Consultancy agreement for a data protection consultant

A data protection consultant is engaged to tell a business how to comply with a regime the business remains accountable for, and where the consultant is appointed as its data protection officer the law gives the role an independence that the agreement has to respect. The document has to define the services, protect the DPO's position, control the consultant's access to the client's data, and keep decisions and accountability with the client. I prepare the agreement from either side for £595, a fixed fee, within five working days. Whether an individual is self-employed is checked case by case with HMRC's Check Employment Status for Tax tool, which no agreement can pre-empt.

Who this is for

Businesses in England and Wales engaging a freelance data protection consultant, an outsourced DPO or a privacy adviser for compliance programmes, audits, impact assessments or ongoing support, and consultants who want an agreement for every client.

What matters in a data protection consultant's agreement

The services and the DPO role

The agreement should define the services (a compliance review, records of processing, policies and notices, impact assessments, training, breach support, responding to data subject requests, acting as the client's point of contact with the Information Commissioner) by a schedule, and where the consultant is appointed as data protection officer, record the appointment under Article 37 of the UK GDPR, the tasks under Article 39, the client's obligation to involve the DPO in data protection matters and to publish the DPO's contact details, and the hours allocated to the role.

Independence, conflicts and the DPO's protections

Article 38 of the UK GDPR requires the DPO to be able to act independently, not to be instructed in the exercise of the tasks, not to be dismissed or penalised for performing them, and not to hold a role that conflicts with them, and an outsourced DPO's agreement should reflect that: no termination for advice the client dislikes, a termination right for the consultant where independence is compromised, and a statement that the consultant does not take decisions on the client's processing. The consultant may act for other clients, with confidentiality kept between them.

Access to data and the consultant's own processor position

The consultant sees the client's data when auditing, handling requests or investigating breaches, and the agreement should limit that access to what each task needs, contain the processor terms Article 28 of the UK GDPR requires for personal data the consultant processes on the client's behalf, state security under Article 32, address any transfers under Article 46 where the consultant works outside the UK, and impose confidentiality that survives the engagement; for its own records of advice the consultant is a controller under its own privacy notice.

Advice, decisions and the client's accountability

The agreement should say that the consultant advises and the client decides, that the client remains accountable for its processing under Article 5 of the UK GDPR and for its registration with the Information Commissioner, that the consultant's advice is based on the information provided and the law at its date, that documents the consultant produces are licensed to the client for its own use under the Copyright, Designs and Patents Act 1988 with templates retained, and that the consultant does not provide legal advice unless qualified to do so; recommendations the client declines should be recorded, because the record is the consultant's protection and the client's evidence of accountability.

Status, substitution and other clients

A data protection consultant with several clients, their own methods, premises and equipment, control over how the services are delivered and the right to use associates is an independent business, and the agreement should reflect it; The status determination for a company-based consultant engaged by a medium or large business belongs to that business under Chapter 10 of Part 2 of the Income Tax (Earnings and Pensions) Act 2003, applying HMRC's tool to what happens in practice.

Fees, termination, liability and cover

The agreement should state the retainer or day rate, the hours included, the interest the Late Payment of Commercial Debts (Interest) Act 1998 adds to invoices paid late, notice on both sides with a handover of the DPO function and records, and an aggregate cap tied to the annual fee that excludes consequential loss and is pitched to survive section 11 of the Unfair Contract Terms Act 1977, supported by professional indemnity insurance at a stated figure; penalties under the Data Protection Act 2018 are imposed on the controller, and the agreement should keep them there.

What it costs

Consultancy or contractor agreement, £595. Drafted for your business. Five working days.

Template set for repeat use, £895. One master agreement plus a short-form schedule you can reuse for every engagement. Five working days.

Buying online forms the engagement on payment. The scope is what the consultancy and contractor agreements page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A clear, express assignment of intellectual property to your business
• Confidentiality provisions that protect your business information
• Restrictive covenants drafted at a scope a court will uphold
• Clear treatment of status, so the arrangement is not accidentally something else
• Payment, deliverables and termination provisions that match how you work
• A reusable structure, so the next engagement costs you nothing

What is not included

• Employment status determinations and off-payroll working assessments, which need your accountant
• Tax advice
• Disputes with a contractor you have already engaged
• Immigration and right to work compliance

Questions I am often asked

Can we sack our outsourced DPO if we disagree with their advice?

Not for the advice. The UK GDPR protects a DPO from dismissal or penalty for performing the role, and the agreement reflects that with a termination right for the consultant where independence is compromised. You can end the engagement on notice for other reasons.

If the ICO fines us, can we recover from the consultant?

Regulatory penalties are imposed on the controller and the agreement excludes them from the consultant's liability. The consultant is liable for negligent advice within the cap and the professional indemnity insurance.

Does the consultant need a data processing agreement with us?

For the personal data the consultant handles on your behalf, yes, and the agreement contains the processor terms. For the consultant's own records of advice, they are a controller under their own notice.

Related guidance and services

• Consultancy and contractor agreements, £595, the service this page describes
• Data protection agreements and privacy terms, £795
• Contract review, £495
• Getting an AI-drafted data processing agreement checked
• Consultancy agreement for a cybersecurity consultant

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.