UCL
Information governance assessment and readiness
Work with UCL's School of Life and Medical Sciences, including governance assessment, readiness and training.
Explore the UCL engagementHigher Education & Research
Data Governance, Privacy & Assurance for Higher Education and Research
Strengthen governance around research, institutional data and collaboration, with senior-led support for privacy, information governance and defensible assurance.
View Relevant Case Studies Not sure where to start? Tell us what you need to decide or resolve.
Relevant experience
Experience that reflects research and institutional complexity
Explore our published work with universities and research programmes.
Liverpool John Moores University
NHS DSPT support in a university setting
Annual DSPT support for the School of Nursing and Allied Health; the engagement was departmental, not university-wide.
Explore the LJMU engagement
NIHR
Governance for biomedical research collaboration
Governance framework work involving the five original Biomedical Research Centres.
Explore the NIHR engagement
Client voices
What clients in this sector say
“We first came across, and were impressed with, IG Smart’s work with one of our partner organisations. This gave us the confidence to choose IG Smart to perform an internal audit and assess our readiness for the DSP Toolkit. IG Smart were able to work with us and produce a report that clearly indicated areas to prioritise. The report provided insight that helped shape and focus our final DSP Toolkit submission.”
Trevor PeacockHead of Information Governance, UCL “From the get-go we were confident you could support the work we do in the University and improve our information governance processes when faced with new challenges.”
Lorraine ShawHead for Nursing, School of Nursing and Allied Health, Liverpool John Moores University
When institutions call us
When research moves faster than governance
Common reasons to seek support include:
Research collaborations
A new collaboration needs clear data-sharing arrangements.
Privacy assessments
Research or institutional processing needs a privacy assessment.
Assurance requirements
A departmental assurance requirement needs reliable evidence.
Accountability across teams
Ownership and reporting are unclear across teams or partners.
How we think
Make the research decision defensible
A useful governance review connects the purpose of the work with clear ownership, the data involved, the safeguards and the evidence behind the decision. These are connected review lenses, not a compulsory sequence or an accredited methodology.
Purpose
Why the work is needed and what it aims to achieve.
Ownership
Who is responsible for decisions, delivery and oversight.
Data use
What data is involved and how it is used and shared.
Safeguards
Appropriate technical and organisational measures.
Evidence
Proportionate and reliable evidence for the relevant scope.
Our published NIHR work produced an information-governance framework across the five original Biomedical Research Centres.
How we help
Start with the requirement, not the service catalogue
- Understand governance gapsInformation Governance ConsultancyReview ownership, policies and supporting evidence.
- Strengthen privacy arrangementsUK GDPR ConsultancySupport privacy governance and DPIA requirements within the agreed scope.
- Add continuing specialist capacityOutsourced & Fractional DPOExplore a scoped DPO or privacy-office engagement.
- Address a relevant NHS assurance requirementNHS DSPT Readiness & AssuranceSupport the applicable departmental or organisational scope.
What you receive
Evidence your teams can use
Depending on the agreed scope, an engagement can produce:
- Prioritised findingsTo focus remediation and decisions.
- Governance framework and accountabilitiesTo clarify responsibilities.
- Data-sharing or privacy documentationTo support the agreed arrangements.
- Readiness and supporting evidenceTo organise applicable assurance requirements.
- Management reportingTo communicate material gaps and decisions.
Working with us
Proportionate, stage by stage
An engagement uses the stages appropriate to its scope. Our delivery architecture runs Assess → Build → Manage → Assure → Improve; not every engagement includes all five.
Assess
Review current policies, ownership and evidence against the applicable requirement.
Build
Develop frameworks, agreements and evidence where gaps are material.
Manage
Provide continuing support where the institution commissions it.
Assure
Review controls and supporting evidence, with the review arrangements and any independence requirements agreed in the scope.
Defined engagement
A scoped assessment, readiness review or governance programme.
Managed or retained support
Continuing specialist governance capacity where commissioned.
Scope and responsibilities
What we can support
- Governance and evidence review
- Agreed frameworks and documentation
- Senior advisory input and reporting
What remains with your organisation
- Decisions, resources and approvals
- Research responsibilities
- Implementation commitments
This support does not replace research ethics approval or certification. Technical profiling, cleansing, platform development and lineage implementation are included only where specifically evidenced, resourced and agreed. DSPT applicability depends on the actual scope.
Requirements organisations commonly encounter
Depending on the organisation, its activities and jurisdiction, relevant requirements may include:
- UK GDPR and the Data Protection Act 2018
- NHS Data Security and Protection Toolkit (DSPT), where an organisation has access to NHS patient data and systems
- Data-sharing agreements and partner or funder conditions on research data
- ISO/IEC 27001, where partners require it
Buyer questions
Questions before you engage
Can you support a research collaboration involving several organisations?
Yes. We agree the scope around the organisations, data flows and governance questions involved. Our NIHR work developed a framework that enabled data sharing across several Biomedical Research Centres, with each partner keeping its own accountability.
Can you work alongside our DPO and research governance team?
Yes. We work with existing DPOs, information-governance leads and research offices, adding senior capacity or specialist review within an agreed scope.
Does every university need to complete the NHS DSPT?
No. The DSPT applies to organisations with access to NHS patient data and systems, so it is often relevant to a specific school, unit or partnership rather than a whole institution. We confirm applicability before proposing readiness work.
What information would you need from us?
Usually a short description of the requirement, the schools or partners involved, any deadline and the existing policies or evidence. We confirm what else is needed when scoping.
How are scope, deliverables and fees agreed?
Defined projects and continuing support are scoped to the requirement and confirmed in a written proposal. Published starting and typical investment bands are on our How We Work page.
View Michael’s profileMichael Abtar
Founder & CEO · Service lead
Senior-led support informed by published university and research governance engagements.
For procurement teams:Engagement modelsTrust CentreRequest relevant evidence
Bring clarity to your next research or institutional decision
Tell us what you need to decide or resolve, or share a defined requirement for review.