Case Studies & Evidence
Evidence From High-Consequence Governance Engagements
When regulatory exposure, patient safety, operational resilience or Board accountability is at stake, buyers need more than claims. They need credible evidence that an adviser can work within complex environments, produce decision-ready outputs and strengthen governance without creating unnecessary disruption.
Tell us the sector, service or procurement requirement you are assessing.
- Regulated Sectors
- Named & Anonymised Evidence
- Client Validation
- Decision-Ready Outputs
- Confidentiality Protected
Featured evidence
Three different engagement models
National strategic advisory · defined-scope enterprise assurance · retained international governance.
National data-privacy and information-governance advisory for NHS England
- What was at stake
- National publications and programmes affect patient data at population scale; IG failures carry significant public-trust and regulatory consequences.
- IG-Smart's intervention
- Strategic data-privacy and data-sharing advisory
Read Full EvidenceStrongest proof
National privacy-by-design framework · multiple national workstreams
A nationwide data-governance audit of an insurer's offsite records-storage supplier
- What was at stake
- Outsourcing storage does not outsource accountability: the insurer remained responsible for its clients' data in the supplier's hands.
- IG-Smart's intervention
- Supplier data-governance audit
Read Full EvidenceStrongest proof
Nationwide supplier audit
Retained external DPO service for a global pharmaceutical company's EU and LATAM operations
- What was at stake
- In pharmaceuticals, personal-data handling affects patient trust, operational integrity and regulatory standing across several jurisdictions with differing requirements.
- IG-Smart's intervention
- Retained external DPO service
Read Full EvidenceStrongest proof
Retained external DPO · EU & LATAM remit
Evidence library
All case studies
Showing 15 of 15 case studies
NHS England
Public Sector , Information Governance , Strategic & programme advisory
National data-privacy and information-governance advisory for NHS England
- Exposure
- National publications and programmes affect patient data at population scale; IG failures carry significant public-trust and regulatory consequences.
- IG-Smart role:
- Strategic data-privacy and data-sharing advisory
- Proof:
- National privacy-by-design framework · multiple national workstreams
Evidence available:
- Named client
- Engagement scope stated
- Deliverables described
AIG
Financial Services , Information Governance , Defined-scope assurance
A nationwide data-governance audit of an insurer's offsite records-storage supplier
- Exposure
- Outsourcing storage does not outsource accountability: the insurer remained responsible for its clients' data in the supplier's hands.
- IG-Smart role:
- Supplier data-governance audit
- Proof:
- Nationwide supplier audit
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
Glenmark Pharmaceuticals
Life Sciences / Pharmaceutical , Data Privacy & DPO , Retained / managed service
Retained external DPO service for a global pharmaceutical company's EU and LATAM operations
- Exposure
- In pharmaceuticals, personal-data handling affects patient trust, operational integrity and regulatory standing across several jurisdictions with differing requirements.
- IG-Smart role:
- Retained external DPO service
- Proof:
- Retained external DPO · EU & LATAM remit
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
UCL
Higher Education / Research , Information Governance , Defined-scope assurance
Information-governance audit and DSPT readiness for a leading research university
- Exposure
- Access to NHS data for research depends on demonstrating appropriate information governance through the Data Security and Protection Toolkit.
- IG-Smart role:
- IG audit, improvement plan, training and physical-security audit
- Proof:
- Helped shape and focus the final DSPT submission
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
Capgemini
Technology / SaaS / RegTech , Data Privacy & DPO , Training & capability
Certified Data Protection Officer training for senior consultants at a global consultancy
- Exposure
- Clients increasingly expect verified, certified data-protection expertise from their advisers.
- IG-Smart role:
- Executive certification training
- Proof:
- Participants report achieving PECB CDPO certification
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
Paul UK
Retail / Consumer , Data Privacy & DPO , Retained / managed service
A five-year retained DPO partnership for a bakery and restaurant chain
- Exposure
- Consumer brands handle customer and employee data across stores and digital channels; advice must be practical enough for operational teams to act on.
- IG-Smart role:
- Retained DPO service and gap analyses
- Proof:
- Retained 5+ years
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Long-term relationship
- Deliverables described
A FTSE 100 organisation
Cyber , Defined-scope assurance
Security maturity and audit readiness for a FTSE 100 organisation
- Exposure
- A third-party maturity assessment would test whether documented policy matched actual UK practice — gaps would be visible to assessors.
- IG-Smart role:
- Three-stage governance and audit-readiness plan
- Proof:
- Audit-ready UK policies ahead of a third-party maturity assessment
Evidence available:
- Anonymised engagement
- Role-attributed testimonial
- Engagement scope stated
- Deliverables described
The Co-operative Group
Retail / Consumer , Cyber , Retained / managed service
Routine penetration testing for a major national retailer and co-operative
- Exposure
- A changing digital estate needs continuing, consistent testing rather than one-off assessments.
- IG-Smart role:
- Routine penetration testing
- Proof:
- Preferred supplier relationship · 2+ years
Evidence available:
- Named client
- Engagement scope stated
- Long-term relationship
- Deliverables described
AIMIA Loyalty Solutions
Retail / Consumer , Data Privacy & DPO , Strategic & programme advisory
Global GDPR implementation and privacy-by-design for a loyalty-solutions business
- Exposure
- As a processor and controller of consumer data for major brand partners, the business needed to demonstrate a consistent, defensible standard of data protection across regions with differing practices — both to regulators and to the brands relying on it.
- IG-Smart role:
- Global GDPR implementation programme
- Proof:
- Global GDPR implementation programme
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
Nectar
Retail / Consumer , Data Privacy & DPO , Strategic & programme advisory
End-to-end GDPR implementation for a major UK consumer loyalty scheme
- Exposure
- The scale and visibility of the consumer database meant significant regulatory and reputational exposure, while the platform had to keep operating throughout implementation.
- IG-Smart role:
- GDPR implementation programme
- Proof:
- Full-cycle, multi-workstream GDPR programme
Evidence available:
- Named client
- Engagement scope stated
- Deliverables described
DAG Global (now Greengage)
Financial Services , Data Privacy & DPO , Defined-scope assurance
Data protection by design for a start-up digital merchant bank
- Exposure
- Building compliance in before launch was far less costly than retrofitting it — and the platform would face the scrutiny of financial regulators as well as data-protection law.
- IG-Smart role:
- Retained DPO service with wider specialist support
- Proof:
- Data protection by design for a digital merchant bank in development
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
Addvanced Solutions Community Network CIC
Charity / Social Enterprise , Cyber , Defined-scope assurance
Penetration testing and security assurance supporting a community organisation's compliance goals
- Exposure
- The organisation needed confidence in its technical defences while demonstrating compliance with GDPR, Cyber Essentials and the NHS Data Security and Protection Toolkit.
- IG-Smart role:
- Penetration testing and security assurance
- Proof:
- Network, application and wireless testing mapped to compliance obligations
Evidence available:
- Named client
- Named executive testimonial
- Engagement scope stated
- Deliverables described
A US-based global music and entertainment group with an active acquisition strategy
Media / Entertainment , Data Privacy & DPO , Retained / managed service
Repeatable governance integration for acquisitions at a global entertainment group
- Exposure
- Each acquisition brought different policies, controls and ways of working, introducing security risk and compliance friction for the group.
- IG-Smart role:
- Retained governance advisory
- Proof:
- Relationship since 2018 · M&A governance integration
Evidence available:
- Anonymised engagement
- Engagement scope stated
- Deliverables described
South West London Better Care Fund
Healthcare / NHS , Information Governance , Strategic & programme advisory
An information-governance framework for integrated health and social care across South West London
- Exposure
- Integrated care depends on professionals seeing the right records at the right time — lawfully, securely and consistently across bodies with differing requirements.
- IG-Smart role:
- Information-governance programme leadership
- Proof:
- Integrated-care data-sharing governance
Evidence available:
- Named client
- Engagement scope stated
- Deliverables described
A US-headquartered global pharmaceutical company with international operations
Life Sciences / Pharmaceutical , Data Privacy & DPO , Defined-scope assurance
Harmonising international data transfers for a global pharmaceutical company
- Exposure
- Conflicting regional data-protection regimes made international transfers complex, with regulatory, contractual and operational exposure.
- IG-Smart role:
- Cross-border data-transfer advisory
- Proof:
- International data-transfer governance
Evidence available:
- Anonymised engagement
- Engagement scope stated
- Deliverables described
What our engagements produce
Decision-ready outputs
The outlines below show how IG-Smart structures typical outputs. They are not client documents.
Representative IG-Smart structure — client information not shown
Independent audit report
Supplier, IG or security audit
An independent view of how controls operate in practice, with rated findings and recommendations.
- Used by:
- Risk, compliance and procurement leads; supplier owners
- Supports:
- Supplier assurance, remediation and contract decisions
- 01Scope and method
- 02Findings by control area
- 03Risk rating and rationale
- 04Prioritised recommendations
- 05Residual risk and owner
Representative IG-Smart structure — client information not shown
Prioritised improvement plan
Readiness for DSPT, ISO/IEC 27001 or audit
A sequenced plan that turns gaps into owned, evidenced actions.
- Used by:
- Programme owners, SIROs, IG and security leads
- Supports:
- Resourcing, sequencing and readiness decisions
- 01Current-state gaps
- 02Priority and dependency
- 03Owner and timescale
- 04Evidence required
- 05Progress tracking
Representative IG-Smart structure — client information not shown
Retained DPO advisory record
Outsourced or fractional DPO service
A running record of matters raised, advice given and the decisions taken.
- Used by:
- Legal, compliance and data-protection leads
- Supports:
- Accountability, consistent advice and regulator-ready records
- 01Matter raised
- 02Applicable requirement
- 03Advice and options
- 04Decision owner
- 05Follow-up
Representative IG-Smart structure — client information not shown
Board assurance summary
Board, committee or executive reporting
An executive-level view of material findings, residual risk and decisions requiring accountable-owner attention.
- Used by:
- Boards, Audit Committees, accountable executives
- Supports:
- Risk acceptance, remediation prioritisation and assurance decisions
- 01Assurance question
- 02Evidence reviewed
- 03Assurance opinion basis
- 04Exceptions and risk acceptance
- 05Decisions requested
Why clients appoint IG-Smart
Differentiation, proved through the portfolio
Senior practitioner involvement
Senior practitioners advise directly, including at national and executive level.
Evidenced in:
Retained specialist capability
Long-term, retained privacy capability for multinational and consumer businesses.
Evidenced in:
Enterprise assurance
Independent assurance for large organisations and their suppliers.
Evidenced in:
Regulated health environments
Information governance where NHS data and patient trust are at stake.
Evidenced in:
Independent, practical outputs
Audit findings, readiness plans and policies that teams can act on.
Evidenced in:
Confidentiality & controlled disclosure
Evidence without compromising client confidentiality
Some of IG-Smart's most sensitive engagements involve regulatory, operational, security, commercial or patient-safety information that cannot responsibly be published in full. Where necessary, examples are anonymised or withheld from public listing.
Additional evidence may sometimes be available, subject to:
- Confidentiality
- Client permissions
- Appropriateness for the buyer
- Procurement stage
- IG-Smart approval
Need evidence relevant to your requirement?
Tell us the sector, service or procurement requirement you are assessing.