosed relationship. Ask whether the advice can be bought separately and why the tool fits your needs. Check how the adviser is paid and what happens if you choose another option. ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Switching provider](https://theassurancedesk.com/best/switching-provider.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [Do you need AI governance software, or is an adviser enough?](https://theassurancedesk.com/guides/ai-governance-software-or-adviser.md) - [Article 28: what must a processor contract say?](https://theassurancedesk.com/guides/article-28-processor-contract.md) - [Law firm or consultancy for GDPR advice?](https://theassurancedesk.com/guides/law-firm-or-consultancy-for-gdpr-advice.md) ## Sources - applytosupply.digitalmarketplace.service.gov.uk, UK GDPR Compliance Platform, Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/183946961703782 (checked 7 October 2026) - The Assurance Desk, AvISO Consultancy profile: https://theassurancedesk.com/advisers/aviso-consultancy (checked 7 October 2026) - ICO, Documentation: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/documentation/ (checked 7 October 2026) - ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026) - ICO, What needs to be included in the contract?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/ (checked 7 October 2026) - The Assurance Desk, Fieldfisher LLP profile: https://theassurancedesk.com/advisers/fieldfisher-llp-uk (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.