CORU Data Protection Officer (DPO) services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

Health and Social Care Professionals Council (CORU) ran this procurement for “CORU Data Protection Officer (DPO) services” as an operational contract requiring implementation and sustained service execution. The extracted pack showed qualification-stage material with references to later ITT technical depth; practical activity therefore centred on building, integrating, and operating the specified service stack with compliant reporting and handover obligations where stated. Constituent activities and named work elements in the supplied extracts:

• Title: CORU Data Protection Officer (DPO) services
• be required to hold for the term of the Services Contract the following insurances: Type of Insurance Indemnity Limit Employer’s Liability €13,000,000 Public Liability €2,600,000 Product Liability n/a Professional Indemnity €500,000 2
• hority estimates that the expenditure on the Services to be covered by the proposed Service Contractsmay amount to some €60,000 per annum (excl
• Tenderers must provide evidence of financial stability – tenderers must demonstrate an annual turnover of greater than €40,000 for DPO related services
• CV of proposed resource(s) with a minimum of 3 years’ experience in the provision of DPO services
• rer shall be required to supply its Tax Clearance Access Number and Tax Reference Number to facilitate online verification of their tax status by
• The DPO services may be required initially for 2-3 days per week
• 1 DPO services for the initial six month period (2-3 days/week) € 50 €
• 2 DPO services for the second six month period (1 day/week) € 20 €
• [20250314 CORU tender for DPO services.docx] Request for Tenders dated 14th March 2025
• [20250314 CORU tender for DPO services.docx] Part 1: Introduction
• [20250314 CORU tender for DPO services.docx] Non-binding monetary references in the source were treated as context only and were not used as qualification thresholds.

3. Background & buyer context

The buyer context reflected a formal Irish public-procurement route, with pre-qualification used to control entry into the tender stage.

• 1.7 Contracting Authority policy seeks to encourage participation on a fair and equal basis by Small and Medium Enterprises (“SME”s) in this Competition. SMEs that believe the scope of this Competition is beyond their technical or business capacity are encouraged, subject to paragraph 2.5, to explore the possibilities of forming relationships with
• 1% - 29% A response where serious reservations exist. This may be because, for example, insufficient detail is provided, and the response has fundamental flaws, or is seriously inadequate or seriously lacks credibility with a high risk of non-delivery.

4. Eligibility & selection criteria

• Turnover requirement — — use these verbatim for insurance / turnover. If a category (insurance, turnover) has no entry here, treat it as 'not specified' for THIS tender.
• Insurance — — use these verbatim for insurance / turnover. If a category (insurance, turnover) has no entry here, treat it as 'not specified' for THIS tender.; be required to hold for the term of the Services Contract the following insurances: Type of Insurance Indemnity Limit Employer’s Liability €13,000,000 Public Liability €2,600,000 Product Liability n/a Professional Indemnity €500,000 2
• Certifications — not specified for this tender
• Past experience — not specified for this tender
• Personnel — not specified for this tender
• Geographic / facility constraints — not specified for this tender Additional binding lines surfaced in the deterministic extract:
• — use these verbatim for insurance / turnover. If a category (insurance, turnover) has no entry here, treat it as 'not specified' for THIS tender.
• be required to hold for the term of the Services Contract the following insurances: Type of Insurance Indemnity Limit Employer’s Liability €13,000,000 Public Liability €2,600,000 Product Liability n/a Professional Indemnity €500,000 2

5. Award criteria & scoring

6. Submission requirements

• Method statement / response document (template/page limits) — Appendix 1 questionnaire/PQQ response was required.
• CVs (page count, named roles) — not specified in extract.
• Pricing schedule (format/template) — expected at ITT stage.
• Case studies (number/value range) — client references/comparable project evidence was referenced.
• Declarations (ESPD/Bona Fides/Tax/COI) — ESPD/declaration/statement-of-confirmation language was present.
• Mandatory site visit — not specified in extract.
• Submission portal and formatting — eTenders portal and PDF electronic copies were referenced. Submission-related source lines:
• CV of proposed resource(s) with a minimum of 3 years’ experience in the provision of DPO services
• Appendix 1: Requirements and Specifications
• Appendix 4: Declaration as to Personal Circumstances of Tenderer
• Appendix 6: Confidentiality Agreement
• 1.1 Health and Social Care Professionals Council (CORU) (the “Contracting Authority”) invites tenders (“Tenders”) to this request for tenders (“RFT”) from economic operators (“Tenderers”) for the provision of the services as described in Appendix 1 to this RFT (the “Services”).
• [20250314 CORU tender for DPO services.docx] Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation”), and any guidelines and codes of practice issued by the Office of the Data Protection Commission or other supervisory authority for data protection in Ireland from time to time. The Contracting Authority will be a Data Controller (where Data Controller has the meaning given under the Data Protection Laws) in respect of any Personal Data (where Personal Data has the meaning given under the Data Protection Laws) required to be provided by the Tenderer in response to this RFT. The Tenderer, as Data Controller in respect of any Personal Data provided by it in its Tender, is required to confirm in the statement required under paragraph 2.4 below that all Data Subjects (where Data Subject has the meaning given under the Data Protection Laws) whose Personal Data is provided by the Tenderer have consented to the processing of such Personal Data by the Tenderer, the Contracting Authority, the Evaluation Team and the supplier of the etenders.gov.ie website, for the purposes of the participation of the Tenderer in this Competition or that the Tenderer otherwise has a legal basis for providing such Personal Data to the Contracting Authority for the purposes of its participation in this Competition .

7. Key dates & process

8. Contract terms that matter

Contract duration in the extract: 3 years. Payment cycle, SLA/KPI schedule, and penalty regime were not fully disclosed in the snippets unless listed below.

• VERIFIED PHRASES (deterministic regex extract from the documents — treat as authoritative for numerical claims)
• be required to hold for the term of the Services Contract the following insurances: Type of Insurance Indemnity Limit Employer’s Liability €13,000,000 Public Liability €2,600,000 Product Liability n/a Professional Indemnity €500,000 2
• NOW IT IS HEREBY AGREED in consideration of the sum of €2.00 (the receipt of which is hereby acknowledged by the Contractor) as follows:
• e right to extend the Term for a period or periods of up to 12 months with a maximum of 2 such extension or e
• [insert number]calendar days either Party may terminate at 14 days notice
• breach(es) (if the breach(es) are capable of remedy) within 30 days after receipt of a request in writing f
• For the Term and for a period of 12 months thereafter (and save in respect of publ
• 1.4 This public procurement competition (the “Competition”) will be conducted in accordance with the open procedure under the European Union (Award of Public Authority Contracts) Regulations 2016 (Statutory Instrument 284 of 2016) (the “Regulations”). Any contract that may result from this Competition (the “Services Contract”) will be issued for a term of 2 years (“the Term”).

9. Risks, red flags & unusuals

• Qualification gate: the deterministic extract included a turnover threshold line (— use these verbatim for insurance / turnover. If a category (insurance, turnover) has no entry here, treat it as 'not specified' for THIS tender.), which can materially narrow bidder pool composition.
• The two-step process (PQQ then ITT) shifted effort to compliance evidence early, with competitive scoring detail potentially deferred.
• Technical and contractual granularity appeared ITT-dependent, increasing ambiguity at qualification stage for non-incumbent bidders.

10. SME fit assessment

This competition looked most accessible to firms with established public-sector tender capability, documented financial capacity, and direct operational experience in the relevant service category.

• Credible bidder profile — mid-sized to large specialist with formal QA/compliance process.
• Consortium / sub-contracting — allowed or addressed in the extracts (Appendix references and reliance provisions).
• Indicative bid-prep effort — 6 to 12 working days for evidence collation, form completion, and review cycles at PQQ level.
• Pwin signal — strongest for bidders with reusable qualification artefacts, comparable references, and low-friction mobilisation capability.

11. Where to dig deeper

• Source RFT/PQQ filenames: 20250314 CORU tender for DPO services.docx, Appendix 1: Requirements and Specifications, Appendix 2: Pricing Schedule.
• eTenders CFT / notice reference: not specified in extract.
• Clarification contact / portal: eTenders message portal (email not surfaced in extract).
• Key attachments to prioritise: Appendix 3: Tenderer’s Statement, Appendix 4: Declaration as to Personal Circumstances of Tenderer, Appendix 5: Services Contract.