Around 20 million people – nearly a third of England’s population – live in areas transitioning to single-tier unitary councils, a shift the Ministry of Housing, Communities and Local Government describes as “a once-in-a-generation reform.” At the same time, the UK Department for Science, Innovation and Technology warns that rising cyber threats are putting the security of sensitive data and the continuity of council services at risk.
For council leaders, CIOs, and information governance teams, this moment is not just about managing change. It is about building a stronger, more resilient foundation for the future. Migration alone is not the goal. The opportunity lies in transforming reorganisation into sustained governance maturity.
The Local Government Reorganisation (LGR) Maturity Curve provides a practical, four-stage framework to help councils move from uncertainty to control, enabling them to discover, protect, migrate, and govern their data with clarity and confidence.
To help councils rise to the moment, we've mapped the journey into a practical, four-stage framework: the Local Government Reorganisation Maturity Curve. Built around the stages of Discover, Protect, Migrate, and Govern, it turns reorganisation from a migration project into a governance opportunity. Here's what each stage looks like in practice, starting where every council must, with Discover.
Stage 1: Discover
Governance starts with visibility. You cannot govern what you do not understand. Yet most councils hold information across SharePoint, Microsoft Teams, OneDrive, file shares, and legacy line-of-business systems, creating digital sprawl and hidden risk. The Discover stage has two priorities: first, understanding your current estate; second, protecting critical information before any remediation, minimisation, or migration activity begins.
Key activities include:
- Data discovery and risk assessment
- Redundant, obsolete, or trivial (ROT) and inactive data identification
- Sensitive and overexposed data identification
- Backup and recovery validation
- Migration planning
Backup Data Before Remediation
Before remediation begins, councils should back up their data so it can be recovered if required. This creates an insurance policy ahead of downstream activities such as remediating overexposed sensitive data, minimising ROT, running information lifecycle initiatives, and executing migration. A robust backup strategy ensures critical information can be restored if issues arise during remediation or migration.
Migration Planning
With visibility established and backups in place, councils can shape a migration plan grounded in evidence. This means mapping the source estate against the target operating model, deciding what moves and when, prioritising high-value or high-risk workloads, and flagging content that should be remediated or minimised first. Clear success criteria and migration waves are defined here for a controlled migration.
Stage 2: Protect
Many councils complete discovery and develop a migration plan, then move straight to execution. But migration alone does not reduce risk. Without remediation, councils simply carry existing governance problems into the new authority. The Protect stage is where councils act on what discovery revealed, closing gaps before consolidation begins, not after.
Data Security Remediation
Discovery typically surfaces issues that have built up over years: overexposed sensitive data, legacy guest accounts, orphaned user identities, and sensitive information that has never been classified.
Key activities include:
- Policy creation to automate risk remediation
- Permission remediation and oversharing reduction
- Sensitive data protection and labelling
Data Minimisation
This is where data minimisation moves from identification to action. The objective is to reduce risk and avoid carrying unnecessary information into the new authority and, in some cases, to lower storage costs. Activities include archiving ROT and inactive data, and where appropriate, defensible deletion. By reducing low-value information before migration, councils lower governance overhead, improve information quality, and reduce long-term compliance risk.
AI Readiness
Many councils are exploring Microsoft Copilot and other AI tools. While AI can boost productivity, it also amplifies existing governance weaknesses, surfacing overexposed data. It can be tempting to rush into migration without first completing security remediation and data minimisation. But councils that finish the Protect stage properly gain a second dividend: a cleaner, better-governed estate that is AI-ready.
Stage 3: Migrate
With the estate understood and the biggest risks addressed, councils can turn to consolidation of data, users, and services.. Migration is the most visible phase of an LGR programme, but visibility should not be confused with success. Migration enables governance maturity, it does not create it. The objective at this stage is to bring information, users, and services into the new operating model while preserving security, compliance, and service continuity.
Key activities include:
- Tenant consolidation and migration execution
- Migration wave planning
- Cutover planning and service transition
By the time councils reach this stage, three things should already be clear: what information will move, what risks have been addressed, and how governance will be maintained after consolidation is complete.
Stage 4: Govern
Governance should continue long after migration is complete. If Discover builds visibility, Protect reduces risk, and Migrate creates the new environment, then Govern is where councils establish the operational foundations that sustain compliance, control and governance long after migration is complete.
Delegated Administration
New unitary authorities support a wide range of services, teams, and departments; far more than any central IT function can realistically manage on its own. Delegated administration enables local teams to manage their own users, data and workloads while maintaining central governance and oversight. Using a least-privileged, role-based access model helps ensure helpdesks and administrators can perform day-to-day tasks securely while maintaining consistent policies and controls across the authority.
Information Lifecycle Management
The highest level of maturity is reached when information is governed across its full lifecycle; from creation to defensible disposition. Rather than relying on manual reviews, councils can embed governance directly into the digital estate through information lifecycle management (ILM).
ILM ensures information is retained for the right period, reviewed at the right moment, and disposed of in a controlled, compliant way. This reduces risk, enables compliance, and makes information easier to manage for years to come.
Governance Maturity Is the True Measure of Success
Every council undertaking LGR should complete Discover. Most should reach Protect before beginning large-scale consolidation. Migrate brings people, information, and services into the new operating model, but the councils that realise the greatest long-term value are those that go on to reach Govern.
The most successful LGR programmes are not defined by the completion of a migration. They are defined by the governance capabilities that remain in place afterwards. LGR is a rare opportunity to reset governance maturity for a generation. Councils that seize it will be better positioned to manage information, maintain compliance, and confidently adopt AI as the technology and the public expectations around it continue to evolve.
Wherever your council sits on the maturity curve; discover, protect, migrate, or govern, you don't have to map the journey alone. Our free 10-Step Checklist for UK Councils' Digital Estate distils the priorities of all four stages into a practical, easy-to-follow guide: reduce cyber risk, strengthen data governance, and modernise with confidence throughout reorganisation.
The checklist gives you the roadmap. AvePoint helps you deliver it, supporting UK councils across every stage of reorganisation, from discovery to sustainable governance.
Take the AvePoint solution tour →
James McCann is a solution engineer at AvePoint with over 16 years of experience across public and private sectors. He partners with organizations across the UK and Ireland to strengthen data governance, security, and compliance, while enabling AI readiness. James works with enterprise and public sector customers to improve cyber resilience, protect critical information, and unlock value from Microsoft 365 and AI. His approach balances innovation with strong governance, helping organizations navigate digital transformation in complex regulated environments.