The Assurance Desk
Six kinds of organisation, each with one main job
Regulators and public bodies, accreditation bodies, certification bodies, advisers, software makers and professional bodies each do a different job. The picture below shows them side by side.
In the UK, the Information Commission (the ICO) regulates data protection. It took over the work of the Information Commissioner on 30 September 2026, and it is still known as the ICO.
In the US, the Federal Trade Commission has led federal work on privacy since the 1970s.
Some public bodies give guidance and do not enforce rules. The National Cyber Security Centre (NCSC) is one. It is the UK's "National Technical Authority for cyber security".
Who does what
- Regulators and public bodies Enforce the law, or give official guidance the Information Commission (the ICO) and the NCSC in the UK, the FTC in the US
- Accreditation bodies Check that certification bodies are competent and impartial UKAS in the UK, ANAB and IAS in the US
- Certification bodies Audit a business against a standard and issue the certificate for ISO 27001, ISO 42001 or Cyber Essentials
- Advisers Help you understand the rules and get ready consultancies, outsourced data protection officers, law firms
- Software makers Help you keep records, run checks and show your work privacy, AI governance and compliance platforms
- Professional bodies Train people and issue credentials the IAPP, ISACA, ISC2 and BCS
How do advisers show what they know?
With a credential. A credential usually shows that a person passed an exam set by a professional body. The picture below shows how a credential differs from a certificate.
No UK regulator or professional body licenses data protection or AI governance consultants. It is the same in the US. No federal agency licenses privacy or AI governance consultants, and we found no state licence for this work (we checked on 29 September 2026).
UK law takes the same approach to a data protection officer. It asks for "expert knowledge of data protection law and practices" and names no set qualification.
A credential or a certificate?
A credential
- Held by a person
- Usually earned by passing an exam
- Issued by a professional body, such as the IAPP
A certificate
- Held by an organisation
- Earned by passing an audit
- Issued by a certification body, which UKAS or ANAB may accredit
Who checks the certification bodies?
An accreditation body does. In the UK, that is the United Kingdom Accreditation Service (UKAS), the only national accreditation body.
Two words matter here. A certification body is accredited. A business that passes its audit is certified.
In the US, more than one body does this job. ANAB, for example, accredits certification bodies and lists them in an online directory.
Who checks whom
- UKAS The UK's national accreditation body. In the US, ANAB is one of the bodies that does this job.accredits
- A certification body It audits businesses against a standard, such as ISO 27001.certifies
- Your business It holds accredited certification.
…if certification bodies are ‘the checkers’ then UKAS’s role as the government-appointed National Accreditation Body is to ‘check the checkers’.
What happens in a certification audit?
An accredited ISO certificate, such as ISO 27001 or ISO 42001, starts with a two-stage audit, then an audit each year. The picture shows the full three-year cycle.
UKAS accredits these certification bodies against ISO/IEC 17021-1, an international standard for how they audit and certify. For ISO 27001, a second standard, ISO/IEC 27006-1, adds extra rules.
For an accredited ISO certificate, the firm that prepares you and the body that certifies you must be separate. An accredited certification body must not also work as a consultant on management systems, such as those ISO 27001 and ISO 42001 describe.
Cyber Essentials, a UK scheme developed by the NCSC, works differently. You complete a self-assessment, a board member signs it off, and an assessor marks it. Cyber Essentials Plus adds independent technical testing.
How a certification audit usually runs
- Stage 1 The auditor reviews your documents and checks you are ready for stage 2.
- Stage 2 The auditor checks, on site, that your system works in practice.
- Decision Someone who did not do the audit decides whether to certify you.
- Yearly audits A follow-up audit, called a surveillance audit, at least once a year in years one and two.
- Renewal A new audit in year three, before the certificate expires.
Which credentials will you come across?
The table lists eight credentials you will see across the three subjects, and who issues each one. The issuer column links to each credential's own page.
Some credentials are accredited too. ANAB, a US accreditation body, accredits four IAPP credentials: CIPP/E, CIPM, CIPT and CIPP/US.
| Credential | What it covers | Who issues it |
|---|---|---|
| CIPP/E | Data protection law in Europe, including the EU GDPR | IAPP |
| CIPM | Setting up and running a privacy programme | IAPP |
| CIPT | Building data protection into products and services | IAPP |
| AIGP | AI governance: the AI life cycle, AI risk and responsible use | IAPP |
| BCS Practitioner Certificate in Data Protection | UK GDPR, the UK Data Protection Act 2018 and the EU GDPR, in practice | BCS, The Chartered Institute for IT |
| CISSP | Security practice and principles, for experienced practitioners and managers | ISC2 |
| CISM | Managing information security | ISACA |
| CISA | Auditing and assessing IT and business systems | ISACA |
Law, standard or framework: what is the difference?
You must follow a law. You choose to meet a standard, or a customer asks you to. A framework is guidance, and using it is usually your choice.
Customers ask for standards more often now. UKAS says public and private organisations increasingly name accredited certification in their contracts.
The US National Institute of Standards and Technology (NIST) publishes an AI Risk Management Framework. NIST says no organisation is required to use it.
Three kinds of rule
A law
- You must follow it
- A regulator enforces it
- Examples: UK GDPR, the EU AI Act
A standard
- You choose it, or a contract asks for it
- A certification body can audit you against it
- Examples: ISO 27001, ISO 42001
A framework
- Guidance you can usually use as you see fit
- NIST says no organisation is required to use its AI framework
- Example: NIST's AI Risk Management Framework
How do you look up a certificate or a credential?
Look it up with the body that keeps the record. Each one has an online tool.
Accreditation is "very specific to the activities it covers". A body accredited for ISO 27001 is not always accredited for ISO 42001.
Where to look it up
- What a certification body is accredited for: the UKAS directory in the UK, or the ANAB directory in the US.
- An ISO certificate issued under UKAS accreditation: UKAS CertCheck shows whether it is valid and current.
- A person's credential: the body that issued it. ISACA, for example, asks for the holder's certificate number and last name.
Which of these is The Assurance Desk?
The Assurance Desk is a news provider for the whole data protection, AI governance and cyber security sector. It is not a regulator, an accreditation body, a certification body, an adviser, a software maker or a professional body. It holds no accreditation and gives no legal advice.
For more, read the data protection, AI governance and cyber security sections, or look up a term in the glossary.