We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Data protection, AI governance and cyber security, explained in plain terms.

Data protection. AI governance. Cyber security.

The Assurance Desk is a news provider for the whole data protection, AI governance and cyber security sector. It explains the rules, the standards and the firms in plain terms.

Read the guides

Latest news

All news

Start with a guide

All guides

Does GDPR apply to small businesses and sole traders?

Start with the personal data you hold, then check your duties, fee and need for a DPO separately.

Read the guide

Do you need a data protection officer? UK GDPR sets three tests

Ask this before you hire anyone, because the answer changes what you need to buy.

Read the guide

What is AI governance, in plain words?

Give people a clear way to choose, use and check AI at work.

Read the guide

Who can write your AI policy?

Choose a writer who can turn the way your team works into rules people can use.

Read the guide

How much is Cyber Essentials, and what does it ask?

Know what the fee buys before you book an assessment or pay for help.

Read the guide

Customer security questionnaires: what they ask and how to answer

A clear response connects each answer to the service, the evidence and any work still to do.

Read the guide

Which data protection, AI governance and cyber security providers publish a price?

A published price lets you see a figure before you speak to a firm, and this list gives every one we found.

Glossary

The industry's words in plain English

Which of these is your situation?

Each page explains one common situation, such as a first DPO, a new certificate or a data breach.

  1. Do we need a DPO?
  2. Getting certified
  3. The EU AI Act reaches us
  4. After a breach
  5. Switching provider
  6. Our sector’s rules
  7. Ransomware

How the industry works

Knowing who does which job tells you where to look for an answer, in the UK and the US.

Read how the industry works

Who does what

  • Regulators and public bodies Enforce the law, or give official guidance the Information Commission (the ICO) and the NCSC in the UK, the FTC in the US
  • Accreditation bodies Check that certification bodies are competent and impartial UKAS in the UK, ANAB and IAS in the US
  • Certification bodies Audit a business against a standard and issue the certificate for ISO 27001, ISO 42001 or Cyber Essentials
  • Advisers Help you understand the rules and get ready consultancies, outsourced data protection officers, law firms
  • Software makers Help you keep records, run checks and show your work privacy, AI governance and compliance platforms
  • Professional bodies Train people and issue credentials the IAPP, ISACA, ISC2 and BCS
Six kinds of organisation, and the main job each one does.

Each of these is sourced and dated on How the industry works.

How we score each provider

We score every provider in the directory on the same six questions, using public sources.

  • Does the firm help when something goes wrong?

    Whether it publishes how it supports clients through a breach or a regulator's enquiry.

  • Who does the work, and what qualifications do they hold?

    Named staff with qualifications you can check or, for a certification body, accreditation from UKAS in the UK or ANAB in the US.

  • How does the firm charge for its work?

    Whether prices or day rates appear on its website, and what the fee covers.

  • Does the firm know your sector?

    Named specialists and published work in sectors such as health, financial services or education.

  • Is the advice separate from anything it sells?

    Whether its advice is tied to a product it sells, and whether it names its partners.

  • Who carries the risk if the advice is wrong?

    Whether it holds professional indemnity insurance, and what its terms say about liability.

Browse the providersA list of providers that publish a price