Public procurement notice: Contract Award Notice
Published: 2019-01-10
Buyer: The Council of the Borough of Kirklees
Country: UK
Contract type: Services
Procedure: Open procedure
CPV classification: 72300000 | 79900000 | 80510000
Estimated value: 2992500 GBP
Award criteria: The most economic tender

Technical requirements: The introduction of the General Data Protection Regulation (GDPR) has meant that Kirklees Council and its associated agencies (Contracting Authorities) require support with their information governance activities. As such the Contracting Authorities have established a Framework Agreement to access the support it requires, in order to enable the achievement of GDPR compliance across all of the Contracting Authorities.
The agencies associated with the Council include Maintained Schools and Academy Trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service Providers (2 organisations). All of these agencies operate with a significant amount of personal data and therefore require support with their GDPR implementation.
This activity requires the economic operator to audit the culture and practices of the commissioning Contracting Authority, conduct a GAP analysis of existing practices compared to GDPR requirements and support the commissioning Contracting Authority to bring their practices into line with GDPR requirements.
It is expected that the final assessments and investigation will be consolidated into an audit report, providing full details of recommendations and expected future actions to enable GDPR compliance.
The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations).
The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”).
Data processor management is a key requirement for GDPR compliance. Organisations must have relevant and appropriate contracts in place with all of their data processors. However, some organisations may not have the appropriate contract management in place. This lot required the provider to demonstrate how they will provide the services outlined below, including the provision of previous work carried out successfully in other organisations.
— full, organisation-wide information audit of paper and electronic records, and key application data including data flow mapping activities associated with each data set,
— training for organisation IG leads on how to conduct these activities in future. This training was required to be outlined within the tender documentation with an expectation that a minimum half day would be required to train the contract management staff within the commissioning Contracting Authority and should be accompanied by materials for the trained staff to refer to following contract completion.
The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations).
The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”).
GDPR requires the culture of an organisation to have privacy and data protection principles at the foundation of all business practices involving the use of personal data. This is known by the Information Commissioner's Office (ICO) as Privacy by Design.
Privacy by Design practices must be embedded within all work involving the collection and processing of personal data. The economic operator is required to:
— if a DPIA has not been completed for an activity, create a DPIA for the activity, consulting with contracting authority IG leads throughout,
— work through the procedures relating to each activity and adjust the procedures to ensure these include privacy by design in future,


Winner: Gooding and Co Ltd T/A Data Privacy Advisory Service
Award value: 2992500
Number of bids: 18