Data Privacy, Information Governance and Risk Management Platform

The Science Museum Group (SMG) is undertaking market research in advance of a potential procurement exercise for a replacement Data Privacy, Information Governance and Risk Management platform.

SMG is interested in engaging with suppliers that provide solutions supporting some or all of the following capabilities:

Information Governance & Compliance

- Information Asset Register (IAR)

- Record of Processing Activities (ROPA)

- Data Protection Impact Assessments (DPIA)

- Legitimate Interests Assessments (LIA)

- Data Processing Agreements

- Privacy compliance reporting

- AI governance and AI Register management

Case Management

- Freedom of Information (FOI) Requests

- Environmental Information Regulations (EIR) Requests

- Subject Access Requests (SAR) and other Data Subject Rights Requests

- Data breach and near-miss management

- Statutory deadline and SLA tracking

- Public-facing document sharing capabilities

Risk & Supplier Management

- Information and cyber risk registers

- Supplier and third-party risk assessments

- Vendor management and annual review workflows

- Contract and digital asset tracking

- Reporting and executive dashboards

General Requirements

SMG is particularly interested in solutions which:

- Reduce administrative effort through workflow automation

- Provide configurable forms, reports and approval processes

- Support Microsoft Entra ID / Active Directory integration

- Can operate independently of the main corporate network where appropriate

- Offer strong reporting and audit capabilities

- Support migration from existing systems

- Demonstrate compliance with UK GDPR and relevant information security standards

- Are cost effective and suitable for a UK public sector organisation

The anticipated implementation timescale would require a replacement service to be operational before the expiry of the current contract in March 2027.

Supplier Engagement

At this stage this is not a procurement exercise and does not constitute a call for competition or invitation to tender.

The purpose of this engagement is to:

- Understand the supplier marketplace

- Review available solutions and approaches

- Gain indicative cost and implementation information

- Understand available deployment and licensing models

- Inform the procurement strategy and business case

Suppliers interested in participating are invited to provide:

- Product overview and key capabilities

- Relevant public sector experience

- Indicative pricing models

- Typical implementation approach and timescales

- Details of any available demonstrations