Data Privacy & Information Governance
18+ yearsSenior practitioner experience
Global audit deliveryInternational assurance and audit experience
Selected published client evidenceNHS England · UCL · AIG
ISO/IEC 27001:2022Certified information-security management
Ongoing information-governance capability, not a periodic clean-up — with defined-scope work available where the operating model or baseline first needs to be established.
Best suited to regulated, multi-entity, multi-site or public-sector-facing organisations that need information governance to operate consistently across teams, records and systems.
Senior-led and coordinated by a named service team, shown below.
When organisations engage us
Information governance relies on one person or goodwill
Records, retention and information-asset ownership are unclear
Information risks are not reported to senior leadership
Audit, contract or assurance requirements keep recurring
Several business units handle information differently
Incidents or near misses reveal gaps in control
What the service covers
How we deliver
Assess
Baseline IG maturity, risks and evidence.
Build
Agree the IG model, priorities and reporting rhythm.
Manage
Run ongoing oversight, advice and issue governance.
Assure
Evidence control and progress for leadership and auditors.
Improve
Refresh priorities as the organisation and risks change.
Scope boundaries
Sample outputs
Illustrative examples of the reports, registers, dashboards and working records that may be provided, depending on scope.
Illustrative output
Ongoing control visibility
A recurring view of ownership, retention and information-risk actions.
What it helps you see and do
Likely format
Illustrative output
Accountability
Every key information asset with an accountable owner and review date.
What it helps you see and do
Likely format
Illustrative output
Control improvement
Where lifecycle control is incomplete, and what will close the gap.
What it helps you see and do
Likely format
Illustrative output
Executive oversight
A committee-ready view of information risk and progress.
What it helps you see and do
Likely format
Illustrative structure — not a client document. Exact outputs and formats depend on the agreed scope.
Relevant evidence
Named client · Healthcare / NHS
Strategic data-privacy and data-sharing advisory
National privacy-by-design framework · multiple national workstreams
Named client · Higher Education / Research
IG audit, improvement plan, training and physical-security audit
Helped shape and focus the final DSPT submission
Named client · Financial Services
Supplier data-governance audit
Nationwide supplier audit
Your IG-Smart team
Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.
Subject-matter expert
CEO and Founder
Governance, risk and assurance specialist with more than 18 years' experience spanning privacy, cyber resilience, AI governance, digital transformation, healthcare and complex regulated organisations.
Experience includes governance and assurance work involving more than 100 million consumer records.
View profile
Subject-matter expert
Senior Data Privacy & Information Governance Consultant
Privacy and information governance specialist advising organisations on data protection, DPO responsibilities and practical governance across healthcare and regulated environments.
View profile
Client & programme contact
Head of Client & Programme Success
A key point of contact from prospective-client scoping through programme and project delivery, coordinating practitioners, workstreams and client stakeholders.
View profileInvestment
Delivered as a managed & retained service. Scope, deliverables, assumptions and fees are agreed in writing before work begins.
Talk to a Senior Practitioner How engagements & investment work
Questions
An assessment is a defined-scope review of where you stand. Managed Information Governance provides continuing oversight and support so improvements are sustained.
It covers the governance that data protection depends on. Where formal DPO oversight or a privacy programme is needed, it can be combined with those services with responsibilities kept distinct.
Yes, it can support the governance behind NHS requirements. Where a DSPT submission needs dedicated readiness or assurance work, that is scoped as NHS DSPT Readiness & Assurance.
Next step