Who does data protection, AI governance and cyber security work?

Advisory firms, certification bodies and software products are scored on the same six questions. Each group is listed A to Z, not by score.

Advisory firms 80

AARC-360

Relevant if you are a US group that wants one adviser across the EU GDPR, HIPAA and CCPA

First DPO or AI policy · Seeking ISO 42001 certification

Accorian (Esha Corporation dba Accorian; Accorian Assurance)

Relevant if you need SOC 2 or ISO 27001 work and ISO 42001 help from the same firm

Seeking ISO 42001 certification · Regulated sectors · After a ransomware or security incident

Actica Consulting Limited

Relevant if you run essential services and need NCSC-assured security architecture, risk or audit work

Regulated sectors · Seeking ISO 42001 certification

Aleada Consulting

Relevant if you are a US tech or finance company appointing a first privacy adviser

First DPO or AI policy · Regulated sectors

Amethyst Risk Management Limited

Relevant if you need a Cyber Assessment Framework audit from an NCSC-listed firm, or ISO/IEC 27001 help

Regulated sectors · Seeking ISO 42001 certification · First DPO or AI policy

Ametros Group

Relevant if you want a budget figure before you call, and a DPO the firm says it employs

First DPO or AI policy · Regulated sectors · Exposed to the EU AI Act · Switching provider

AMSA InfoSec Ltd

Relevant if you buy through G-Cloud and want a published day rate and a named consultant

Seeking ISO 42001 certification · First DPO or AI policy

Anekanta Consulting

Relevant if your board uses higher-risk AI, such as biometrics, and needs an EU AI Act risk assessment

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

Apache Consulting (Apache Consults / Vadasz Ventures)

Relevant if you want outsourced Chief Privacy Officer help and will confirm the firm's legal entity first

First DPO or AI policy

Arcanum Cyber Security (Arcanum Information Security Limited)

Relevant if you need NCSC-assured audit, risk management or security architecture work in a regulated sector

First DPO or AI policy · Regulated sectors · After a ransomware or security incident

Athlex

Relevant if you are a start-up or small business and want a DPO at a known monthly price

First DPO or AI policy

AvISO Consultancy

Relevant if you are already working towards several ISO certificates and want DPO support alongside

Seeking ISO 42001 certification · Regulated sectors · First DPO or AI policy · Exposed to the EU AI Act

BABL AI Inc.

Relevant if you sell hiring software and need a New York City Local Law 144 bias audit

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

BD Emerson LLC

Relevant if you want a named privacy lead with IAPP credentials for DPO or AI-governance work

First DPO or AI policy · Exposed to the EU AI Act · Regulated sectors

Bird & Bird LLP

Relevant if you face a breach, a regulator investigation or EU AI Act exposure and need lawyers

Exposed to the EU AI Act · After a breach or ICO contact · First DPO or AI policy

Bratby Law

Relevant if you run a telecoms or AI-product business and want a partner's advice at an agreed fee

After a breach or ICO contact · Exposed to the EU AI Act · Regulated sectors

Bridewell

Relevant if you run critical infrastructure or a regulated business and want privacy help inside a security firm

First DPO or AI policy · Seeking ISO 42001 certification · After a breach or ICO contact · Exposed to the EU AI Act · Regulated sectors · After a ransomware or security incident

Bright Defense, LLC

Relevant if you need SOC 2 or ISO 27001 readiness and want a published starting price

Seeking ISO 42001 certification · Regulated sectors

C3IA Solutions Limited

Relevant if you need NCSC-assured audit or risk work for a public-sector or defence body

First DPO or AI policy · Regulated sectors

CBIZ Pivot Point Security

Relevant if you want an outsourced security chief with published monthly prices, or help towards ISO 27001

Seeking ISO 42001 certification · Regulated sectors · First DPO or AI policy

Compass IT Compliance, LLC

Relevant if you want help preparing for SOC 2, PCI DSS or CMMC from named practice leads

Seeking ISO 42001 certification · Regulated sectors · First DPO or AI policy

Core Business Solutions

Relevant if you are preparing for a first SOC 2 or ISO 27001 audit and want named consultants

Seeking ISO 42001 certification

Cyber Defense Group

Relevant if you are a growing company that wants a part-time security leader and help preparing for audits

Seeking ISO 42001 certification · Regulated sectors · First DPO or AI policy · After a ransomware or security incident

CyPro

Relevant if you want cyber security and GDPR work together from named founders with checkable credentials

First DPO or AI policy · Seeking ISO 42001 certification · Regulated sectors

Data GRC Ltd

Relevant if you want a 30-minute advice call at a fixed price before committing to a retainer

First DPO or AI policy · Seeking ISO 42001 certification · After a breach or ICO contact

Data Privacy & Security Advisors, LLC (The DPSA)

Relevant if you need an outsourced US privacy contact for CCPA/CPRA, HIPAA and state privacy laws

First DPO or AI policy · Regulated sectors

Data Protection People

Relevant if you want DPO support and subject access request handling from one firm with named staff

First DPO or AI policy · Seeking ISO 42001 certification · After a breach or ICO contact · Regulated sectors

DataGuard

Relevant if you want software with consultants attached for ISO 27001 or several frameworks at once

First DPO or AI policy · Seeking ISO 42001 certification · Exposed to the EU AI Act

DCI Consulting Group, Inc.

Relevant if you use an AI hiring tool and need a bias audit under a specific law

Exposed to the EU AI Act · Regulated sectors

Debbie Reynolds Consulting LLC

Relevant if you want a first conversation about privacy or AI governance risk with one named practitioner

First DPO or AI policy · After a breach or ICO contact

Deloitte LLP

Relevant if you are a large organisation with EU AI Act duties and want a named privacy partner

Exposed to the EU AI Act · First DPO or AI policy

DPO-Service

Relevant if you want a DPO within 48 hours on a 30-day rolling contract

First DPO or AI policy · After a breach or ICO contact · Switching provider

Elevate Consult

Relevant if you are preparing for ISO 42001 or a New York City hiring-tool bias audit

Seeking ISO 42001 certification · Exposed to the EU AI Act

Enterprivacy Consulting Group

Relevant if you want a privacy-by-design review done personally by a named, qualified privacy specialist

First DPO or AI policy · Seeking ISO 42001 certification

Eticas.ai (Algorithmic Auditing Inc., US entity of Eticas Research and Consulting S.L.)

Relevant if you want an outside audit of a specific AI system, such as a hiring tool

First DPO or AI policy · Exposed to the EU AI Act · Regulated sectors

Evalian

Relevant if you want data protection, cyber security and ISO support from one firm with named, qualified leaders

First DPO or AI policy · Seeking ISO 42001 certification · Exposed to the EU AI Act · After a breach or ICO contact · After a ransomware or security incident

EY (UK), Ernst & Young LLP

Relevant if you need AI governance advice from a mixed team of lawyers, risk experts and data scientists

Exposed to the EU AI Act

Fast Data Science

Relevant if you need hands-on AI delivery with governance advice built in, not a DPO

First DPO or AI policy · Regulated sectors

Fieldfisher LLP

Relevant if you want regulated solicitors whose data protection team has run a High Court claim

Exposed to the EU AI Act · First DPO or AI policy

Forvis Mazars

Relevant if you want privacy and AI governance advice from a large firm that names its indemnity insurer

First DPO or AI policy · Exposed to the EU AI Act · After a breach or ICO contact · Regulated sectors

Fractional CISO, LLC

Relevant if you are preparing for a SOC 2 or ISO 27001 audit and want named, qualified staff

Seeking ISO 42001 certification · First DPO or AI policy · Regulated sectors

GDPR Advisor (PSA Professional Solutions)

Relevant if you want an outsourced DPO and training from one firm, and will check its company number

First DPO or AI policy · Seeking ISO 42001 certification · After a breach or ICO contact · Regulated sectors

Gowling WLG (UK) LLP

Relevant if you want data protection and AI lawyers who publish how they use AI themselves

Regulated sectors · Exposed to the EU AI Act · After a breach or ICO contact

GRCI Law

Relevant if you want data protection help alongside a group's wider cyber and ISO 27001 services

First DPO or AI policy · After a breach or ICO contact

Handley Gill

Relevant if you need data protection and AI governance support, including information-rights tribunal appeals

First DPO or AI policy · After a breach or ICO contact · Exposed to the EU AI Act · Regulated sectors

HewardMills

Relevant if you need an outsourced DPO across several countries from a firm that sells no software

First DPO or AI policy · After a breach or ICO contact · Regulated sectors

Hope & May

Relevant if you run a charity and want a named DPO team from an NCVO trusted supplier

First DPO or AI policy · Regulated sectors · After a breach or ICO contact · Exposed to the EU AI Act

IT Governance (now GRC Solutions)

Relevant if you want advice and ready-made compliance documents from one supplier, with published product prices

Seeking ISO 42001 certification · First DPO or AI policy · Exposed to the EU AI Act · After a breach or ICO contact · After a ransomware or security incident

JBW Group International, LLC

Relevant if you run a regulated US business and want named, qualified people for privacy or ISO work

First DPO or AI policy · Seeking ISO 42001 certification · Regulated sectors

JVR Consultancy

Relevant if you want UK GDPR help alongside rail, construction or utilities accreditation work

First DPO or AI policy · Seeking ISO 42001 certification · Regulated sectors

Kafico

Relevant if you run a GP practice or health business and want a named, qualified DPO

First DPO or AI policy · Seeking ISO 42001 certification · Regulated sectors

Kemp IT Law LLP

Relevant if you need a regulated lawyer on the EU AI Act or UK data protection law

Exposed to the EU AI Act · Regulated sectors

KPMG LLP (UK)

Relevant if you already use Microsoft Purview and want AI-risk and data protection work from one firm

Exposed to the EU AI Act · After a breach or ICO contact · Regulated sectors

Kuma (Kimble and Associates, LLC)

Relevant if you run a US public body and want a named, qualified part-time privacy officer

First DPO or AI policy · Regulated sectors

Logiq Consulting Ltd

Relevant if you are a public body buying through G-Cloud and need NCSC-assured cyber audit work

Regulated sectors · First DPO or AI policy

Meditology Services, LLC

Relevant if you are a US health organisation needing a HITRUST assessment or HIPAA compliance help

Seeking ISO 42001 certification · Regulated sectors · After a breach or ICO contact

Mishcon de Reya LLP

Relevant if you face a cyber incident, or want an outsourced DPO from a law firm

After a breach or ICO contact · First DPO or AI policy · After a ransomware or security incident

ORCAA (O'Neil Risk Consulting and Algorithmic Auditing, Inc.)

Relevant if you need a bias audit under New York City's Local Law 144 or Colorado's SB21-169

Regulated sectors

Osborne Clarke LLP

Relevant if you need solicitors for an ICO crisis, a subject access dispute or an AI rollout

After a breach or ICO contact · Seeking ISO 42001 certification · Exposed to the EU AI Act

Pembroke Privacy

Relevant if you need one adviser for EU and UK GDPR work and want named, qualified staff

First DPO or AI policy · Exposed to the EU AI Act · After a breach or ICO contact

PricewaterhouseCoopers LLP (PwC UK)

Relevant if you want a Big Four firm that names its insurer and lists ISO 27701 certification

Exposed to the EU AI Act · Regulated sectors

Privacy Ref, Inc.

Relevant if you want a small US firm for privacy or AI governance work, not a large one

First DPO or AI policy · Regulated sectors

Red Clover Advisors, LLC

Relevant if you want help building a US privacy or AI governance programme, not incident response

First DPO or AI policy · Regulated sectors

Resolution Economics LLC

Relevant if you need a bias audit under New York City's Local Law 144 in the US

Regulated sectors

Responsible Artificial Intelligence LLC (RAI LLC)

Relevant if you need a New York City Local Law 144 audit or an AI expert witness

Regulated sectors

Rhymetec LLC

Relevant if your SaaS company needs SOC 2, ISO 27001 and a virtual CISO from one firm

Seeking ISO 42001 certification · First DPO or AI policy · Regulated sectors

RightCue Consulting Services Ltd

Relevant if you are a small firm seeking Cyber Essentials or appointing a first virtual CISO

Seeking ISO 42001 certification · Regulated sectors · First DPO or AI policy · After a ransomware or security incident

Rocket-Hire LLC

Relevant if you need a bias audit of an automated hiring tool and want the starting price upfront

Regulated sectors · First DPO or AI policy

RPC (Reynolds Porter Chamberlain LLP)

Relevant if you face a data breach or regulator's investigation and want a regulated law firm

After a breach or ICO contact · Exposed to the EU AI Act · After a ransomware or security incident

Samurai Digital Security Limited

Relevant if you are appointing a first virtual CISO or working towards ISO 27001 or Cyber Essentials

First DPO or AI policy · Seeking ISO 42001 certification · After a breach or ICO contact · After a ransomware or security incident

Securys

Relevant if you want a fixed-fee DPO with breach response and subject access requests included

First DPO or AI policy · Exposed to the EU AI Act · After a breach or ICO contact · Regulated sectors

SideChannel, Inc.

Relevant if you want a virtual CISO or SOC 2 readiness help and a published price range

Seeking ISO 42001 certification · First DPO or AI policy

SME Comply

Relevant if you run a small business and want DPO support and legal advice from one place

First DPO or AI policy · After a breach or ICO contact · Exposed to the EU AI Act

Strategic Management Services, LLC

Relevant if you run a US healthcare organisation and need an interim HIPAA privacy officer or breach help

After a breach or ICO contact · Regulated sectors · First DPO or AI policy

The DPO Centre

Relevant if you are appointing a first DPO and want named, qualified people and sector case studies

First DPO or AI policy · Exposed to the EU AI Act · Regulated sectors · Seeking ISO 42001 certification

URM Consulting

Relevant if you want DPO support and ISO 27001 or 22301 certification help from one firm

First DPO or AI policy · Seeking ISO 42001 certification · Regulated sectors · Exposed to the EU AI Act · After a ransomware or security incident

vCISO Services, LLC

Relevant if you are a smaller US business preparing for SOC 2, ISO 27001 or CMMC audits

Seeking ISO 42001 certification · First DPO or AI policy · Regulated sectors

VeraSafe, LLC

Relevant if you need an outsourced DPO or advice on California privacy law or the EU AI Act

First DPO or AI policy · Exposed to the EU AI Act

Winston Taylor UK LLP (formerly Taylor Wessing)

Relevant if you face a breach, regulator inquiry or EU AI Act question and want a law firm

After a breach or ICO contact · Exposed to the EU AI Act · Regulated sectors

Zaviant (WJS Cyber Consulting, LLC d/b/a Zaviant)

Relevant if you are a US company building a privacy programme on OneTrust or a similar platform

Exposed to the EU AI Act · Seeking ISO 42001 certification · Regulated sectors

Certification bodies 33

360 Advanced, Inc.

Relevant if you need a SOC 2 examination and work in US finance, healthcare or government

Seeking ISO 42001 certification · Regulated sectors

A-LIGN Compliance and Security, Inc. (dba A-LIGN)

Relevant if you want one accredited body to certify security, privacy, continuity and AI management systems

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

Amtivo

Relevant if you want UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification, not ISO 42001

First DPO or AI policy · Seeking ISO 42001 certification · Switching provider · Regulated sectors

Approachable Certification Ltd

Relevant if you want ISO/IEC 27001 certification from a body that says it has never offered consultancy

Seeking ISO 42001 certification

Aprio, LLP

Relevant if you want ISO/IEC 42001 or 27001 certification from a large, ANAB-accredited US firm

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

BARR Certifications, LLC

Relevant if you run a US organisation and need ANAB-accredited ISO/IEC 27001 or 27701 certification

Seeking ISO 42001 certification

Boulay Certifications, LLC

Relevant if you need ISO/IEC 27001 certification and want written rules separating audit from consulting

Seeking ISO 42001 certification

BSI (The British Standards Institution)

Relevant if you want UKAS-accredited ISO/IEC 42001 certification and a certificate anyone can check online

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

Bureau Veritas

Relevant if you need UKAS-accredited ISO 27001, ISO 9001 or nuclear supply-chain certification, not ISO 42001

First DPO or AI policy · Seeking ISO 42001 certification · Switching provider · Regulated sectors

Centre for Assessment

Relevant if you want UKAS-accredited ISO 9001 or 27001 certification, or a Lexcel assessment for a law firm

First DPO or AI policy · Seeking ISO 42001 certification · Switching provider · Regulated sectors

Coalfire Certification, Inc.

Relevant if you want ISO 42001 certification from a body that has already certified named technology firms

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

ControlCase Assessments LLC

Relevant if you need PCI DSS, FedRAMP, CMMC or HITRUST assessments from one firm

Seeking ISO 42001 certification · Regulated sectors

DNV

Relevant if you need UKAS-accredited ISO 9001, ISO 27001 or ISO 45001 certification from a large international group

First DPO or AI policy · Seeking ISO 42001 certification · Switching provider · Regulated sectors

EAGLE Registrations Inc.

Relevant if you want an ANAB-accredited ISO/IEC 27001 certificate from a body that sells no consulting

Seeking ISO 42001 certification · Regulated sectors

Forefront Certification Limited (FFC)

Relevant if you want UKAS-accredited ISO 27001 certification for a UK organisation

Seeking ISO 42001 certification

Intertek

Relevant if you need a UKAS-accredited ISO 27001, ISO 9001 or ISO 37001 certificate from a large group

First DPO or AI policy · Seeking ISO 42001 certification · Switching provider · Regulated sectors

IS Partners, LLC

Relevant if you need an ANAB-accredited ISO 27001 certificate or a CMMC assessment in the US

Seeking ISO 42001 certification · Regulated sectors

ISOQAR (formerly Alcumus ISOQAR)

Relevant if you want a UKAS-accredited ISO 42001 certificate, audited alongside ISO 9001 or ISO 27001

Seeking ISO 42001 certification · Exposed to the EU AI Act · First DPO or AI policy

Kompleye Attestation, LLC

Relevant if you need an accredited ISO 27001 or 27701 certificate and SOC work from one firm

Seeking ISO 42001 certification · Regulated sectors

Linford & Company LLP

Relevant if you need SOC 2, US HIPAA or FedRAMP Moderate assessments from one firm

Seeking ISO 42001 certification · Regulated sectors

LRQA

Relevant if you want accredited ISO 42001 certification combined with ISO 27001, 9001 or 14001 audits

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors

NQA

Relevant if you want accredited ISO 42001 certification with the contract terms published before you sign

Seeking ISO 42001 certification · Exposed to the EU AI Act · Switching provider

Palindrome Technologies, Inc.

Relevant if you want ISO/IEC 42001 certification from an ANAB-accredited body

Seeking ISO 42001 certification · Regulated sectors

Peers Quality Assurance Limited (PQAL)

Relevant if you want UKAS-accredited ISO/IEC 27001 certification and published rules on auditor impartiality

Seeking ISO 42001 certification · Regulated sectors

Perry Johnson Registrars, Inc.

Relevant if you need certification to an established standard such as ISO 9001 or ISO 27001

Seeking ISO 42001 certification · Regulated sectors · Exposed to the EU AI Act

RA Cert Ltd

Relevant if you want UKAS-accredited ISO/IEC 27001 certification or a World Lottery Association security assessment

Seeking ISO 42001 certification · Regulated sectors

Responsible AI Institute (Responsible Artificial Intelligence Institute)

Relevant if you work in finance or health and want an AI governance assessment with published prices

Seeking ISO 42001 certification · Regulated sectors

Schellman Compliance, LLC

Relevant if you want ISO 42001 or ISO 27001 certification and also face US FedRAMP or CMMC rules

Seeking ISO 42001 certification · Regulated sectors

Sensiba LLP

Relevant if you want ISO 27001 or ISO 42001 certification and a SOC 2 report from one firm

Seeking ISO 42001 certification

SGS North America Inc.

Relevant if you need ISO 27001 or ISO 42001 certification in the US from a large certifier

Seeking ISO 42001 certification

SGS United Kingdom Limited

Relevant if you want UKAS-accredited ISO 27001 certification, with ISO 27701 privacy certification from the same body

Seeking ISO 42001 certification

Socotec Certification United Kingdom Limited

Relevant if you want UKAS-accredited ISO 27001 certification and do not need ISO 42001

Seeking ISO 42001 certification

TÜV UK Limited (TÜV NORD Group)

Relevant if you want an ISO 42001 certificate from a UKAS-accredited body that says it does not consult

Seeking ISO 42001 certification · Exposed to the EU AI Act · Regulated sectors · Switching provider

In a particular situation? First DPO or AI policy Seeking ISO 42001 certification After a breach or ICO contact Exposed to the EU AI Act Switching provider Regulated sectors After a ransomware or security incident

This is an independent editorial guide, not legal advice.

Advisory firms 80

Certification bodies 33

Software products 27