# Data protection, AI governance and cyber security, explained in plain terms. *Data protection. AI governance. Cyber security.* The Assurance Desk is a news provider for the whole data protection, AI governance and cyber security sector. It explains the rules, the standards and the firms in plain terms. [Read the guides](https://theassurancedesk.com/guides.md) ## Latest news - [Which websites did AI cite on AI governance?](https://theassurancedesk.com/news/ai-answers-ai-governance-sources-october-2026.md): AI governance, 13 October 2026. Our October snapshot shows which websites appeared in answers to selected UK questions about AI governance. - [The ICO led our data protection citation snapshot](https://theassurancedesk.com/news/ai-answers-data-protection-sources-october-2026.md): Data protection, 13 October 2026. The regulator appeared most often in our October answers to selected UK questions about data protection help. - [Which websites did AI cite on ISO certification?](https://theassurancedesk.com/news/ai-answers-iso-certification-sources-october-2026.md): AI governance, 13 October 2026. Our October snapshot shows which websites appeared in answers to selected UK questions about ISO certification. ## [Data protection](https://theassurancedesk.com/data-protection.md) What UK GDPR asks of your organisation, from whether you need a data protection officer (DPO) to reporting a breach. - [Do you need a data protection officer?](https://theassurancedesk.com/guides/do-you-need-a-dpo.md) - [How outsourced DPO services are priced](https://theassurancedesk.com/guides/how-dpo-and-data-protection-services-are-priced.md) - [What to do after a personal data breach](https://theassurancedesk.com/best/post-breach.md) ## [AI governance](https://theassurancedesk.com/ai-governance.md) What an AI policy covers, when the EU AI Act reaches a UK business, and what ISO 42001 is. - [Does your UK business need an AI policy?](https://theassurancedesk.com/guides/the-ai-governance-gap.md) - [When the EU AI Act reaches a UK business](https://theassurancedesk.com/best/eu-ai-act-exposed.md) - [What ISO 42001 is](https://theassurancedesk.com/glossary.md#iso-iec-42001) ## [Cyber security](https://theassurancedesk.com/cyber-security.md) What Cyber Essentials and ISO 27001 involve, and what UK law asks after a cyber attack. - [What Cyber Essentials is](https://theassurancedesk.com/glossary.md#cyber-essentials) - [Who can certify you to ISO 27001](https://theassurancedesk.com/best/certification-seeking.md) - [The first days after a ransomware attack](https://theassurancedesk.com/best/security-incident.md) ## Start with a guide - [Does GDPR apply to small businesses and sole traders?](https://theassurancedesk.com/guides/gdpr-small-business-sole-trader.md): Start with the personal data you hold, then check your duties, fee and need for a DPO separately. - [Do you need a data protection officer? UK GDPR sets three tests](https://theassurancedesk.com/guides/do-you-need-a-dpo.md): Ask this before you hire anyone, because the answer changes what you need to buy. - [What is AI governance, in plain words?](https://theassurancedesk.com/guides/what-is-ai-governance.md): Give people a clear way to choose, use and check AI at work. - [Who can write your AI policy?](https://theassurancedesk.com/guides/who-can-write-your-ai-policy.md): Choose a writer who can turn the way your team works into rules people can use. - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md): Know what the fee buys before you book an assessment or pay for help. - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md): A clear response connects each answer to the service, the evidence and any work still to do. [All guides](https://theassurancedesk.com/guides.md) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price.md): A published price lets you see a figure before you speak to a firm, and this list gives every one we found. - [Glossary](https://theassurancedesk.com/glossary.md): The industry's words in plain English ## Which of these is your situation? Each page explains one common situation, such as a first DPO, a new certificate or a data breach. - [Do we need a DPO?](https://theassurancedesk.com/best/first-appointment.md) - [Getting certified](https://theassurancedesk.com/best/certification-seeking.md) - [The EU AI Act reaches us](https://theassurancedesk.com/best/eu-ai-act-exposed.md) - [After a breach](https://theassurancedesk.com/best/post-breach.md) - [Switching provider](https://theassurancedesk.com/best/switching-provider.md) - [Our sector’s rules](https://theassurancedesk.com/best/sector-regulated.md) - [Ransomware](https://theassurancedesk.com/best/security-incident.md) ## How the industry works Knowing who does which job tells you where to look for an answer, in the UK and the US. [Read how the industry works](https://theassurancedesk.com/the-market.md) **Who does what** - **Regulators and public bodies**: Enforce the law, or give official guidance (the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO) and the NCSC in the UK, the FTC in the US) - **Accreditation bodies**: Check that certification bodies are competent and impartial (UKAS in the UK, ANAB and IAS in the US) - **Certification bodies**: Audit a business against a standard and issue the certificate (for ISO 27001, ISO 42001 or Cyber Essentials) - **Advisers**: Help you understand the rules and get ready (consultancies, outsourced data protection officers, law firms) - **Software makers**: Help you keep records, run checks and show your work (privacy, AI governance and compliance platforms) - **Professional bodies**: Train people and issue credentials (the IAPP, ISACA, ISC2 and BCS) Six kinds of organisation, and the main job each one does. Source: UK commencement regulations, S.I. 2026/1015, https://www.legislation.gov.uk/uksi/2026/1015/made (checked 29 September 2026); the FTC, https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security (checked 29 September 2026); UKAS, accreditation and certification, https://www.ukas.com/accreditation/about/accreditation-vs-certification/ (checked 29 September 2026); the IAPP, https://iapp.org/about/ (checked 29 September 2026); the NCSC, https://www.ncsc.gov.uk/section/about-ncsc/what-we-do (checked 29 September 2026); ANAB, https://anab.ansi.org/ (checked 29 September 2026); IAS, about IAS, https://www.iasonline.org/about-ias/ (checked 29 September 2026); IAS, management system certification bodies, https://www.iasonline.org/services/management-systems-certification-bodies/ (checked 29 September 2026); the NCSC, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 29 September 2026); ISACA, CISM, https://www.isaca.org/credentialing/cism (checked 29 September 2026); ISC2, CISSP, https://www.isc2.org/certifications/cissp (checked 29 September 2026); BCS, Practitioner Certificate in Data Protection, https://www.bcs.org/qualifications-and-certifications/certifications-for-professionals/information-security-and-data-protection-certifications/bcs-practitioner-certificate-in-data-protection/ (checked 29 September 2026) Each of these is sourced and dated on [How the industry works](https://theassurancedesk.com/the-market.md). ## How we score each provider We score every provider in the directory on the same six questions, using public sources. - **Does the firm help when something goes wrong?** Whether it publishes how it supports clients through a breach or a regulator's enquiry. - **Who does the work, and what qualifications do they hold?** Named staff with qualifications you can check or, for a certification body, accreditation from UKAS in the UK or ANAB in the US. - **How does the firm charge for its work?** Whether prices or day rates appear on its website, and what the fee covers. - **Does the firm know your sector?** Named specialists and published work in sectors such as health, financial services or education. - **Is the advice separate from anything it sells?** Whether its advice is tied to a product it sells, and whether it names its partners. - **Who carries the risk if the advice is wrong?** Whether it holds professional indemnity insurance, and what its terms say about liability. - [Browse the providers](https://theassurancedesk.com/advisers.md) - [A list of providers that publish a price](https://theassurancedesk.com/lists/providers-that-publish-a-price.md) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.