Off The Record
Proportionate Information Governance framework
After implementing IG-Smart's recommendations, the charity earned the NHS Digital Toolkit kite-mark, as reported by its trustee.
Read the case studyCharities & Community Interest Companies
Data Protection, Information Governance & Cyber Assurance for Charities and Community Interest Companies
Protect the people you serve with governance sized to your organisation — practical enough for a small team, robust enough for NHS partners, funders and commissioners.
View Relevant Case Studies Not sure where to start? Tell us what you need to decide or resolve.
Relevant experience
Published work with charities and community interest companies
Our published work includes charities supporting young people, a hospice charity, a community interest company and an NHS trust whose managed service also covered its hospital charity. Each case study states what IG-Smart did and what the client reported.
Brandon Centre
GDPR and Information Governance gap analysis
GDPR and Information Governance assessed against relevant NHS good practice, with a prioritised improvement plan and implementation support.
Read the case study
The Myton Hospices
NHS IG Toolkit compliance and retained support
Level 2 compliance in under two months, as reported by the hospice; retained annually for advice, support and training.
Read the The Myton Hospices case study
Addvanced Solutions Community Network CIC
Managed vCISO service and penetration testing
A community interest company: ongoing vCISO service, penetration testing and findings mapped to GDPR, Cyber Essentials and the DSPT.
Read the Addvanced Solutions Community Network CIC case study
Royal Brompton & Harefield
Managed IG across the Trust, its private care arm and charity
The three-year managed service scope also covered RB&HH Specialist Care and Royal Brompton & Harefield Hospitals Charity.
Read the Royal Brompton & Harefield NHS Foundation Trust case study
Client voices
What clients in this sector say
“Michael and his team devised for Off The Record an Information Governance framework that is wholly appropriate both to the size of our charity, and to the essential services we provide to young people.”
Phil ChecklandTrustee, Off The Record“IG Smart worked alongside us to audit our practice, prepare our evidence, identify gaps and build an action plan to enable us to become level 2 compliant, which we achieved (with a lot of hard work!) in under two months.”
David PrattDirector of Strategy & Business Development, The Myton Hospices“They have developed key frameworks that have left our Information Governance processes at the Royal Brompton in a manageable state. IG Smart Ltd proved to be a safe pair of hands to partner with.”
Graham EversonDirector of IM&T (at the time), Royal Brompton & Harefield NHS Foundation Trust
When charities and CICs call us
When sensitive data meets a small team
We typically work with charities, hospices, community interest companies and social enterprises — usually through a chief executive, trustee, operations lead or the person responsible for data protection.
An NHS contract or partner needs assurance
Commissioners or NHS partners expect a Data Security and Protection Toolkit submission or equivalent evidence.
Sensitive data about vulnerable people
Records about young people, patients or beneficiaries need handling that is safe, lawful and proportionate.
Governance must fit the organisation
Policies and controls designed for large organisations are too heavy for a small team to sustain.
Cyber risk with limited in-house expertise
Systems, devices and suppliers need testing and oversight without a full-time security function.
Our approach
Proportionate governance, not paperwork
A charity's governance should match its size, its services and the people it supports. These are the dimensions an engagement can review; historic deliverables are described in the case studies.
People served
What information is held about beneficiaries, and the safeguards it needs.
Obligations
Which requirements apply — UK GDPR, NHS Toolkit, funder or commissioner conditions.
Capacity
What the team can realistically operate and maintain.
Controls
The policies, processes and technical measures that close material gaps.
Evidence
The records that show trustees, partners and regulators the position.
Off The Record's trustee described the framework IG-Smart devised as wholly appropriate to the size of the charity and to the services it provides to young people.
How we help
Start with the requirement, not the service catalogue
- Complete or improve your DSPT submissionNHS DSPT ReadinessEvidence and support for charities that deliver NHS-funded services or handle NHS data. Published examples: The Myton Hospices, Off The Record.
- Build a proportionate governance frameworkData & Information Governance ConsultancyGap analysis, frameworks and improvement plans sized to the organisation. Published examples: Brandon Centre, Off The Record.
- Keep governance running each yearManaged Data & Information GovernanceContinuing advice, support and training within an agreed scope.
- Access DPO expertise without a full-time hireOutsourced & Fractional DPOStatutory or voluntary DPO support scaled to the organisation.
- Test and oversee cyber securityPenetration TestingTechnical testing with findings mapped to the frameworks you report against. Published example: Addvanced Solutions Community Network CIC; an evidence letter is available on request.
What you receive
Evidence your teams can use
Depending on the agreed scope, an engagement can produce:
- Gap analysis and improvement planA prioritised view of where governance falls short and what to fix first.
- Proportionate governance frameworkPolicies and procedures a small team can operate.
- DSPT evidence and action planSupport to prepare evidence and close gaps before submission.
- Penetration test findingsTechnical findings mapped to compliance obligations.
- Training and retained adviceStaff awareness and senior input as requirements change.
Working with us
Proportionate, stage by stage
An engagement uses the stages appropriate to its scope. Our delivery architecture runs Assess → Build → Manage → Assure → Improve; not every engagement includes all five.
Assess
Review current practice against the requirements that apply.
Build
Develop a proportionate framework, evidence and action plan.
Manage
Provide retained advice, support and training where commissioned.
Improve
Refine arrangements as services, partners and requirements change.
Defined engagements
Assessment, audit, readiness, remediation, assurance and defined programmes.
Managed & retained capability
Ongoing specialist governance and assurance where continuity matters.
Scope and responsibilities
What we can support
- Data protection and information governance
- NHS Toolkit readiness
- Penetration testing and cyber oversight
What remains with your organisation
- Trustee decisions and risk acceptance
- Implementation by your team
- Submission of your own DSPT
Toolkit status and certification decisions rest with the relevant body. IG-Smart supports readiness and evidence; it does not award accreditation.
Requirements organisations commonly encounter
Depending on the organisation, its activities and jurisdiction, relevant requirements may include:
- UK GDPR and the Data Protection Act 2018
- NHS Data Security and Protection Toolkit, where NHS data or contracts apply
- Cyber Essentials, where funders or contracts require it
- Privacy and Electronic Communications Regulations (PECR) for fundraising communications
Buyer questions
Questions before you engage
We are a small charity. Is this proportionate for us?
Yes. Our published charity work includes frameworks designed around the organisation's size and services. Scope is agreed to the requirement and your team's capacity.
Can you help us complete the DSPT?
Yes. Our published charity and hospice cases include Toolkit evidence preparation, gap analysis and action planning. Submission remains the organisation's responsibility.
Do you work with community interest companies?
Yes. Our published work includes an ongoing vCISO service and penetration testing for a community interest company.
Can you support us every year, not just once?
Yes. Retained advice, support and training can be agreed within a defined scope.
How are scope, deliverables and fees agreed?
Defined projects and retained support are scoped to the requirement and confirmed in a written proposal. Published investment bands are on our How We Work page.
View Michael’s profileMichael Abtar
Founder & CEO · Service lead
Leads IG-Smart's published charity and community-organisation engagements.
For procurement teams:Engagement modelsTrust CentreRequest relevant evidence
Bring clarity to your next governance decision
Tell us what you need to decide or resolve, or share a defined requirement for review.