Data Privacy, Information Governance and Risk Management Platform

The Science Museum Group (SMG) is undertaking market research in advance of a potential procurement exercise for a replacement Data Privacy, Information Governance and Risk Management platform.

SMG is interested in engaging with suppliers that provide solutions supporting some or all of the following capabilities:

Information Governance & Compliance

• Information Asset Register (IAR)
• Record of Processing Activities (ROPA)
• Data Protection Impact Assessments (DPIA)
• Legitimate Interests Assessments (LIA)
• Data Processing Agreements
• Privacy compliance reporting
• AI governance and AI Register management

Case Management

• Freedom of Information (FOI) Requests
• Environmental Information Regulations (EIR) Requests
• Subject Access Requests (SAR) and other Data Subject Rights Requests
• Data breach and near-miss management
• Statutory deadline and SLA tracking
• Public-facing document sharing capabilities

Risk & Supplier Management

• Information and cyber risk registers
• Supplier and third-party risk assessments
• Vendor management and annual review workflows
• Contract and digital asset tracking
• Reporting and executive dashboards

General Requirements

SMG is particularly interested in solutions which:

• Reduce administrative effort through workflow automation
• Provide configurable forms, reports and approval processes
• Support Microsoft Entra ID / Active Directory integration
• Can operate independently of the main corporate network where appropriate
• Offer strong reporting and audit capabilities
• Support migration from existing systems
• Demonstrate compliance with UK GDPR and relevant information security standards
• Are cost effective and suitable for a UK public sector organisation

The anticipated implementation timescale would require a replacement service to be operational before the expiry of the current contract in March 2027.

Supplier Engagement

At this stage this is not a procurement exercise and does not constitute a call for competition or invitation to tender.

The purpose of this engagement is to:

• Understand the supplier marketplace
• Review available solutions and approaches
• Gain indicative cost and implementation information
• Understand available deployment and licensing models
• Inform the procurement strategy and business case

Suppliers interested in participating are invited to provide:

• Product overview and key capabilities
• Relevant public sector experience
• Indicative pricing models
• Typical implementation approach and timescales
• Details of any available demonstrations