--- title: "Data Privacy, Information Governance and Risk Management Platform" ocid: "ocds-h6vhtk-079528" canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-079528" markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-079528.md" json_url: "https://d3tenders.com/contract/ocds-h6vhtk-079528.json" source: "Find A Tender Service" current_stage: "Planning" buyer: "Science Museum Group" published: "2026-11-02" --- # Data Privacy, Information Governance and Risk Management Platform Buyer: Science Museum Group Current stage: Planning OCID: ocds-h6vhtk-079528 [View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-079528) [Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-079528.json) ## Summary The Science Museum Group is researching a replacement platform for data privacy, information governance and risk management. The service is intended to support information asset registers, records of processing, privacy impact and legitimate interests assessments, data processing agreements, privacy and AI governance, and compliance reporting. Casework includes freedom of information, environmental information and subject access requests, data breaches, deadline tracking and public document sharing. Risk functions include information and cyber risk registers, supplier assessments, vendor reviews, contract and digital asset tracking, and management dashboards. Delivery is for the Science Museum Group, based in London, with a replacement service expected to serve its organisation. The platform should help manage governance and compliance processes across the Group. This is a planning-stage market research exercise, not a competition or invitation to tender. The Group is gathering supplier, product, cost, implementation, deployment and licensing information to shape its procurement strategy and business case; no procurement procedure has yet been settled. Interested suppliers are asked to register their interest by email by 30 November 2026, including their organisation and platform details, and may provide brochures, case studies or links. The Group is considering an optional online supplier Q&A session, but has not set a date. The anticipated contract period runs from 1 March 2027 to 28 February 2030, with the replacement service required to be operational before the existing contract expires in March 2027. The estimated value is £160,000 excluding VAT (£192,000 including VAT). This market research is most relevant to suppliers of configurable software platforms combining data protection, information governance, case management and supplier or cyber risk tools. The Group is interested in automation that reduces administration, configurable forms, reports and approvals, strong audit and reporting, and support for migration from existing systems. Suppliers should be prepared to explain integration with Microsoft Entra ID or Active Directory, and whether the solution can operate independently of the main corporate network where appropriate. Evidence of UK GDPR compliance and relevant information security standards will be important, alongside suitability and cost-effectiveness for a UK public sector organisation. Suppliers can help shape the future requirement by sharing public sector experience, indicative pricing models, typical implementation approaches and timescales, deployment and licensing options, and demonstration availability. ## Notice The Science Museum Group (SMG) is undertaking market research in advance of a potential procurement exercise for a replacement Data Privacy, Information Governance and Risk Management platform. SMG is interested in engaging with suppliers that provide solutions supporting some or all of the following capabilities: Information Governance & Compliance - Information Asset Register (IAR) - Record of Processing Activities (ROPA) - Data Protection Impact Assessments (DPIA) - Legitimate Interests Assessments (LIA) - Data Processing Agreements - Privacy compliance reporting - AI governance and AI Register management Case Management - Freedom of Information (FOI) Requests - Environmental Information Regulations (EIR) Requests - Subject Access Requests (SAR) and other Data Subject Rights Requests - Data breach and near-miss management - Statutory deadline and SLA tracking - Public-facing document sharing capabilities Risk & Supplier Management - Information and cyber risk registers - Supplier and third-party risk assessments - Vendor management and annual review workflows - Contract and digital asset tracking - Reporting and executive dashboards General Requirements SMG is particularly interested in solutions which: - Reduce administrative effort through workflow automation - Provide configurable forms, reports and approval processes - Support Microsoft Entra ID / Active Directory integration - Can operate independently of the main corporate network where appropriate - Offer strong reporting and audit capabilities - Support migration from existing systems - Demonstrate compliance with UK GDPR and relevant information security standards - Are cost effective and suitable for a UK public sector organisation The anticipated implementation timescale would require a replacement service to be operational before the expiry of the current contract in March 2027. Supplier Engagement At this stage this is not a procurement exercise and does not constitute a call for competition or invitation to tender. The purpose of this engagement is to: - Understand the supplier marketplace - Review available solutions and approaches - Gain indicative cost and implementation information - Understand available deployment and licensing models - Inform the procurement strategy and business case Suppliers interested in participating are invited to provide: - Product overview and key capabilities - Relevant public sector experience - Indicative pricing models - Typical implementation approach and timescales - Details of any available demonstrations ### Planning Information Interested suppliers should register their interest via email: data.protection@sciencemuseum.ac.uk Subject: Market Research Response – Data Privacy & Risk Management Platform Please include: - Organisation name - Contact name - Email address - Website - Brief description of your platform - Any supporting brochures, case studies or links Alternatively, SMG may publish and manage supplier responses through an online registration form if appropriate during the engagement period. Optional Supplier Q&A Session SMG is considering holding a supplier market engagement and question-and-answer session via Microsoft Teams to provide interested suppliers with an opportunity to ask questions about the scope, objectives and anticipated procurement approach. Suppliers responding to this market research exercise are invited to indicate whether they would be interested in attending such a session should it be arranged. At this stage, no date has been confirmed; however, suppliers expressing an interest will be notified of further details if the session proceeds. Please indicate within your response: - Whether you would be interested in attending a supplier Q&A session - The name and role of proposed attendees - Any initial topics or areas of interest you would like SMG to address This information will help SMG assess demand and shape any future market engagement activities. ## Key Details | Field | Value | | --- | --- | | Publication source | Find A Tender Service | | Latest notice | https://www.find-tender.service.gov.uk/Notice/103570-2026 | | Notice type | UK2 - Preliminary Market Engagement Notice | | Procurement type | Standard | | Procurement category | Services | | Procurement method | Not Specified | | Procurement method details | Not specified | | Tender suitability | Not specified | | Awardee scale | Not specified | | All stages | Planning | ## Dates | Field | Value | | --- | --- | | Publication date | 2 Nov 2026 | | Submission deadline | Not specified | | Future notice date | Not specified | | Award date | Not specified | | Contract period | 1 Mar 2027 - 28 Feb 2030 | | Recurrence | Not specified | ## Values | Field | Value | | --- | --- | | Tender value | £160,000 | | Lots value | Not specified | | Awards value | Not specified | | Contracts value | Not specified | ## Status | Field | Value | | --- | --- | | Tender status | Planning | | Lots status | Planning | | Awards status | Not specified | | Contracts status | Not specified | ## Buyer | Field | Value | | --- | --- | | Main buyer | Science Museum Group | | Locality | LONDON | | Postcode area | South West London | | Postcode | SW7 2DD | | Country | England | | ITL 1 | TLI London | | ITL 2 | TLI3 Inner London - West | | ITL 3 | TLI33 Kensington & Chelsea and Hammersmith & Fulham | | Local authority | Kensington and Chelsea | | Electoral ward | Brompton & Hans Town | | Westminster constituency | Kensington and Bayswater | | Delivery location | Not specified | ## CPV Codes ### Divisions - 72 - IT services: consulting, software development, Internet and support ### Codes - 72322000 - Data management services ## Release History - 2 Nov 2026 at 10:03 - PlanningUpdate - UK2 - Preliminary Market Engagement Notice - https://www.find-tender.service.gov.uk/Notice/103570-2026 - 2 Nov 2026 at 09:33 - Planning - UK2 - Preliminary Market Engagement Notice - https://www.find-tender.service.gov.uk/Notice/103545-2026 ## Documents - https://www.find-tender.service.gov.uk/Notice/103570-2026 2nd November 2026 - Preliminary market engagement notice on Find a Tender - https://www.find-tender.service.gov.uk/Notice/103545-2026 2nd November 2026 - Preliminary market engagement notice on Find a Tender ## Notice URLs - https://www.legislation.gov.uk/ukpga/2023/54/contents ## Provenance This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-079528. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-079528.json.