Law firm or consultancy for GDPR advice?

Part of the guide How do I choose a data protection or AI governance adviser?

What do you need the adviser to do?

Start with a short brief. Describe the problem, the work you need and who will use the result. Ask each firm to respond to that same brief.

When is a specialist lawyer useful?

A specialist legal adviser may be needed for the particular area of a problem. GOV.UK gives a solicitor as an example. For GDPR work, ask about their experience of the actual issue rather than relying on a general legal qualification.

Does the brief involve a dispute, an investigation or a difficult legal interpretation? Ask who will give the legal advice and handle any further proceedings. Confirm the country whose law they advise on and whether they can handle the work you may need.

Legal professional privilege can also matter. It protects certain communications between a legal professional and their client from disclosure. It is a specific legal protection, not simply another word for confidentiality.

Is everything sent to a lawyer privileged?

No. HMRC’s published explanation says legal advice privilege concerns confidential communications between a lawyer and their client for obtaining or giving legal advice. That does not turn every document in a lawyer’s inbox into privileged material.

Litigation privilege is a separate category. HMRC describes it as applying to documents produced for the dominant purpose of contemplated or actual litigation, and lawyers’ advice for that purpose. Privilege belongs to the client, who may waive it.

Before sharing sensitive material, ask the lawyer which protection may apply. Establish who the client is for that work and how communications should be handled. This brief description does not determine whether any particular document is protected.

Does your DPO have to be a solicitor?

No. The UK GDPR requires professional qualities, experience and expert knowledge of data protection law. It does not specify precise credentials. The person’s expertise should fit the processing and protection required.

An external DPO can be a person or an organisation working under a service contract. The DPO must be independent, have enough resources and report to the highest management level. Those requirements matter whichever type of firm supplies the service.

Ask whether you are buying the formal DPO role, support for your existing DPO, or a separate project. These are useful distinctions to settle in the brief before comparing fees.

How should you compare the proposals?

Ask each firm to name the person doing the work and give examples of their relevant experience. Then compare the scope, completion dates and your team’s share of the work.

Data protection trainer Tim Turner urges professionals to talk about their own experience rather than generalising about an entire sector. It is a useful prompt when assessing a proposal: ask what this person has actually done.

Can you use both?

TMC3’s public Privacy Consultant listing illustrates the practical work a consultancy may offer. It includes policies, impact assessments, supplier checks and breach support, with a named contact and agreed support levels.

If the proposed work needs different people, ask the firms to explain how they would work together. Set out who leads, who instructs whom, what information will be shared and when a second fee starts.

Keep someone inside the organisation responsible for the work too. Hiring help does not transfer the organisation’s responsibility to comply with the UK GDPR.

What to do

1. Write one brief describing the problem, the work required and the country involved.
2. Ask both types of firm for a named delivery team and the same set of deliverables.
3. Where legal protection matters, ask the lawyer to explain the scope of privilege before sharing material.
4. Compare scope, availability, insurance and total fees before agreeing the engagement.

Common questions

Is a law firm always more expensive than a consultancy?

This guide does not establish a general price ranking. Ask for written proposals covering the same work, including your own team’s time, ongoing support and any separately charged services.

Does a privacy qualification make someone a solicitor?

The UK GDPR’s DPO requirements concern professional qualities, experience and expert knowledge; they do not specify precise credentials. For legal advice, check the person’s separate professional status and expertise in the issue.

Can a consultancy supply our DPO?

An external DPO can be supplied by an individual or an organisation under a service contract. The appointment still needs suitable expertise, independence and resources.

Where next

• First DPO or AI policy
• Switching provider
• How do I choose a data protection or AI governance adviser?
• How do you check that a data protection consultant is qualified?
• Data protection consultants and indemnity insurance: who pays if advice is wrong?
• ICO has written to you: what to do in the first week
• How much does an outsourced DPO cost, and what does it cover?
• Day rate or retainer: how do consultants charge?
• Is your GDPR consultant recommending their own software?

This is an independent editorial guide, not legal advice.