How to vet a UK privacy measurement consultant

What to take away

Ask for the lawful basis for each measurement data flow before anyone opens a dashboard.
Check the company at Companies House, then check the individual's evidence separately.
Test one live question earlyhow would you measure this without consent?
Require a written data flow, a retention schedule and named people in the proposal.
Fix the first engagement to one deliverable, with exit terms agreed up front.

Where measurement advice meets UK GDPR

A privacy first measurement consultant in the UK should open with the lawful basis for each data flow, not with a tool list. Processing personal data needs a recorded basis, and the ICO's UK GDPR guidance explains that accountability duty directly. Read it before the first call. Ask whether the consultant acts as a controller for any processing of your data; where they do, use the ICO's data protection fee self-assessment and register of fee payers to check whether a fee is due.

Cookies and similar technologies also fall under the Privacy and Electronic Communications Regulations. The ICO sets out its expectations for tracking and direct marketing together, including what must happen before storage or access on a device.

Measurement that touches an identifiable person is data protection work first and analytics second. A GDPR marketing measurement consultant should be able to say which records count as personal data, how long each is kept, and who decides when it goes.

A vetting table for UK consultants

Use this in the first meeting and write down the answers. The weak column is common enough that it should be a prompt, not an instant rejection.

Area	Question to ask	Weak answer	Strong answer
Lawful basis	What is the lawful basis for each data flow, and where is it recorded?	“We will decide once the dashboard is set up.”	Identifies the basis for each flow and shows where the decision and reasoning are documented.
Consent and PECR	How would you measure this without consent?	“Legitimate interests means consent is never needed,” or “hashing makes the data anonymous.”	First checks whether personal data or device storage or access is involved. Where PECR consent is required, they do not propose tracking before consent; they explain any genuinely aggregate or otherwise suitable alternative and its limits.
Data flow	What data is collected, where does it go, who can access it, and how long is it kept?	“The platform handles that.”	Maps sources, data, recipients and roles, access, purpose and retention in a written flow record.
Identity and evidence	Who will do the work, and what evidence supports their experience?	“The company has done this before,” with no named people or examples.	Names the people doing the work and provides relevant, appropriately redacted evidence.
Method	How will you answer the measurement question while limiting data use?	“We will collect everything and see what is useful.”	Explains the proposed method, what it can and cannot show, and how it avoids unnecessary or identifying detail.
Exit	What will we receive and what happens when the engagement ends?	“We can sort that out later.”	Agrees deliverables, export formats, access removal and dates in writing.

Vetting UK measurement consultants

Weak answer

Lawful basis: Nothing written down
Consent: The banner covers it
Data flow: Dashboard screenshot
Identity: Client logo slide
Method: One method every brief
Exit: We hand everything over

Strong answer

Lawful basis: Basis per flow, recorded
Consent: States pre-choice firing
Data flow: Written flow, roles, retention
Identity: Company number, named staff
Method: Method chosen, limits stated
Exit: Formats, access removal, dates

Score each row as answered, partly answered or unanswered. Three blanks usually means the candidate is not ready for paid work, whatever the presentation looked like.

Documents to request before you sign

Request these five items in writing and read them as a set:

A measurement design showing the data flow, purposes and roles.
The recorded lawful basis for each relevant flow, including the consent position where PECR applies.
A retention schedule and deletion arrangements.
A redacted example of relevant work, such as a report or output, with enough context to understand the method.
The names of the people who will do the work and evidence of their relevant experience.

A missing item is a gap in the proposal, not a small detail.

Five documents to request

Design showing where personal data moves
Lawful basis for each flow, reasoning filed
Deletion schedule for logs and exports
One redacted comparable work example
Names of people doing the work

Check the legal entity before the person. Companies House holds the registered name, number and filing history for a limited company, and a search takes minutes.

Then ask for a measurement data flow record that names roles and retention. That document decides whether the numbers can be defended two years later.

Where an independent consultant differs from an agency

Independent privacy measurement advisors in the UK usually sell judgement and time rather than a platform licence. That suits a question about what to measure. It is weaker when you need engineering hours at short notice.

Ask who does the implementation, who owns the code, and what happens if the consultant is unavailable for a fortnight. Agencies absorb that risk with staff. A sole trader must name a substitute. Ask for the deputy's name, relevant skills, availability, authority to act, access and handover arrangements, and how the client will be told if the deputy is needed.

A privacy attribution consultant based in England may work remotely for a team in Scotland or Wales. Data protection rules apply across the UK, so location matters less than the evidence in the proposal.

Commercial terms and exit

Fix the first engagement to one deliverable: a measurement design, a written data flow or a controlled test result. Open-ended retainers hide unclear scope, and two of them cannot be compared.

First deliverable decision test

Did the first deliverable change a decision?

Yes

second phase may start

second phase should not start

Put the exit in the contract at the start. Name the scope and deliverables, how changes are agreed, payment terms, data protection roles and instructions, confidentiality, security, code and other intellectual property ownership, and any subcontracting arrangements. Exports, formats, access removal and dates belong there, not in a farewell email. Our guide to measurement contract questions names the clauses worth arguing about now.

If the first deliverable does not change a decision, the second phase should not start.

Common questions

Do I need a consultant who is also a lawyer?

No. You need someone who describes the processing accurately and knows when to send a question to a solicitor. Good candidates name that boundary without being asked.

What should the first deliverable be?

A written measurement design with the data flow attached. It is cheap to review, it exposes weak thinking, and it gives you something to test the next proposal against.

How do I compare an independent with an agency?

Ask both for the same three things: named people, the data flow and the exit terms. Compare the answers rather than the pitch. A larger provider is not automatically safer.

What does a fair fee look like?

There is no single day rate that establishes whether a fee is fair. Ask for the day rate, estimated days and any expenses against a defined deliverable, then compare proposals on the same scope, named team, evidence and exit terms. Consider what is included and what would trigger extra work before agreeing.