Skip to main content

Data Privacy & Information Governance

Data & Information Governance Consultancy

IG-Smart helps regulated organisations design and operate information governance models that connect accountability, records lifecycle, policies, decision-making and assurance — so important information is managed deliberately rather than through fragmented local practice.

The problem is usually not absence of documentation. It is absence of an effective governance system.

View information governance evidence — View Relevant Evidence

When organisations engage us

When organisations engage us

  • Governance redesign

    Existing arrangements have grown organically and ownership is unclear.

  • Regulatory or audit findings

    Recurring weaknesses indicate a governance problem rather than an isolated control failure.

  • Organisational change

    Merger, acquisition, restructuring, new technology or outsourcing has changed how information is owned or managed.

  • NHS / healthcare requirements

    Information governance must align with sector-specific records, privacy, assurance and clinical governance expectations.

  • Growth into regulated markets

    Informal practices no longer provide sufficient evidence or executive assurance.

  • Records remediation

    Legacy information, inconsistent retention or uncontrolled repositories require structured intervention.

  • Board assurance requirement

    Leadership needs a reliable picture of risk, remediation and residual exposure.

What we help solve

Information risk rarely comes from one missing policy

In most organisations, information-governance problems build up gradually. They commonly arise because:

  • responsibilities are distributed but unclear;
  • policies have accumulated without coherent ownership;
  • retention decisions differ between teams and systems;
  • committees receive activity reports instead of risk information;
  • privacy, security, records and operational governance work in parallel;
  • legacy information is retained without a defensible business or regulatory basis;
  • important decisions are made but not consistently recorded;
  • audit findings recur because governance causes are not addressed;
  • ownership becomes unclear when systems, suppliers or business models change.

What changes for your organisation

Build governance that works in practice

  • Governance Operating Model

    Define how information decisions are made, who owns them, who provides oversight and how issues escalate.

  • Records & Information Lifecycle

    Establish proportionate governance from creation and use through retention, archival and defensible disposal.

  • Policy & Control Framework

    Replace fragmented documents with a coherent hierarchy of policies, standards, procedures and supporting controls.

  • Information Risk & Accountability

    Make material information risks visible, owned and capable of escalation.

  • Governance Committees & Reporting

    Help governance forums spend less time receiving updates and more time making informed decisions.

  • Assurance & Continuous Improvement

    Test whether governance arrangements are operating as intended and turn findings into measurable improvement.

Part of an information governance engagement

Data Sharing & Research Governance

We help organisations design the governance that lets information be shared and reused for research and analytics lawfully, securely and with clear accountability — covering sharing frameworks, roles and responsibilities, anonymisation and pseudonymisation arrangements, and the evidence partners and oversight bodies expect.

  • Direct data-sharing evidence: the information-governance framework that enabled multi-centre patient-data sharing for research across the original NIHR Biomedical Research Centres. NIHR case study
  • Related platform governance: data privacy, security and quality governance for a specialist NHS trust’s clinical and corporate data warehouse and analytics platform. Royal Brompton & Harefield case study
  • Related information-governance and DSPT experience (not presented as data-sharing delivery): UCL and Liverpool John Moores University.

Need confidence in the quality of the data being shared? See Data Quality Governance & Assurance.

Lifecycle

Govern information throughout its lifecycle

Retention is one stage. Governance applies at every stage, from the moment information is created or received.

  1. Create / Receive

    Subject to the same cross-cutting controls: ownership, policy, risk, privacy, security and assurance.

  2. Classify

    Subject to the same cross-cutting controls: ownership, policy, risk, privacy, security and assurance.

  3. Use & Share

    Subject to the same cross-cutting controls: ownership, policy, risk, privacy, security and assurance.

  4. Store & Protect

    Subject to the same cross-cutting controls: ownership, policy, risk, privacy, security and assurance.

  5. Retain

    Subject to the same cross-cutting controls: ownership, policy, risk, privacy, security and assurance.

  6. Archive or Dispose

    Subject to the same cross-cutting controls: ownership, policy, risk, privacy, security and assurance.

Delivered within IG-Smart’s wider Assess → Build → Manage → Assure → Improve approach.

What you receive

What an Information Governance engagement may produce

Illustrative examples of the frameworks, registers and executive reporting the engagement may produce.

IG Programme Dashboard · Engagement periodIllustrative data — not client data
Overall positionAmber — on track
Framework components in place
7 / 10
▲ 2 this period
Open IG gaps
8
▼ 3 vs last review
Policies approved
12 / 15
▲ 4 this period
Owners assigned
14 / 16
▲ 3 this period

Gaps by priority

  • High2
  • Medium3
  • Low2

Evidence complete

72%

Overdue actions
2
Policies awaiting approval
3
Matters for escalation
1

Illustrative output

IG Programme Dashboard

Programme view

A single view of IG framework progress, so leadership can see what is in place and what remains.

What it helps you see

  • Framework progress
  • Open gaps by priority
  • Policy approval status
  • Ownership and escalations

Likely format

Dashboard / reporting view · Supporting registers and evidence records · Executive PDF summary where agreed

Information Governance current-state assessmentIllustrative data — not client data
Illustrative Information Governance current-state assessment
AreaPositionGapPriority
Records managementPartialNo retention scheduleHigh
Information assetsIn placeOwners not confirmedMedium
Data sharingNot startedNo agreements logHigh

Illustrative output

Information Governance current-state assessment

Current position

A documented view of the governance position, key dependencies, gaps and priority risks.

What it helps you see

  • Governance position by area
  • Key dependencies
  • Gaps
  • Priority risks

Likely format

IG-Smart branded PDF

Target operating modelIllustrative data — not client data
Illustrative Target operating model
RoleAccountable forForumEscalates to
SIROInformation riskIG committeeExecutive
Asset ownerNamed assetsIG working groupSIRO

Illustrative output

Target operating model

Accountability design

Defined roles, accountability, decision rights, governance forums and escalation routes.

What it helps you see

  • Roles and accountability
  • Decision rights
  • Governance forums
  • Escalation routes

Likely format

IG-Smart branded PDF

Records and information lifecycle frameworkIllustrative data — not client data
Illustrative Records and information lifecycle framework
Record classOwnerRetentionDisposal
ContractsLegal6 years after endSecure destruction
HR filesPeople team6 years after leavingReview then destroy

Illustrative output

Records and information lifecycle framework

Lifecycle control

Governance for creation, ownership, retention, archival and defensible disposal.

What it helps you see

  • Ownership at each stage
  • Retention rules
  • Archival arrangements
  • Defensible disposal

Likely format

IG-Smart branded PDF · IG-Smart branded spreadsheet / register

Policy architectureIllustrative data — not client data
Illustrative Policy architecture
DocumentLevelOwnerReview
Information governance policyPolicySIROAnnual
Retention standardStandardRecords ownerAnnual

Illustrative output

Policy architecture

Policy hierarchy

A coherent hierarchy of policies, standards, procedures, owners and review cycles.

What it helps you see

  • Policies, standards and procedures
  • Owners
  • Review cycles
  • Gaps and overlaps

Likely format

IG-Smart branded PDF

Governance committee frameworkIllustrative data — not client data
Illustrative Governance committee framework
ForumPurposeCadenceReports to
IG committeeOversight and decisionsQuarterlyExecutive
IG working groupDelivery and actionsMonthlyIG committee

Illustrative output

Governance committee framework

Committee reporting

Terms of reference, decision routes, management information, reporting and action tracking.

What it helps you see

  • Terms of reference
  • Decision routes
  • Management information
  • Action tracking

Likely format

IG-Smart branded PDF

Prioritised remediation planIllustrative data — not client data
Illustrative Prioritised remediation plan
ActionRiskOwnerStatus
Approve retention scheduleHighRecords ownerIn progress
Confirm asset ownersMediumSIRONot started

Illustrative output

Prioritised remediation plan

What to fix first

Findings sequenced by risk, dependency, effort and accountable owner.

What it helps you see

  • Findings by risk
  • Dependencies
  • Effort
  • Accountable owner

Likely format

IG-Smart branded spreadsheet / register

Board / executive assurance reportingIllustrative data — not client data
Illustrative Board / executive assurance reporting
MeasurePositionDecision
Overall IG positionAmber — improvingApprove priorities

Illustrative output

Board / executive assurance reporting

Executive reporting

Clear visibility of material information risk, progress, decisions and residual exposure.

What it helps you see

  • Material information risk
  • Progress
  • Decisions required
  • Residual exposure

Likely format

IG-Smart branded PDF · Board pack section

Illustrative structure — not a client document. Exact outputs and formats depend on the agreed scope.

Discuss the governance outputs, ownership arrangements and assurance evidence your organisation needs.

See a worked example: Information Governance Accountability & Assurance Matrix (illustrative, no sign-up).

Talk to a Senior Practitioner

Service boundaries

Information Governance, Managed Privacy and DPO support are connected — but different

What does "Information Governance" cover?
Designs and operates the organisation-wide structures through which information is owned, controlled and assured. Explore Managed Information Governance
What does "Managed Privacy Programme" cover?
Provides operational capability for privacy controls, records of processing, DPIAs, rights handling and improvement activity. Explore the Managed Data Privacy Programme
What does "Fractional / Outsourced DPO" cover?
Provides independent statutory or senior DPO oversight, challenge and assurance. Explore Outsourced & Fractional DPO

Reference

Optional background on scope and ownership

What is information governance?

Information governance is the system of accountability, decision-making, controls and assurance through which an organisation manages information throughout its lifecycle. It connects ownership, records management, privacy, security, retention, access, policy and oversight so information is managed consistently and important decisions can be evidenced.

The disciplines overlap and depend on each other, but they are not interchangeable:

  • Information Governance: The wider management and accountability environment around organisational information.
  • Data Protection: Legal obligations relating to personal data. May sit within, alongside or intersect with information governance.
  • Cybersecurity: Protects information and systems, but does not by itself establish ownership, lifecycle management or executive accountability.
Who owns information governance?

No single organisational model works universally. The right model depends on: sector, regulatory environment, organisational scale, risk profile, information types, operating structure, existing privacy, security and records functions.

IG-Smart does not impose a fixed committee structure. We configure accountability around the organisation that exists.

Which requirements can an information governance framework support?

Applicable requirements depend on the sector and the processing environment. Depending on the organisation, relevant references may include:

  • UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, where personal data is involved
  • Freedom of Information and public-records obligations, where applicable
  • Sector-specific records-management requirements
  • NHS information-governance and records-management requirements for relevant health and care organisations
  • ISO 15489-1:2016 records-management principles
  • ISO/IEC 27001 information-security governance, where relevant
  • Contractual, audit and procurement requirements

A governance framework supports an organisation in meeting these requirements; it does not by itself produce compliance with all of them. Scope is agreed for each engagement.

Relevant evidence

Selected information governance engagements

Published engagements involving national information governance advice, records and supplier assurance, and governance integration through organisational change.

  • Named client · Healthcare / NHS

    NHS England

    Strategic data-privacy and data-sharing advisory

    National privacy-by-design framework · multiple national workstreams

    View the evidence: NHS England

  • Named client · Higher Education / Research

    National Institute for Health and Care Research (NIHR)

    Data-sharing consultancy and information governance strategy

    National multi-centre research data-sharing framework

    View the evidence: National Institute for Health and Care Research (NIHR)

  • Named client · Healthcare / NHS

    Royal Brompton & Harefield NHS Foundation Trust

    Three-year managed service: Information Governance, data quality, Payment by Results, trust-wide information security and clinical systems safety, reporting to the board-level SIRO

    Three-year managed IG, data quality, security & clinical systems safety service · reporting to the board-level SIRO

    View the evidence: Royal Brompton & Harefield NHS Foundation Trust

  • Named client · Financial Services

    AIG

    Supplier data-governance audit

    Nationwide supplier audit

    View the evidence: AIG

Explore all case studies →Request Data Governance Evidence →

Client perspective

“It is my pleasure to recommend the consultancy and resourcing services of IG SMART ltd. The company offers top-notch quality service and across the board we have been pleased with their work. One project in particular illustrates their attention to detail and concern for quality, which was the assistance and successful submission of our NHS IG Toolkit for 2015-2016. I strongly recommend the services of the company and I am looking forward to working with them again on future projects or recruitment needs.”

Marion WilsonGeneral Manager, The Centre for Reproductive & Genetic HealthNHS IG Toolkit and DSPT-aligned Information Governance
Read the CRGH case study — The Centre for Reproductive & Genetic Health case study

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

  • Subject-matter expert

    Michael Abtar

    LLB (Hons), PG.Dip.Law, Cert. DPO

    View profile

  • Subject-matter expert

    Shaista Peart

    BA (Hons), CIPP/E

    View profile

  • Client & programme contact

    Julia Andrade

    BA

    Coordinates scope, practitioners, delivery and stakeholder communication.

    View profile

Buyer decisions

Questions before you engage

What is information governance?

Information governance is the system of accountability, decision-making, controls and assurance through which an organisation manages information throughout its lifecycle — from creation or receipt to retention, archival or disposal — so that information is managed consistently and important decisions can be evidenced.

What is the difference between information governance and data governance?

Data governance commonly focuses on data quality, ownership, standards, metadata and how data is used. Information governance addresses the wider organisational accountability and lifecycle environment around information and records, including policy, retention, risk and assurance. The two overlap, and many organisations manage them together.

What is the difference between information governance and data protection?

Data protection concerns legal obligations relating to personal data. Privacy is one component of — or an intersection with — information governance, which covers the wider information-management and accountability environment, including records, lifecycle controls, decision rights and assurance for all organisational information.

Who should own information governance?

Executive accountability and operational responsibilities should both be explicit. The exact model varies with sector, regulatory environment, scale, risk profile and existing privacy, security and records functions; there is no single structure that suits every organisation.

What should an information governance framework contain?

Typically: defined roles and accountability, a coherent policy hierarchy, records and lifecycle controls, information-risk management, governance forums, escalation routes, management reporting and a means of assuring that the arrangements operate as intended.

Can IG-Smart review an existing information governance framework?

Yes. A review examines design, implementation, governance effectiveness and evidence — whether the arrangements actually operate — rather than simply confirming that documents exist.

Can you help implement the recommendations?

Yes. Depending on scope, IG-Smart can support design, remediation, managed governance activity and continuing assurance, so recommendations are carried through rather than left as a report.

Does information governance include records management?

Records management is a significant component of information governance, but information governance is broader: it also covers accountability, decision rights, policy, information risk, privacy and security interfaces, and assurance.

Investment

Information Governance assessment / programme

Defined-scope engagement. Typical investment £10,000–£30,000+ (plus VAT).

The fee depends on

  • Number of business units and record types
  • Maturity of existing policies and evidence
  • Remediation support required

Procurement or supplier-assurance review?

Visit our Trust Centre

Ready to move forward?

Choose the route that matches where you are.

Not sure which service applies? Find the Right Service

  • Still defining your requirement?

    Discuss Information Governance

    Discuss the requirement, risk, scope and the right engagement model with an experienced practitioner.

    Discuss Information Governance

  • Have a defined scope, tender or RFP?

    Submit an Information Governance Requirement

    Share a defined requirement, RFP, tender, statement of work or existing scope for senior review.

    Submit an Information Governance Requirement

  • Procurement or supplier assurance

    Prepare for Procurement Review

    Access company, security and assurance information for supplier review, with controlled evidence available on request.

    Open Trust Centre