# Law firm or consultancy for GDPR advice? Choose the people and work you need, with clear terms for legal advice, practical help and ongoing support. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md). **The short answer.** Start with the work you need. For a disputed legal issue, look for a legal adviser with specialist expertise. For practical data protection work, ask who will do it and what they will deliver. A consultancy’s services can include policies, supplier checks and support with breaches ([GOV.UK, Find legal advice and information: Overview](https://www.gov.uk/find-legal-advice) and [applytosupply.digitalmarketplace.service.gov.uk, Privacy Consultant, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/441487472778111), checked 7 October 2026). ## What do you need the adviser to do? Start with a short brief. Describe the problem, the work you need and who will use the result. Ask each firm to respond to that same brief. **Start with the work you need** - **A legal problem** - A disputed interpretation or investigation. - Ask for a legal adviser with expertise in the issue. - **Practical support** - Policies, supplier checks or impact assessments. - Ask for named deliverables and the people doing the work. - **An ongoing DPO** - Advice, monitoring and an independent point of contact. - Check the service contract, expertise and resources. These describe different tasks. A firm may offer more than one, so check the proposal rather than assuming from its name. Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026); GOV.UK, Find legal advice and information: Overview, https://www.gov.uk/find-legal-advice (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, Privacy Consultant, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/441487472778111 (checked 7 October 2026) ## When is a specialist lawyer useful? A specialist legal adviser may be needed for the particular area of a problem. GOV.UK gives a solicitor as an example. For GDPR work, ask about their experience of the actual issue rather than relying on a general legal qualification ([GOV.UK, Find legal advice and information: Overview](https://www.gov.uk/find-legal-advice), checked 7 October 2026). Does the brief involve a dispute, an investigation or a difficult legal interpretation? Ask who will give the legal advice and handle any further proceedings. Confirm the country whose law they advise on and whether they can handle the work you may need. Legal professional privilege can also matter. It protects certain communications between a legal professional and their client from disclosure. It is a specific legal protection, not simply another word for confidentiality ([GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244), checked 7 October 2026). ## Is everything sent to a lawyer privileged? No. HMRC’s published explanation says legal advice privilege concerns confidential communications between a lawyer and their client for obtaining or giving legal advice. That does not turn every document in a lawyer’s inbox into privileged material ([GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244), checked 7 October 2026). Litigation privilege is a separate category. HMRC describes it as applying to documents produced for the dominant purpose of contemplated or actual litigation, and lawyers’ advice for that purpose. Privilege belongs to the client, who may waive it ([GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244), checked 7 October 2026). Before sharing sensitive material, ask the lawyer which protection may apply. Establish who the client is for that work and how communications should be handled. This brief description does not determine whether any particular document is protected. **Privilege depends on the communication and its purpose** - **Legal advice privilege** - Confidential communications between lawyer and client. - For the purpose of obtaining or giving legal advice. - **Litigation privilege** - Documents for the dominant purpose of contemplated or actual litigation. - Lawyers’ advice for that purpose. Ask the lawyer which protection applies. Sending a document to a lawyer does not settle that question. Source: GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual, https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244 (checked 7 October 2026) ## Does your DPO have to be a solicitor? No. The UK GDPR requires professional qualities, experience and expert knowledge of data protection law. It does not specify precise credentials. The person’s expertise should fit the processing and protection required ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). An external DPO can be a person or an organisation working under a service contract. The DPO must be independent, have enough resources and report to the highest management level. Those requirements matter whichever type of firm supplies the service ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). Ask whether you are buying the formal DPO role, support for your existing DPO, or a separate project. These are useful distinctions to settle in the brief before comparing fees. ## How should you compare the proposals? Ask each firm to name the person doing the work and give examples of their relevant experience. Then compare the scope, completion dates and your team’s share of the work. Data protection trainer Tim Turner urges professionals to talk about their own experience rather than generalising about an entire sector. It is a useful prompt when assessing a proposal: ask what this person has actually done ([Tim Turner on LinkedIn](https://www.linkedin.com/posts/tim-turner-845541b3_i-have-a-simple-three-step-process-that-activity-7384558045177217024-rbzQ), checked 7 October 2026). **Match the brief to the work you need** | Your task | What to ask for | | --- | --- | | Resolve a disputed legal question | A legal adviser with specialist expertise in that issue. | | Put data protection processes into practice | Named deliverables, such as policies, supplier checks or impact assessments, and the person doing each task. | | Appoint an external DPO | A defined service contract, suitable expertise, independence and resources. | | Obtain confidential legal advice | An explanation from the lawyer of whether legal advice privilege applies to the proposed work. | | Arrange ongoing help | Named support, agreed availability and a clear boundary between included work and extra fees. | Source: ICO, Data protection officers, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026); GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual, https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244 (checked 7 October 2026); GOV.UK, Find legal advice and information: Overview, https://www.gov.uk/find-legal-advice (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, Privacy Consultant, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/441487472778111 (checked 7 October 2026) > "Try saying sensible things about your own actual experience." > Tim Turner, LinkedIn post excerpt > Tim Turner on LinkedIn, 👍 I have a simple three-step process that I advise all DP professionals to follow., https://www.linkedin.com/posts/tim-turner-845541b3_i-have-a-simple-three-step-process-that-activity-7384558045177217024-rbzQ (checked 7 October 2026) > [View LinkedIn post](https://www.linkedin.com/posts/tim-turner-845541b3_i-have-a-simple-three-step-process-that-activity-7384558045177217024-rbzQ) > ![Tim Turner, LinkedIn profile portrait](https://theassurancedesk.com/images/editorial/tim-turner-linkedin.jpeg) > Portrait source: https://www.linkedin.com/posts/tim-turner-845541b3_i-have-a-simple-three-step-process-that-activity-7384558045177217024-rbzQ ## Can you use both? TMC3’s public Privacy Consultant listing illustrates the practical work a consultancy may offer. It includes policies, impact assessments, supplier checks and breach support, with a named contact and agreed support levels ([applytosupply.digitalmarketplace.service.gov.uk, Privacy Consultant, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/441487472778111), checked 7 October 2026). If the proposed work needs different people, ask the firms to explain how they would work together. Set out who leads, who instructs whom, what information will be shared and when a second fee starts. Keep someone inside the organisation responsible for the work too. Hiring help does not transfer the organisation’s responsibility to comply with the UK GDPR ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). ## What to do 1. Write one brief describing the problem, the work required and the country involved. 2. Ask both types of firm for a named delivery team and the same set of deliverables. 3. Where legal protection matters, ask the lawyer to explain the scope of privilege before sharing material ([GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual](https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244), checked 7 October 2026). 4. Compare scope, availability, insurance and total fees before agreeing the engagement. ## Common questions ### Is a law firm always more expensive than a consultancy? This guide does not establish a general price ranking. Ask for written proposals covering the same work, including your own team’s time, ongoing support and any separately charged services. ### Does a privacy qualification make someone a solicitor? The UK GDPR’s DPO requirements concern professional qualities, experience and expert knowledge; they do not specify precise credentials. For legal advice, check the person’s separate professional status and expertise in the issue ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/) and [GOV.UK, Find legal advice and information: Overview](https://www.gov.uk/find-legal-advice), checked 7 October 2026). ### Can a consultancy supply our DPO? An external DPO can be supplied by an individual or an organisation under a service contract. The appointment still needs suitable expertise, independence and resources ([ICO, Data protection officers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/), checked 7 October 2026). ## Where next - [First DPO or AI policy](https://theassurancedesk.com/best/first-appointment.md) - [Switching provider](https://theassurancedesk.com/best/switching-provider.md) - [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md) - [How do you check that a data protection consultant is qualified?](https://theassurancedesk.com/guides/check-a-data-protection-consultant-is-qualified.md) - [Data protection consultants and indemnity insurance: who pays if advice is wrong?](https://theassurancedesk.com/guides/data-protection-consultants-indemnity-insurance.md) - [ICO has written to you: what to do in the first week](https://theassurancedesk.com/guides/ico-has-written-to-you.md) - [How much does an outsourced DPO cost, and what does it cover?](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) - [Day rate or retainer: how do consultants charge?](https://theassurancedesk.com/guides/data-protection-consultant-day-rate-or-retainer.md) - [Is your GDPR consultant recommending their own software?](https://theassurancedesk.com/guides/is-your-gdpr-consultant-recommending-their-own-software.md) ## Sources - GOV.UK, Find legal advice and information: Overview: https://www.gov.uk/find-legal-advice (checked 7 October 2026) - applytosupply.digitalmarketplace.service.gov.uk, Privacy Consultant, Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/441487472778111 (checked 7 October 2026) - ICO, Data protection officers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/data-protection-officers/ (checked 7 October 2026) - GOV.UK, CH22244, Information & Inspection Powers: conditions and safeguards: restrictions: legal professional privilege: what is legal professional privilege, HMRC internal manual: https://www.gov.uk/hmrc-internal-manuals/compliance-handbook/ch22244 (checked 7 October 2026) - Tim Turner on LinkedIn: https://www.linkedin.com/posts/tim-turner-845541b3_i-have-a-simple-three-step-process-that-activity-7384558045177217024-rbzQ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.