Expenditure on external data protection and compliance consultants / contractors over 5 yr
Case reference FOI2025/01322
Received 4 July 2025
Published 25 September 2025
Request
Please detail the expenditure you have spent on external data protection and compliance consultants / contractors over the last 5 years. Please detail the task they completed and the cost to your business. These tasks could include but not be limited to: data processing / sharing agreements, privacy notices, contracts, policy review / writing, consent mechanisms, ROPS, DPIA, audits, privacy advice, breach responses etc.
Response
From September 2022 to the end of February 2024 National Highways (NH) spent £111,341.90 on external data protection and compliance contractors.
They were employed to respond to subject access requests, assist with the updating of the Record of Processing Activities (RoPA), assist with gaining an understanding of the scope and compliance level of existing Data Sharing Agreements across the NH, assist in improving the efficiency of the Privacy Notice process to meet statutory obligations to inform individuals how their personal information is used by NH and assist in meeting our strategic aim of embedding Privacy by Default and Design across all National Highways processes and project frameworks.
Documents
This is National Highways' response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.