Data Protection Services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The Ombudsman for Children's Office (OCO) seeks a provider for Data Protection Services. The contract aims to support the OCO in fulfilling its obligations under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The services will be delivered to the OCO and staff working within its 5 units.

The scope of work includes, but is not limited to, the following activities:

• Compliance Monitoring: Ongoing monitoring of compliance with GDPR and related legislation.
• Policy and Procedure Development: Developing and implementing procedures and policies for data privacy and data protection.
• Reporting:
• Preparing monthly data protection governance reports.
• Preparing quarterly reports for presentation to the OCO’s Audit and Risk Committee.
• Incident Management: Managing data breaches, including response protocols.
• Data Subject Requests: Handling requests from data subjects concerning their personal data.
• Impact Assessments: Conducting Data Protection Impact Assessments (DPIAs) as required.
• Training: Delivering data protection training, including an indicative plan for one afternoon on-premise event.
• Contract Management: Managing data protection activities, including planning, issue management, reporting, and integration with OCO systems and processes.
• Resource Allocation: Providing detailed CVs of proposed resources and confirming their availability. An indicative work plan detailing tasks, associated resource requirements (hours, days), and costs is required.

The provider must demonstrate an understanding of the OCO's mission, vision, and risk profile, and how their services align with these. The services are expected to be delivered in the Republic of Ireland.

3. Background & buyer context

The Ombudsman for Children's Office (OCO) is procuring Data Protection Services to ensure compliance with data protection legislation. This procurement is driven by the need to implement obligations under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The OCO is the contracting authority for this tender. The tender documents do not specify an incumbent provider. The strategic driver is to maintain robust data protection practices within the OCO.

4. Eligibility & selection criteria

Tenderers must satisfy the following selection criteria to be considered for evaluation. These are pass/fail criteria.

• Economic and Financial Standing:
• Tax Clearance: Tenderers must possess a current Tax Clearance Certificate and provide evidence upon contract award.
• Social Security & Legal Obligations: Tenderers must be compliant with social security and legal obligations for the duration of any awarded contract.
• Insurance: Tenderers must provide evidence of the insurance policies specified in section 2.21.
• Turnover: No minimum turnover figure applies. Tenderers are required to supply turnover figures for all applicable years.
• Technical and Professional Ability:
• Previous Experience: Tenderers must demonstrate successful delivery of at least three comparable contracts (in scale, nature, quality, and complexity) within the three previous years.
• Detailed descriptions of services offered and their comparability to Appendix 1 requirements are needed.
• Details of client engagement to determine and deliver requirements must be provided.
• One of the three references must be for a public sector organisation.
• Quality Assurance: Tenderers must demonstrate adequate measures for quality service delivery.
• A description of the Tenderer’s quality assurance policy and procedures is required.
• Details of any third-party certification for quality assurance must be provided.

Tenderers relying on the capacity of other entities (subcontractors) must ensure those entities also satisfy the relevant selection criteria.

5. Award criteria & scoring

The contract will be awarded based on the Most Economically Advantageous Tender (MEAT). The evaluation will be conducted separately for each lot, if applicable. Tenderers must address all award criteria. Qualitative criteria will be assessed first. Only tenders meeting the minimum qualifying thresholds for criteria 1-5 will proceed to cost evaluation.

6. Submission requirements

Tenders must be submitted electronically via the eTenders.gov.ie portal.

• Tender Response Document (TRD): A mandatory TRD, provided as a separate attachment, must be completed and submitted. This document simplifies and streamlines the response and evaluation process.
• Format: Tenders must be submitted in English and compiled into readable formats (e.g., PDF, MS Word). Documents must not be corrupt.
• File Size Limit: A maximum of 4GB is permitted for combined uploaded documents.
• Pricing Schedule: Tenderers must complete the pricing schedule as set out in Appendix 2 of the RFT. Prices must be all-inclusive, in Euro, and exclusive of VAT. VAT rate(s) should be indicated separately.
• Validity: All prices quoted must remain valid for 6 months from the Tender Deadline.
• Declarations: Tenderers must submit:
• A scanned signed copy of the Tenderer’s Statement (Appendix 3).
• European Single Procurement Document (ESPD) (Appendix 4).
• Declaration as to Personal Circumstances of Tenderer (Appendix 5).
• Consortia/Subcontractors: If a group of undertakings submits a tender, details of all members and their roles, along with contact details for a single nominated entity, must be provided.
• Site Visit: Not applicable.
• Submission Portal: www.etenders.gov.ie. Tenderers must click "Submit Response" and can modify their submission until the deadline.

7. Key dates & process

8. Contract terms that matter

• Term: The Services Contract will have an initial term of twenty-four months.
• Extension: The Contracting Authority reserves the right to extend the term for one further period of twelve months, subject to legal obligations.
• Payment: Payments will be made in accordance with the Services Contract at Appendix 6.
• Pricing Validity: All prices quoted must remain valid for 6 months from the Tender Deadline.
• Currency Risk: Any currency variations over the contract term will be borne by the Tenderer.
• Termination: The contract may terminate on 14 days' notice. Specific clauses for breach and remedy are included.
• Sub-contracting: Where tasks are performed by subcontractors, a single entity (Prime Contractor) will carry overall responsibility.
• Tax Clearance: Compliance with all applicable EU and domestic tax laws is a condition of the contract. The successful Tenderer must provide Tax Clearance Access Number and Tax Reference Number for online verification.
• Environmental, Social, Labour Law: The successful Tenderer and subcontractors must comply with all applicable environmental, social, and labour laws, including Council Directive 2001/23/EC on transfers of undertakings.

9. Risks, red flags & unusuals

• Indicative Value vs. Contract Length: The estimated annual expenditure is €45,000 ex VAT, for a potential contract duration of 36 months (24 + 12). This suggests a relatively small contract value, which may influence the level of bid preparation investment.
• Clarification Deadline: The clarification deadline (11 August 2023) is significantly earlier than the tender submission deadline (6 October 2026). This requires bidders to formulate queries well in advance.
• No Minimum Turnover: The absence of a minimum turnover requirement is unusual for a public sector tender and may indicate a desire to encourage SME participation or a lower perceived risk profile for the services.
• Award Criteria Weighting: The significant weighting of qualitative criteria (87.5% combined for understanding, technical merit, methodology, resource availability, and sustainability) over cost (12.5%) indicates a strong emphasis on the quality and approach of the proposed service.
• Public Sector Experience Requirement: One of the three required comparable contracts must be for a public sector organisation, which may limit bidders who have primarily worked in the private sector.

10. SME fit assessment

This tender is structured to be accessible to Small and Medium Enterprises (SMEs). The absence of a minimum turnover requirement and the emphasis on quality over cost suggest that smaller, specialised firms can compete effectively.

• Credible Bidders: Viable bidders would likely be consultancies or firms specialising in data protection and GDPR compliance. They should have a proven track record of delivering similar services, including at least one project for a public sector organisation within the last three years. Firms with ISO 14001 certification or equivalent may have an advantage in the sustainability criterion.
• Consortium/Sub-contracting: Consortiums and sub-contracting are permitted. This allows SMEs to partner with other firms to meet requirements they might not be able to fulfil individually. Larger enterprises are also encouraged to include SMEs in their proposals.
• Indicative Bid-Prep Effort: Bid preparation will require significant effort. Tenderers need to thoroughly address all qualitative award criteria, including detailed methodology, resource CVs, and sustainability approaches. This could range from 10-20 days of dedicated effort for a well-prepared bid, depending on the firm's existing documentation and resources.
• Pwin Signal: The tender does not explicitly indicate an incumbent or a framework. The strong weighting of qualitative factors suggests that a well-articulated understanding of the OCO's specific needs and a robust, tailored methodology will be key differentiators. The requirement for public sector experience is a specific hurdle.

11. Where to dig deeper

• Source RFT Filename: OCO - RFT Data Protection Services.pdf
• eTenders CFT ID: Not specified in the provided text.
• Contact / Clarification Portal: Messaging facility on www.etenders.gov.ie
• Key Attachments:
• Appendix 1: Requirements and Specifications
• Appendix 2: Pricing Schedule
• Appendix 3: Tenderer’s Statement
• Appendix 6: Services Contract