HOW TO HIRE · BUSINESS & PROFESSIONAL

How to hire a data protection consultant in the UK
The checks, the questions and the paperwork.

No licence applies to GDPR consultants. Here is how to judge one and what the project should deliver.

  • Search and compare — no account needed
  • Nearest to you first
  • One score from Google, Trustpilot and Locufy reviews

THE 60-SECOND VERSION

Hiring a data protection consultant in five steps

  1. Check your own ICO feeMost businesses processing personal data must pay it.
  2. Say what you needAn audit, privacy notices, a breach response, a subject access request or an outsourced DPO.
  3. Check sector experienceHealth, children's or marketing data raises different issues.
  4. Agree adviser or DPOWhether they will be your data protection officer or just advise.
  5. Get an action planFixes ranked by risk, with owners.

BEFORE YOU BOOK

Check before you book

No register applies

No law licenses data protection consultants in England, Wales, Scotland or Northern Ireland, and certifications are voluntary. Experience in your sector and a clear scope matter most.

Ask the data protection consultant for similar projects and a client reference.

The ICO data protection fee

A business or sole trader processing personal data must pay the ICO fee unless exempt; for most small organisations it is £52 or £78 a year, and not paying can lead to a fine.

Check your business's registration on the ICO register before the audit. gov.uk →

Your core duties

gov.uk explains that a business must keep personal data secure, accurate and up to date, tell people how it is used, and respond to requests to see it, with the ICO able to fine misuse. A consultant can map and document this, but the duty stays with you.

Ask the consultant to show how the action plan covers each duty. gov.uk →

Processor contracts (UK GDPR)

Where suppliers handle personal data for you, the ICO's guidance lists what the written contract must include. A good audit checks those contracts.

Ask whether supplier contracts are in scope. ico.org.uk →

VAT

Data protection consultancy is standard-rated, so a registered data protection consultant adds 20% to the project fee, the outsourced DPO retainer and incident support. Registration becomes compulsory once a data protection consultant has VAT-taxable turnover over £90,000 in any rolling 12 months; from then VAT must be charged and shown as a separate line on the invoice.

Ask the data protection consultant for the VAT number with the scope and for VAT on each fee as its own figure. gov.uk →

“What data protection work have you done in my sector?”

A good answer: Similar audits or incidents, and a client the data protection consultant can name.

“Will you act as our DPO, or advise only?”

A good answer: A clear answer, and what each role involves.

“What will the data protection audit produce?”

A good answer: A data map, a gap analysis, notices and policies, and a ranked action plan.

“Are supplier contracts in scope?”

A good answer: Yes or no, and the cost if not.

“How would you help with a data breach?”

A good answer: A response plan and availability.

“How will you protect the data you see?”

A good answer: Confidentiality and secure handling.

“What is a fixed price for the project?”

A good answer: A fee for the scope, with extras listed.

Getting the quote right

  • Scope: data mapping, gap analysis, notices, policies, contracts
  • Who actually attends to the audit and the policies: the data protection consultant named, an employee, or a subcontractor
  • Fixed project fee, or day rate
  • Outsourced DPO: monthly fee and duties
  • Incident support: rate and response time
  • Confidentiality terms
  • The VAT number, and VAT at 20% on the project fee and any DPO retainer

Walk away if

  • Template policies with no look at your data
  • Scare stories about fines to sell a retainer
  • Says a certificate makes you compliant
  • No action plan
  • Will not sign confidentiality terms
  • No sector experience for sensitive data
LOW
£600
TYPICAL
£950
HIGH
£2,000

What a data protection consultant costs: £600–£2,000 per project

Data protection consultants usually quote a fixed project fee for audits and documents, with monthly fees for outsourced DPO services. GDPR / Data Protection Consultant price guide →

Guide prices compiled by the Locufy team from published Irish and UK provider price lists and 2026/27 cost guides. Updated 2026.

KNOW WHAT TO LOOK FOR? NOW FIND ONE

Data protection consultants near you, with the badges that matter shown

ID checked, trader status and one score from every review — on the card, before you message anyone. Nearest first. No account needed to look.

Or post the job free and let them come to you.

  1. Data mappingWhat data you hold, where it goes and why.
  2. Gap analysisPractice compared with UK GDPR, risks ranked.
  3. DocumentsPrivacy notices, retention schedules and policies.
  4. ContractsSupplier contracts reviewed.
  5. Action planFixes, training and next steps.

UK GDPR
The UK's main data protection law, with the Data Protection Act 2018.
DPO
Data protection officer: a role some organisations must appoint.
Subject access request
A person's request to see the data you hold on them.
Data map
A record of personal data, where it flows and why.
Retention schedule
How long each type of data is kept.
Processor
A supplier handling personal data on your behalf.

AFTER

When the job is done

Work through the action planAssign owners and dates.
Publish the noticesPrivacy notices on your website and forms.
Diary a reviewData protection is ongoing; review yearly.
Write the reviewReviews on Locufy can only follow a booking, so the data protection consultant is judged on real work. If something is wrong, the make-it-right step comes first and they are asked to fix it before the review is published.

STEP 1Complain to the data protection consultant directlyKeep it factual: what the data protection consultant agreed to do, what you got, and what you want now. Section 49 of the Consumer Rights Act 2015 builds reasonable care and skill into every trader's service; if it was missing, ask for a repeat of the work or a reduction.
STEP 2Bring in LocufyScore the data protection consultant below four stars and you choose whether they see the problem before the review goes up. We follow it through; then you review.
STEP 3Where to report itBecause data protection consultants have no regulator, a dispute with the data protection consultant goes to consumer advice: Citizens Advice (0808 223 1133) in England and Wales, Advice Direct Scotland (0808 800 9060), Consumerline (0300 123 6262) in Northern Ireland.
STEP 4Small claims, as the last stepYou can sue the data protection consultant for the money without a lawyer: small claims up to £10,000 in England and Wales, simple procedure up to £5,000 in Scotland, small claims up to £5,000 in Northern Ireland.

Hiring a data protection consultant: questions people ask

There is no licence or register for this work anywhere in the UK, and no qualification is required.

Most businesses processing personal data must, unless exempt; for most small organisations it is £52 or £78 a year.

They can help, but the duties stay with your business.

£600 to £2,000 per project, around £950 for a typical job. Scope, sensitive data, number of systems and an outsourced DPO role set the price. The data protection consultant price guide explains what moves it; enter your town above to see data protection consultants near you.

Only some organisations must appoint one; ask the consultant whether you do.

A few days for an audit and report; ongoing support for an outsourced DPO.

MORE GUIDES

More hiring guides in business & professional

How to hire: ISO Certification ConsultantHow to hire: Business ConsultantHow to hire: HR ConsultantHow to hire: Market ResearchHow to hire: Management ConsultantHow to hire: Private InvestigatorHow to hire: Startup AdvisorHow to hire: Telemarketing & Lead GenerationAll 701 hiring guides →

Data protection consultants near you

Data protection consultants in LondonData protection consultants in ManchesterData protection consultants in BirminghamData protection consultants in GlasgowData protection consultants in BelfastAll data protection consultants on Locufy →

Sources — checked October 2026

  1. gov.uk — pay the data protection fee
  2. gov.uk — data protection and your business
  3. ICO — contracts between controllers and processors
  4. Consumer Rights Act 2015, section 49 — reasonable care and skill
  5. Citizens Advice — more help with a consumer issue
  6. gov.uk — make a court claim for money: court fees
  7. VAT rates — VAT rates for goods and services: standard rate 20% on most goods and services
  8. GOV.UK — Register for VAT: when to register