Outsourced DPO services: what does the monthly fee buy?

DPO prices: start with the work you need

Before asking for quotes, write down what you need help with. Do you want someone to review your work, or to carry out agreed tasks? Use that same list with each provider.

We checked the published offers of 25 providers from the Desk directory. Just two showed a DPO-specific numerical price in the pages we read. Three set out an ongoing support allowance. We read the provider pages on 17 October 2026.

That gives you a useful starting point: ask for the scope alongside the fee. Ametros, for example, publishes a price band covering several outsourced roles. We recorded it separately from DPO-specific prices, rather than treating it as an equivalent quote.

The chart counts information in our checked pages. A detail missing there may still appear in a proposal or contract. It does not tell you whether the provider offers the service.

Included support: advice and completed work are different offers

Athlex makes the link between price and capacity visible. Its Essentials, Pro and Premium plans pair monthly fees of £350, £650 and £950 with 2, 5 and 7 hours. All prices are plus VAT. Extra hours cost more, and unused hours do not usually carry over.

GRC Solutions describes unlimited advice, but excludes specific implementation work. Asking how to handle a request for personal data is different from paying someone to carry out that request. Check which of those jobs your proposed service includes.

Mishcon de Reya gives a starting price of £500 per month plus VAT. A starting fee is a prompt to get a proposal for your needs. It is not a complete price for every organisation or workload.

Bring a real task to the call. Ask who gathers the information, who reviews it and who sends the response. Then ask which parts use your allowance or cost extra. You can compare the answers against the same job.

Athlex shows the monthly hours beside each package price.

DPO cover: meet the backup as well as the lead

Knowing your usual contact is only part of the picture. In our review, 19 of 25 providers described an assigned DPO or client team. Five explicitly explained continuity or absence cover. The contact count includes dedicated teams, not only named individuals.

The DPO Centre describes secondary cover at no extra cost within the agreed resource level. That final condition matters: ask how your cover works within the support you have bought.

Ask to understand the backup arrangement before you need it. Who steps in during leave? How will that person know your business? Which records and recent decisions will they have?

In a team, the ICO says roles and responsibilities should be clear, including how the team relates to the DPO. Tim Turner’s comment below raises a separate capacity question: how much time can the service give each client? It is his opinion, not a finding about the staffing of the providers in our study.

DPO contracts: agree urgent help and exit terms

Ask what happens outside routine support hours. Three of the 25 providers published support hours or a response deadline that met our study definition. GRC Solutions states Monday to Friday, 9:00 am to 5:00 pm GMT, excluding public holidays. Those are contact hours, not a promise to reply within a set time.

DPO-Service publishes a response within 4 business hours. These are different commitments. Ask the provider to explain the contact route and promised response for an urgent incident, including outside its normal hours.

Check the exit terms too. Five providers published a commitment or cancellation period. GRC Solutions has a one-year minimum contract paid monthly; cancellation within that year leaves the balance payable. DPO-Service describes rolling monthly plans with 30 days’ notice. Monthly payment alone does not tell you when you can leave.

Use the questions below to turn a sales conversation into a clear scope of work. Hiring a DPO does not transfer your organisation’s responsibility for UK GDPR compliance.

GRC Solutions gives contact hours in its service conditions.

How we ran the study

We started with 140 records in the Desk directory. Screening produced 36 candidates. Reading their original pages confirmed 25 distinct providers offering ongoing DPO appointments with UK presence or explicit UK GDPR coverage.

The other candidates comprised one duplicate brand, three incidental matches and six whose eligibility we could not establish. One further site could not be read. That inaccessible site was left unresolved, not counted as a provider with no DPO service.

For each included provider, we read up to four substantive service, pricing or terms pages, plus pages needed to check eligibility and failed reads. We coded twelve fields and retained the source passages and qualifications. The same editor reviewed the material twice. This was not independent double coding.

This is a dated review of published information from a directory sample. It is not a survey of the whole UK market, a quality ranking or a check of actual service delivery. We did not obtain private proposals or interview providers. A service mentioned on a page is not necessarily included in every package, and missing wording is not proof of a missing service.

We also checked the effect of excluding BD Emerson, an international provider included because its offer explicitly covers UK GDPR. That leaves 24 providers, 18 assigned contacts and two DPO-specific prices. It does not establish that every other provider is based in the UK.

Tim Turner’s words are from his LinkedIn comment, not an interview. These quotations were checked against saved readings of public posts, which may not show later edits. The provider dataset below keeps the observations, source links and study limits together.

To decide whether to outsource and which firms to approach, start with our outsourced DPO guide.