Data Protection Support Services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The Financial Services and Pensions Ombudsman (FSPO) requires a contractor to provide Data Protection Support Services over a two-year period, with the potential for two 12-month extensions. The contractor will work closely with the FSPO’s Data Protection Officer (DPO) and is expected to deliver a range of services that ensure compliance with data protection legislation, particularly the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The contractor's day-to-day activities will include:

• Data Protection Expertise and Guidance:

• Provide advice on GDPR-related queries, including Subject Access Requests (SARs) and data breaches.

• Issue recommendations for compliance with data protection legislation.

• Support the establishment of Data Sharing Agreements and Data Processing Agreements.

• Assist in implementing proposals arising from audits.

• Data Protection Compliance Reviews:

• Conduct a gap analysis of current data protection compliance.

• Review and update data protection policies, including breach reporting and Subject Access Requests processes.

• Compile and update the Record of Processing Activities (ROPA).

• Review third-party processor agreements.

• Data Protection Support Services:

• Assist with ongoing Data Protection Impact Assessments (DPIAs).

• Provide cover for the DPO during absences.

• Coordinate DPIA work for the FSPO’s Complaint Management System.

The FSPO anticipates that the service requirements will average two days per week during normal office hours, with 24/7 access to support as needed.

3. Background & buyer context

The procurement of Data Protection Support Services is timely due to the increasing volume of complaints received by the FSPO, which rose by 29% in 2023. The FSPO, established on January 1, 2018, plays a crucial role in consumer protection by resolving complaints against financial service providers and pension providers. The need for enhanced data protection compliance aligns with the FSPO's strategic objectives to ensure robust consumer protection frameworks and effective complaint resolution processes.

4. Eligibility & selection criteria

Bidders must meet the following eligibility and selection criteria:

• Turnover requirement: Minimum average annual turnover of €35,000 for each of the three immediately preceding financial years.
• Insurance:
• Employers Liability: €13 million
• Public Liability: €6.5 million
• Professional Indemnity: €1.5 million
• Certifications: Not specified for this tender.
• Past experience: Two comparable projects of similar scale and nature completed within the last three years.
• Personnel: Key personnel must have relevant experience and qualifications, including a dedicated contract manager.
• Geographic / facility constraints: Not specified for this tender.

5. Award criteria & scoring

Bids will be evaluated based on the following criteria:

The overall scoring will follow a Most Economically Advantageous Tender (MEAT) approach.

6. Submission requirements

Bidders must submit the following documents:

• Method statement / response document: Use the provided Tender Response Document (TRD) template, adhering to any page limits.
• CVs: Include CVs for key personnel, with a focus on relevant experience.
• Pricing schedule: Complete the specified format in the TRD, excluding VAT.
• Case studies: Provide two examples of previous contracts of similar nature.
• Declarations: Include ESPD, Bona Fides, Tax clearance, and Conflict of Interest declarations.
• Mandatory site visit: Not specified for this tender.
• Submission portal: Tenders must be submitted via the eTenders postbox facility.

7. Key dates & process

8. Contract terms that matter

Key contract terms include:

• Duration: Initial period of two years, with up to two 12-month extensions based on performance and budget availability.
• Payment terms: Not specified in the documents.
• Key SLAs/KPIs: Regular performance reports required from the contract manager.
• Termination clauses: The FSPO reserves the right to terminate the contract for reasons outside its control, including changes in the Customs Union.
• IP ownership: Not specified in the documents.
• Sub-contracting rules: Allowed, but the main contractor must maintain overall responsibility.

9. Risks, red flags & unusuals

Potential risks include:

• The turnover requirement of €35,000 may limit participation from smaller firms.
• The contract's reliance on the successful tenderer’s ability to provide 24/7 support could pose challenges for smaller providers.
• The requirement for two comparable projects may disadvantage newer firms without extensive experience.
• The FSPO reserves the right to terminate contracts due to external factors, which may introduce uncertainty for bidders.

10. SME fit assessment

This tender is suitable for small to medium-sized enterprises (SMEs) with expertise in data protection services. Viable bidders should have:

• Experience in delivering data protection compliance services.
• The capacity to provide a dedicated contract manager and key personnel with relevant qualifications.
• The ability to form consortia or subcontract to meet financial and technical requirements.
• An indicative bid preparation effort of approximately 10-15 days.

The incumbent's strength and the potential for a sole-supplier framework may impact the likelihood of success for new entrants.

11. Where to dig deeper

• Source RFT filename: RFT - Data Protection Support Services.pdf
• eTenders CFT ID: not specified
• Contact for queries: Questions and Answers facility on www.etenders.gov.ie
• Important attachments:
• Tender Response Document (TRD)
• Award Criteria Document