We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk
Hope & May logo

Hope & May review

Advisory firm

A family-founded UK consultancy that acts as an outsourced data protection officer (DPO), trains staff and handles breaches, mainly for charities. NCVO lists it as a trusted supplier.

Relevant if you run a charity and want a named DPO team from an NCVO trusted supplier

Price Not published
Indemnity cover Published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Hope & May scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 3/5
Qualifications of the people who do the work 3/5
What it publishes about fees 2/5
Knowledge of your sector 4/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 3/5

What Hope & May offers, and what it publishes

Hope & May names its whole team. It says founder Mark Burnett holds GDPR.Cert and is a trained Caldicott Guardian, COO Sofiya Mhaisale is a solicitor, and most of the six other practitioners have legal backgrounds. Services include outsourced DPO, audits, training, breach management, subject access requests, AI governance and an outsourced Caldicott Guardian service.

Hope & May does not publish a price, day rate or worked example. It says it is 'fully insured' but gives no cover level or insurer. It publishes no named client case studies. No team member lists an IAPP qualification such as CIPP/E or CIPM. It does not say how it uses AI itself.

NCVO lists it as a trusted supplier, and NCVO members get 10% off. The firm also shows ACEVO, Lloyds Bank Foundation and Directory of Social Change endorsements. It says Mark Burnett was a finalist for 'Outstanding DPO' at the 2025 PICCASO awards. Its AI governance service cites no ISO 42001 certificate. We found no Trustpilot profile.

Strengths

  • Fully named team published, from directors to practitioners, including a solicitor COO and a GDPR.Cert-certified founder who is also a trained Caldicott Guardian
  • Independently verifiable third-party endorsement: listed by NCVO as a trusted supplier for data protection with a published 10% NCVO member discount
  • Publishes a public insurance statement, 'We are fully insured', alongside CPD-accreditation and charity-sector partnership claims
  • Publishes an AI Governance & Data Protection service covering AI risk assessment, DPIAs for AI projects and transparency guidance, including FRIA under emerging EU AI regulation

Things to check

  • Ask for a written quote. The DPO service page we checked gave no prices or worked examples.
  • Its About page lists legal backgrounds but no IAPP privacy qualifications. Ask which qualifications your adviser holds.
  • It says it is fully insured. Ask for the amount of cover and the limits on what it would pay if its advice caused a loss.
  • Ask who would lead your AI project and what experience they have. The service page we checked named no AI specialists or ISO 42001 certification.

Common questions

Which sectors does Hope & May work in?

Mainly charities and voluntary groups. NCVO lists it as a trusted supplier, and it describes itself as an ACEVO premium partner. It also has pages for retail, healthcare, education, fitness and recruitment.

Does Hope & May publish its prices?

No. It publishes no fees, day rates or worked examples. NCVO's supplier page says NCVO members get a 10% discount.

Do its staff hold IAPP qualifications?

Not that it says. Its About page lists GDPR.Cert, solicitor status and legal training, but no CIPP/E, CIPM or other IAPP credential.

Evidence for each Hope & May score

Show our working

Notes behind each thing to check

  • Ask for a written quote. The DPO service page we checked gave no prices or worked examples. (https://hope-may.com/ and https://hope-may.com/outsourced-data-protection-officer/ checked 2026-07-16; no figures found on either page.)
  • Its About page lists legal backgrounds but no IAPP privacy qualifications. Ask which qualifications your adviser holds. (Raw page text of https://hope-may.com/about-us/ checked 2026-07-16 contained no 'CIPP', 'CIPM' or 'IAPP' strings; published credentials are GDPR.Cert, solicitor status and legal backgrounds.)
  • It says it is fully insured. Ask for the amount of cover and the limits on what it would pay if its advice caused a loss. (https://hope-may.com/ homepage checked 2026-07-16.)
  • Ask who would lead your AI project and what experience they have. The service page we checked named no AI specialists or ISO 42001 certification. (https://hope-may.com/ai-governance-data-protection/ checked 2026-07-16, no third-party certification or named staff on the page.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 3/5 Publishes a data-breach management service (threshold and impact assessment, contacting affected individuals, ICO reporting where required) with a named lead practitioner (Mark Burnett, a 2025 'Outstanding DPO' finalist per its DPO page), but discloses no incident outcomes (hope-may.com/outsourced-data-protection-officer/, checked 2026-07-16).
Qualifications of the people who do the work 3/5 A fully named team with stated qualifications, GDPR.Cert founder, solicitor COO, legally trained practitioners, but no IAPP (CIPP/E/CIPM) or otherwise independently verifiable credentials appear on the About page (raw text checked, hope-may.com/about-us/, 2026-07-16).
What it publishes about fees 2/5 No prices, day rates, retainers or worked examples published; only 'cost-effective' and 'range of packages' claims, plus a 10% NCVO member discount noted on NCVO's site (hope-may.com and ncvo.org.uk, checked 2026-07-16).
Knowledge of your sector 4/5 Charity-sector specialism evidenced by third-party NCVO Trusted Supplier status and ACEVO premium partnership, dedicated sector pages (charity, retail, healthcare, education) and an outsourced Caldicott Guardian service for health bodies (ncvo.org.uk and hope-may.com, checked 2026-07-16).
Independence from what it sells 4/5 Consultancy and training only, with no software product to sell; channel partnerships (NCVO, ACEVO, Lloyds Bank Foundation, DSC) are openly disclosed, including the NCVO member discount (hope-may.com and ncvo.org.uk, checked 2026-07-16).
Who carries the risk if the advice is wrong 3/5 A public commitment exists, 'We are fully insured…professional safeguards expected of a trusted Data Protection partner', but no PI cover level, insurer or engagement/liability terms are published (hope-may.com, checked 2026-07-16).

Sources for Hope & May

  • Companies House registration: HOPE AND MAY LIMITED, company number 08846089, incorporated 15 January 2014, status Active; registered office Coltsfoot Cherry Orchard Lane, Wyddial, Buntingford, Hertfordshire, SG9 0EN; SIC 70229. Officers match the published team, including founder Mark Burnett (director since 15 January 2014), Denise Burnett and Sofiya Mhaisale (directors since 10 October 2024) (Companies House, checked 16 July 2026)
  • Service scope: Outsourced DPO, data-protection audit, staff training, data-breach management, SAR support, AI Governance & Data Protection, outsourced Caldicott Guardian service, data-protection helpline, DPIA review service and V-Learning courses (hope-may.com, checked 16 July 2026)
  • Pricing disclosure: Does not publish any prices, day rates, retainers or worked examples on its public website as of 2026-07-16; NCVO's trusted-supplier page states 'NCVO get a 10% discount on Hope & May's services' (ncvo.org.uk, checked 16 July 2026)
  • Credentials disclosure: Publishes a fully named team: Mark Burnett (GDPR.Cert, 'Certified GDPR Data Protection Practitioner' since 2017, trained Caldicott Guardian, 15+ years in data protection law), COO Sofiya Mhaisale (solicitor and foreign-qualified lawyer, trained Caldicott Guardian) and six named practitioners largely with legal backgrounds; no CIPP/E, CIPM or IAPP credentials appear anywhere in the About page text as of 2026-07-16 (raw page text checked) (hope-may.com, checked 16 July 2026)
  • PI insurance / liability disclosure: Homepage states 'We are fully insured, ensuring that every organisation we work with benefits from the security, assurance, and professional safeguards expected of a trusted Data Protection partner'; no cover level, insurer or engagement liability terms are published as of 2026-07-16 (hope-may.com, checked 16 July 2026)
  • Independent endorsement: Listed by NCVO as a trusted supplier for data-protection audits, DPO representation, helpline and training to NCVO members; the homepage also displays NCVO Trusted Supplier 2026, ACEVO premium partner, Directory of Social Change and Lloyds Bank Foundation endorsements and a CPD-accreditation claim; no ISO 27001/27701/42001 certificate is published as of 2026-07-16 (ncvo.org.uk, checked 16 July 2026)
  • Named client outcomes: Does not publish named-client case studies on the pages checked as of 2026-07-16; its outsourced-DPO page states founder Mark Burnett was 'a finalist for Outstanding DPO' at the 2025 PICCASO awards (hope-may.com, checked 16 July 2026)
  • AI-use disclosure: Privacy policy states 'We currently do not undertake automated decision making'; no fuller statement of how the firm itself uses AI or where client data goes is published as of 2026-07-16. Its client-facing AI Governance & Data Protection service (AI risk assessment, DPIAs for AI projects, policy development, transparency guidance, and FRIA 'under emerging EU AI regulation') is self-declared, with no ISO 42001 certification cited (hope-may.com, checked 16 July 2026)

NCVO Trusted Supplier 2026 (verified on ncvo.org.uk) ACEVO premium partner 2026 (claimed on hope-may.com) CPD-accredited training (claimed on hope-may.com)

First DPO or AI policyRegulated sectorsAfter a breach or ICO contactExposed to the EU AI Act

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.