# Who does what in data protection, AI governance and cyber security Knowing who does which job makes certificates, credentials and the rules themselves easier to follow. The Assurance Desk. Last checked 2 October 2026. ## Six kinds of organisation, each with one main job Regulators and public bodies, accreditation bodies, certification bodies, advisers, software makers and professional bodies each do a different job. The picture below shows them side by side. In the UK, the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO) regulates data protection. It took over the work of the Information Commissioner on 30 September 2026, and it is still known as the ICO ([the ICO, 30 September 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/) and [the ICO, 15 September 2026](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-governance-changes-confirmed-for-30-september-2026/), checked 2 October 2026). In the US, the Federal Trade Commission has led federal work on privacy since the 1970s ([the FTC](https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security), checked 29 September 2026). Some public bodies give guidance and do not enforce rules. The National Cyber Security Centre (NCSC) is one. It is the UK's "National Technical Authority for cyber security" ([the NCSC](https://www.ncsc.gov.uk/section/about-ncsc/what-we-do), checked 29 September 2026). **Who does what** - **Regulators and public bodies**: Enforce the law, or give official guidance (the Information Commission (the ICO) and the NCSC in the UK, the FTC in the US) - **Accreditation bodies**: Check that certification bodies are competent and impartial (UKAS in the UK, ANAB and IAS in the US) - **Certification bodies**: Audit a business against a standard and issue the certificate (for ISO 27001, ISO 42001 or Cyber Essentials) - **Advisers**: Help you understand the rules and get ready (consultancies, outsourced data protection officers, law firms) - **Software makers**: Help you keep records, run checks and show your work (privacy, AI governance and compliance platforms) - **Professional bodies**: Train people and issue credentials (the IAPP, ISACA, ISC2 and BCS) Six kinds of organisation, and the main job each one does. Source: UKAS, accreditation and certification, https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026); the IAPP, https://iapp.org/about/ (checked 29 September 2026); ANAB, https://anab.ansi.org/ (checked 29 September 2026); IAS, about IAS, https://www.iasonline.org/about-ias/ (checked 29 September 2026) ## How do advisers show what they know? With a credential. A credential usually shows that a person passed an exam set by a professional body. The picture below shows how a credential differs from a certificate. No UK regulator or professional body licenses data protection or AI governance consultants. It is the same in the US. No federal agency licenses privacy or AI governance consultants, and we found no state licence for this work (we checked on 29 September 2026). UK law takes the same approach to a data protection officer. It asks for "expert knowledge of data protection law and practices" and names no set qualification ([UK GDPR Article 37(5)](https://www.legislation.gov.uk/eur/2016/679/article/37), checked 29 September 2026). **A credential or a certificate?** - **A credential** - Held by a person - Usually earned by passing an exam - Issued by a professional body, such as the IAPP - **A certificate** - Held by an organisation - Earned by passing an audit - Issued by a certification body, which UKAS or ANAB may accredit People hold credentials. Organisations hold certificates. Source: the IAPP, certification, https://iapp.org/certify/ (checked 29 September 2026); UKAS, accreditation and certification, https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026); the ANAB directory of accredited certification bodies, https://anabdirectory.remoteauditor.com/ (checked 29 September 2026) ## Who checks the certification bodies? An accreditation body does. In the UK, that is the United Kingdom Accreditation Service (UKAS), the only national accreditation body ([UKAS](https://www.ukas.com/about-us/about-ukas/), checked 29 September 2026). Two words matter here. A certification body is accredited. A business that passes its audit is certified ([UKAS](https://www.ukas.com/accreditation/about/accreditation-vs-certification/), checked 29 September 2026). In the US, more than one body does this job. ANAB, for example, accredits certification bodies and lists them in an online directory ([ANAB](https://anabdirectory.remoteauditor.com/), checked 29 September 2026). **Who checks whom** - UKAS: The UK's national accreditation body. In the US, ANAB is one of the bodies that does this job. (accredits → A certification body) - A certification body: It audits businesses against a standard, such as ISO 27001. (certifies → Your business) - Your business: It holds accredited certification. UKAS checks the certification body, and the certification body audits your business. Source: UKAS, accreditation and certification, https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026); the ANAB directory of accredited certification bodies, https://anabdirectory.remoteauditor.com/ (checked 29 September 2026); IAS, management system certification bodies, https://www.iasonline.org/services/management-systems-certification-bodies/ (checked 29 September 2026); IAS, about, https://www.iasonline.org/about-ias/ (checked 29 September 2026) > "…if certification bodies are ‘the checkers’ then UKAS’s role as the government-appointed National Accreditation Body is to ‘check the checkers’." > UKAS, Certification guidance > UKAS, https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026) ## What happens in a certification audit? An accredited ISO certificate, such as ISO 27001 or ISO 42001, starts with a two-stage audit, then an audit each year. The picture shows the full three-year cycle ([the International Accreditation Service](https://www.iasonline.org/wp-content/uploads/2021/02/17021-1-2015-Section-9.pdf), checked 29 September 2026). UKAS accredits these certification bodies against ISO/IEC 17021-1, an international standard for how they audit and certify. For ISO 27001, a second standard, ISO/IEC 27006-1, adds extra rules ([UKAS](https://www.ukas.com/accreditation/standards/certification-body-accreditation/), checked 29 September 2026). For an accredited ISO certificate, the firm that prepares you and the body that certifies you must be separate. An accredited certification body must not also work as a consultant on management systems, such as those ISO 27001 and ISO 42001 describe ([European Accreditation](https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/), checked 29 September 2026). Cyber Essentials, a UK scheme developed by the NCSC, works differently. You complete a self-assessment, a board member signs it off, and an assessor marks it. Cyber Essentials Plus adds independent technical testing ([the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026). **How a certification audit usually runs** 1. Stage 1: The auditor reviews your documents and checks you are ready for stage 2. 2. Stage 2: The auditor checks, on site, that your system works in practice. 3. Decision: Someone who did not do the audit decides whether to certify you. 4. Yearly audits: A follow-up audit, called a surveillance audit, at least once a year in years one and two. 5. Renewal: A new audit in year three, before the certificate expires. An ISO certificate usually runs for three years, with an audit every year. Source: ISO/IEC 17021-1, section 9, summarised by the International Accreditation Service, https://www.iasonline.org/wp-content/uploads/2021/02/17021-1-2015-Section-9.pdf (checked 29 September 2026) ## Which credentials will you come across? The table lists eight credentials you will see across the three subjects, and who issues each one. The issuer column links to each credential's own page. Some credentials are accredited too. ANAB, a US accreditation body, accredits four IAPP credentials: CIPP/E, CIPM, CIPT and CIPP/US ([the IAPP](https://iapp.org/certify/), checked 29 September 2026). **Credentials in data protection, AI governance and cyber security, and who issues them. Issuers' pages checked 29 September 2026.** | Credential | What it covers | Who issues it | | --- | --- | --- | | CIPP/E | Data protection law in Europe, including the EU GDPR | [IAPP](https://iapp.org/certify/cippe/) | | CIPM | Setting up and running a privacy programme | [IAPP](https://iapp.org/certify/cipm/) | | CIPT | Building data protection into products and services | [IAPP](https://iapp.org/certify/cipt/) | | AIGP | AI governance: the AI life cycle, AI risk and responsible use | [IAPP](https://iapp.org/certify/aigp/) | | BCS Practitioner Certificate in Data Protection | UK GDPR, the UK Data Protection Act 2018 and the EU GDPR, in practice | [BCS, The Chartered Institute for IT](https://www.bcs.org/qualifications-and-certifications/certifications-for-professionals/information-security-and-data-protection-certifications/bcs-practitioner-certificate-in-data-protection/) | | CISSP | Security practice and principles, for experienced practitioners and managers | [ISC2](https://www.isc2.org/certifications/cissp) | | CISM | Managing information security | [ISACA](https://www.isaca.org/credentialing/cism) | | CISA | Auditing and assessing IT and business systems | [ISACA](https://www.isaca.org/credentialing/cisa) | ## Law, standard or framework: what is the difference? You must follow a law. You choose to meet a standard, or a customer asks you to. A framework is guidance, and using it is usually your choice. Customers ask for standards more often now. UKAS says public and private organisations increasingly name accredited certification in their contracts ([UKAS](https://www.ukas.com/accreditation/standards/certification-body-accreditation/), checked 29 September 2026). The US National Institute of Standards and Technology (NIST) publishes an AI Risk Management Framework. NIST says no organisation is required to use it ([NIST](https://www.nist.gov/itl/ai-risk-management-framework/ai-risk-management-framework-faqs), checked 29 September 2026). **Three kinds of rule** - **A law** - You must follow it - A regulator enforces it - Examples: UK GDPR, the EU AI Act - **A standard** - You choose it, or a contract asks for it - A certification body can audit you against it - Examples: ISO 27001, ISO 42001 - **A framework** - Guidance you can usually use as you see fit - NIST says no organisation is required to use its AI framework - Example: NIST's AI Risk Management Framework What each kind asks of you, and who checks it. Source: UKAS, certification body accreditation, https://www.ukas.com/accreditation/standards/certification-body-accreditation/ (checked 29 September 2026); NIST, AI RMF questions, https://www.nist.gov/itl/ai-risk-management-framework/ai-risk-management-framework-faqs (checked 29 September 2026) ## How do you look up a certificate or a credential? Look it up with the body that keeps the record. Each one has an online tool. Accreditation is "very specific to the activities it covers". A body accredited for ISO 27001 is not always accredited for ISO 42001 ([UKAS](https://www.ukas.com/accreditation/about/accreditation-vs-certification/), checked 29 September 2026). **Where to look it up** - What a certification body is accredited for: the [UKAS directory](https://www.ukas.com/find-an-organisation/) in the UK, or the [ANAB directory](https://anabdirectory.remoteauditor.com/) in the US. - An ISO certificate issued under UKAS accreditation: [UKAS CertCheck](https://www.ukas.com/certcheck/) shows whether it is valid and current. - A person's credential: the body that issued it. [ISACA](https://www.isaca.org/credentialing/verify-a-certification), for example, asks for the holder's certificate number and last name. Three records you can search online, and what each one shows. Source: UKAS, find an organisation, https://www.ukas.com/find-an-organisation/ (checked 29 September 2026); the ANAB directory of accredited certification bodies, https://anabdirectory.remoteauditor.com/ (checked 29 September 2026); UKAS CertCheck, https://www.ukas.com/certcheck/ (checked 29 September 2026); ISACA, verify a certification, https://www.isaca.org/credentialing/verify-a-certification (checked 29 September 2026) ## Which of these is The Assurance Desk? The Assurance Desk is a news provider for the whole data protection, AI governance and cyber security sector. It is not a regulator, an accreditation body, a certification body, an adviser, a software maker or a professional body. It holds no accreditation and gives no legal advice. For more, read the [data protection](/data-protection), [AI governance](/ai-governance) and [cyber security](/cyber-security) sections, or look up a term in the [glossary](/glossary). ## Sources - UK commencement regulations, S.I. 2026/1015: https://www.legislation.gov.uk/uksi/2026/1015/made (checked 29 September 2026) - The ICO, governance changes confirmed for 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-governance-changes-confirmed-for-30-september-2026/ (checked 29 September 2026) - The ICO: ICO welcomes transition to new Information Commission, 30 September 2026: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026) - The FTC, protecting consumer privacy and security: https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security (checked 29 September 2026) - The NCSC, what we do: https://www.ncsc.gov.uk/section/about-ncsc/what-we-do (checked 29 September 2026) - UK GDPR Article 37: https://www.legislation.gov.uk/eur/2016/679/article/37 (checked 29 September 2026) - UKAS, about UKAS: https://www.ukas.com/about-us/about-ukas/ (checked 29 September 2026) - UKAS, accreditation and certification: https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026) - UKAS, certification body accreditation: https://www.ukas.com/accreditation/standards/certification-body-accreditation/ (checked 29 September 2026) - UKAS, find an organisation: https://www.ukas.com/find-an-organisation/ (checked 29 September 2026) - UKAS CertCheck: https://www.ukas.com/certcheck/ (checked 29 September 2026) - The ANAB directory of accredited certification bodies: https://anabdirectory.remoteauditor.com/ (checked 29 September 2026) - European Accreditation, impartiality FAQ on ISO/IEC 17021-1: https://european-accreditation.org/sp_accordion_faqs/question-41-1-impartiality-cl-5-2-5-of-iso-iec-17021-12015/ (checked 29 September 2026) - International Accreditation Service, ISO/IEC 17021-1 section 9: https://www.iasonline.org/wp-content/uploads/2021/02/17021-1-2015-Section-9.pdf (checked 29 September 2026) - The NCSC, Cyber Essentials overview: https://www.ncsc.gov.uk/cyberessentials/overview (checked 29 September 2026) - The IAPP, about: https://iapp.org/about/ (checked 29 September 2026) - The IAPP, certification: https://iapp.org/certify/ (checked 29 September 2026) - The IAPP, CIPP/E: https://iapp.org/certify/cippe/ (checked 29 September 2026) - The IAPP, CIPM: https://iapp.org/certify/cipm/ (checked 29 September 2026) - The IAPP, CIPT: https://iapp.org/certify/cipt/ (checked 29 September 2026) - The IAPP, AIGP: https://iapp.org/certify/aigp/ (checked 29 September 2026) - BCS, Practitioner Certificate in Data Protection: https://www.bcs.org/qualifications-and-certifications/certifications-for-professionals/information-security-and-data-protection-certifications/bcs-practitioner-certificate-in-data-protection/ (checked 29 September 2026) - ISC2, CISSP: https://www.isc2.org/certifications/cissp (checked 29 September 2026) - ISACA, CISM: https://www.isaca.org/credentialing/cism (checked 29 September 2026) - ISACA, CISA: https://www.isaca.org/credentialing/cisa (checked 29 September 2026) - ISACA, verify a certification: https://www.isaca.org/credentialing/verify-a-certification (checked 29 September 2026) - NIST, AI Risk Management Framework questions: https://www.nist.gov/itl/ai-risk-management-framework/ai-risk-management-framework-faqs (checked 29 September 2026) - IAS, about: https://www.iasonline.org/about-ias/ (checked 29 September 2026) - IAS, management system certification bodies: https://www.iasonline.org/services/management-systems-certification-bodies/ (checked 29 September 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.