GDPR Compliance Assessment - Analyst Team

Tender description

Why the Work is Being Done The new Data Protection Bill, which includes GDPR, provides greater visibility and access to people who have their data stored and used by an organisation. The new laws ensure that the data is not only protected to the best of the organisations’ capabilities but that it is only used for the initial purposes for which it had been collected. GDPR will be enforced from the 25th May 2018. This specific analysis is being undertaken to assist ongoing assessments of the MoJ's GDPR compliance status for IT systems. Problem to Be Solved The MoJ seek to understand the scale of GDPR non-compliance across the organisation, gather information to begin remediation efforts and fill the knowledge gap that currently exists. Who Are the Users As a technology owner/information asset owner, I need to understand the level of compliance of IT with the new data protection laws, so that I can make appropriate investment and ensure the IT is compliant. Early Market Engagement No Work Already Done Yes - We have undertaken a pilot assessment of 5 systems, ● CCMS [LAA] ● NOMIS [HMPPS] ● Tariff System [CICA] ● BRAVO [IRS] ● LIBRA [HMCTS] Existing Team The team currently consists of 2 people, a Civil Servant and a Contractor. Working closely with a central GDPR team. Current Phase Discovery Work Location Ministry of Justice, 102 Petty France, London, SW1H 9AJ Working Arrangments Working onsite for a minimum of 3 days a week for team meetings, catch ups and meetings with system owners. Security Clearance BPSS as a minimum Additional T&Cs Standard Contract Terms Skills & Experience Research and gather information from a range of sources. Communicate and engage with stakeholders at all levels. Utilise organisational skills to manage multiple work-streams. Time efficient and able to deliver on time sensitive tasks. Adaptable, responsive and able to work without close supervision. Ability to follow approved methodology. Pro-active in information gathering. Nice to Haves Build relationships quickly with a range of stakeholders. Interpret and analyse findings and identify data gap. Understand requirements quickly. Comfortable working in a team and as an individual. Use a range of techniques to analyse situations, and quickly gain actionable insights into how to resolve problems. Knowledge of GDPR. Knowledge and experience of the MoJ. No. of Suppliers to Evaluate 8 Proposal Criteria Value for money. Estimated timeframes for the work. How they’ve identified risks and dependencies and offered approaches to manage them. Team structure. Skills and experience of team members. Cultural Fit Criteria Work as a team with our organisation and other suppliers. Be transparent and collaborative when making decisions. Have a no-blame culture and encourage people to learn from their mistakes. Take responsibility for their work. Learn quickly and synthesize information effectively. Share knowledge and experience with other team members. Follow approved methodology and suggest improvements. Can work with clients with low technical expertise or knowledge of GDPR. Comfortable working with a range of stakeholders . Payment Approach Time and materials Assessment Method Written proposal Case study Work history Reference Evaluation Weighting Technical competence 50% Cultural fit 20% Price 30% Questions from Suppliers Budget range maximum £200,000