How much does an outsourced DPO cost, and what does it cover?

How do firms charge for DPO, data protection and security work?

The published prices in this guide take three forms: a monthly retainer, a day rate or a project fee. A retainer buys set DPO hours or services each month. Athlex sells 2 hours a month for £350 plus VAT, or 7 hours for £950 plus VAT.

With a day rate, you pay for each day a consultant works. Arcanum, a cyber security firm, lists day rates of £800, £950 and £1,200 plus VAT, by grade, with travel and subsistence charged on top at the buying department's standard rates. They come from its G-Cloud 14 pricing document (version 5.0), whose file name carries the date 7 May 2024. The document does not mention DPO work.

G-Cloud is a catalogue that UK public sector bodies and charities use to buy cloud services. G-Cloud 14 runs until 28 October 2026, when G-Cloud 15 replaces it.

A project fee covers one defined piece of work, such as a gap analysis, which checks where you fall short of a standard. Kafico prices a gap analysis against ISO 27001, the international standard for managing information security, from £1,000, depending on scope, and says a full certification project typically starts from £10,000.

Does a DPO retainer include breach response?

A DPO retainer does not always include breach response. DPO-Service's Professional Plan includes help with security incidents and data breaches. GRC Solutions' DPO as a Service gives guidance on breach reporting, but the reporting itself is not included. Ask which kind you are buying before you sign.

UK GDPR, the UK's main data protection law, sets the deadline. You must report a breach to the Information Commission (the ICO), the UK data protection regulator, without undue delay. Where you can, report within 72 hours of becoming aware of it. You need not report a breach that is unlikely to put people at risk.

Help with a breach is simpler to agree at the start than in the 72 hours after you find one.

How much time does a monthly fee buy?

The time a monthly fee for an outsourced DPO buys depends on the plan, so check the hours. Athlex's lowest plan buys 2 hours a month and is aimed at small, low-risk businesses. Athlex counts help with a reply to the ICO against those hours, and sells extra hours.

The ICO says you must give your DPO enough resources, including enough time, to meet the duties set by UK GDPR. A low fee with a small hour cap can cost more in a busy month.

Which providers publish a price?

32 of the 140 UK and US providers The Assurance Desk checked between July and October 2026 publish a price. They publish it on their own website or on a UK government G-Cloud listing. The list of providers that publish a price shows them. A published price is a starting point, not a quote.

Why do some firms quote instead of publishing a price?

Two firms that do not publish a price for an outsourced data protection officer (DPO) say the price depends on your organisation. The DPO Centre says it depends on how complex your data is and what your organisation needs. GRC Solutions asks you to request a tailored quote.

GRC Solutions publishes prices for its documentation toolkits, but shows no figure for its DPO service. Because of those toolkit prices, GRC Solutions is on our list of providers that publish a price.

What should you get in writing?

Get the charges for DPO or data protection work, and what the fee covers, in writing. Bratby Law says its fees are usually fixed or capped, and agreed before work begins. It says it talks through any change of scope with you before it charges more.

What if you want to switch provider later?

Before you switch DPO provider, check the minimum term and notice period. GRC Solutions sets a one-year minimum term for its DPO service, and the balance stays payable if you cancel in the first year. DPO-Service runs a rolling monthly contract with 30 days' notice and says there are no setup fees or exit charges.

Plan the handover before giving notice: ask the outgoing firm for your records, registers and a list of open work. See what to check when you switch.

What to do

1. Check whether you need a DPO at all with do you need a DPO?, and read first appointment if it is your first.
2. If you ask for quotes, ask each firm to price the same scope and to say what the fee covers.
3. Confirm whether each price includes VAT and travel.
4. Check the minimum term and the notice period.

Common questions

Can an outside firm be your DPO?

Yes. UK GDPR says a DPO can work under a service contract, and the ICO says an outside DPO should have the same position, tasks and duties as one on your staff.

Do you have to appoint a DPO?

Only in some cases. UK GDPR requires one for most public bodies, and where your core work involves, on a large scale, monitoring people regularly and systematically, or handling sensitive data or data about criminal convictions.

Do unused retainer hours roll over?

Not usually, at Athlex, the only firm in this guide that says. Unused hours there do not usually roll over from one month to the next. Get each firm's answer in the contract.

Where next

• First DPO or AI policy
• Switching provider
• After a breach or ICO contact
• Do you need a data protection officer? UK GDPR sets three tests
• Day rate or retainer: how do consultants charge?
• How much does data protection software cost per year?

This is an independent editorial guide, not legal advice.