# Hope & May - **Type:** Advisory firm - **Website:** https://hope-may.com/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A family-founded UK consultancy that acts as an outsourced data protection officer (DPO), trains staff and handles breaches, mainly for charities. NCVO lists it as a trusted supplier. ## Hope & May scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 3/5 Publishes a data-breach management service (threshold and impact assessment, contacting affected individuals, ICO reporting where required) with a named lead practitioner (Mark Burnett, a 2025 'Outstanding DPO' finalist per its DPO page), but discloses no incident outcomes (hope-may.com/outsourced-data-protection-officer/, checked 2026-07-16). ### Qualifications of the people who do the work: 3/5 A fully named team with stated qualifications, GDPR.Cert founder, solicitor COO, legally trained practitioners, but no IAPP (CIPP/E/CIPM) or otherwise independently verifiable credentials appear on the About page (raw text checked, hope-may.com/about-us/, 2026-07-16). ### What it publishes about fees: 2/5 No prices, day rates, retainers or worked examples published; only 'cost-effective' and 'range of packages' claims, plus a 10% NCVO member discount noted on NCVO's site (hope-may.com and ncvo.org.uk, checked 2026-07-16). ### Knowledge of your sector: 4/5 Charity-sector specialism evidenced by third-party NCVO Trusted Supplier status and ACEVO premium partnership, dedicated sector pages (charity, retail, healthcare, education) and an outsourced Caldicott Guardian service for health bodies (ncvo.org.uk and hope-may.com, checked 2026-07-16). ### Independence from what it sells: 4/5 Consultancy and training only, with no software product to sell; channel partnerships (NCVO, ACEVO, Lloyds Bank Foundation, DSC) are openly disclosed, including the NCVO member discount (hope-may.com and ncvo.org.uk, checked 2026-07-16). ### Who carries the risk if the advice is wrong: 3/5 A public commitment exists, 'We are fully insured…professional safeguards expected of a trusted Data Protection partner', but no PI cover level, insurer or engagement/liability terms are published (hope-may.com, checked 2026-07-16). ## Sources for Hope & May Every line carries the page it was read on and the date it was checked. - Companies House registration: HOPE AND MAY LIMITED, company number 08846089, incorporated 15 January 2014, status Active; registered office Coltsfoot Cherry Orchard Lane, Wyddial, Buntingford, Hertfordshire, SG9 0EN; SIC 70229. Officers match the published team, including founder Mark Burnett (director since 15 January 2014), Denise Burnett and Sofiya Mhaisale (directors since 10 October 2024) - Source: https://find-and-update.company-information.service.gov.uk/company/08846089/officers - Checked: 2026-07-16 - Service scope: Outsourced DPO, data-protection audit, staff training, data-breach management, SAR support, AI Governance & Data Protection, outsourced Caldicott Guardian service, data-protection helpline, DPIA review service and V-Learning courses - Source: https://hope-may.com/ - Checked: 2026-07-16 - Pricing disclosure: Does not publish any prices, day rates, retainers or worked examples on its public website as of 2026-07-16; NCVO's trusted-supplier page states 'NCVO get a 10% discount on Hope & May's services' - Source: https://www.ncvo.org.uk/about-us/our-services/trusted-suppliers/it-data-protection/hope-may/ - Checked: 2026-07-16 - Credentials disclosure: Publishes a fully named team: Mark Burnett (GDPR.Cert, 'Certified GDPR Data Protection Practitioner' since 2017, trained Caldicott Guardian, 15+ years in data protection law), COO Sofiya Mhaisale (solicitor and foreign-qualified lawyer, trained Caldicott Guardian) and six named practitioners largely with legal backgrounds; no CIPP/E, CIPM or IAPP credentials appear anywhere in the About page text as of 2026-07-16 (raw page text checked) - Source: https://hope-may.com/about-us/ - Checked: 2026-07-16 - PI insurance / liability disclosure: Homepage states 'We are fully insured, ensuring that every organisation we work with benefits from the security, assurance, and professional safeguards expected of a trusted Data Protection partner'; no cover level, insurer or engagement liability terms are published as of 2026-07-16 - Source: https://hope-may.com/ - Checked: 2026-07-16 - Independent endorsement: Listed by NCVO as a trusted supplier for data-protection audits, DPO representation, helpline and training to NCVO members; the homepage also displays NCVO Trusted Supplier 2026, ACEVO premium partner, Directory of Social Change and Lloyds Bank Foundation endorsements and a CPD-accreditation claim; no ISO 27001/27701/42001 certificate is published as of 2026-07-16 - Source: https://www.ncvo.org.uk/about-us/our-services/trusted-suppliers/it-data-protection/hope-may/ - Checked: 2026-07-16 - Named client outcomes: Does not publish named-client case studies on the pages checked as of 2026-07-16; its outsourced-DPO page states founder Mark Burnett was 'a finalist for Outstanding DPO' at the 2025 PICCASO awards - Source: https://hope-may.com/outsourced-data-protection-officer/ - Checked: 2026-07-16 - AI-use disclosure: Privacy policy states 'We currently do not undertake automated decision making'; no fuller statement of how the firm itself uses AI or where client data goes is published as of 2026-07-16. Its client-facing AI Governance & Data Protection service (AI risk assessment, DPIAs for AI projects, policy development, transparency guidance, and FRIA 'under emerging EU AI regulation') is self-declared, with no ISO 42001 certification cited - Source: https://hope-may.com/privacy-policy/ - Checked: 2026-07-16 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Published - Client results: Not published - How it uses AI: Not published ## Strengths - Fully named team published, from directors to practitioners, including a solicitor COO and a GDPR.Cert-certified founder who is also a trained Caldicott Guardian - Independently verifiable third-party endorsement: listed by NCVO as a trusted supplier for data protection with a published 10% NCVO member discount - Publishes a public insurance statement, 'We are fully insured', alongside CPD-accreditation and charity-sector partnership claims - Publishes an AI Governance & Data Protection service covering AI risk assessment, DPIAs for AI projects and transparency guidance, including FRIA under emerging EU AI regulation ## Things to check Each one carries the factual basis it rests on. - Ask for a written quote. The DPO service page we checked gave no prices or worked examples. - Basis: https://hope-may.com/ and https://hope-may.com/outsourced-data-protection-officer/ checked 2026-07-16; no figures found on either page. - Its About page lists legal backgrounds but no IAPP privacy qualifications. Ask which qualifications your adviser holds. - Basis: Raw page text of https://hope-may.com/about-us/ checked 2026-07-16 contained no 'CIPP', 'CIPM' or 'IAPP' strings; published credentials are GDPR.Cert, solicitor status and legal backgrounds. - It says it is fully insured. Ask for the amount of cover and the limits on what it would pay if its advice caused a loss. - Basis: https://hope-may.com/ homepage checked 2026-07-16. - Ask who would lead your AI project and what experience they have. The service page we checked named no AI specialists or ISO 42001 certification. - Basis: https://hope-may.com/ai-governance-data-protection/ checked 2026-07-16, no third-party certification or named staff on the page. ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.