Data services

Tender description

The introduction of the General Data Protection Regulation (GDPR) has meant that Kirklees Council and its associated agencies (Contracting Authorities) require support with their information governance activities. As such the Contracting Authorities have established a Framework Agreement to access the support it requires, in order to enable the achievement of GDPR compliance across all of the Contracting Authorities. The agencies associated with the Council include Maintained Schools and Academy Trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service Providers (2 organisations). All of these agencies operate with a significant amount of personal data and therefore require support with their GDPR implementation. The Framework Agreement has 8 Lots. This activity requires the economic operator to audit the culture and practices of the commissioning Contracting Authority, conduct a GAP analysis of existing practices compared to GDPR requirements and support the commissioning Contracting Authority to bring their practices into line with GDPR requirements. This will include assessments and an audit report for: — data protection frameworks, — policies and procedures, — data processor management, — records management, — information security, — Incident management. It is expected that the final assessments and investigation will be consolidated into an audit report, providing full details of recommendations and expected future actions to enable GDPR compliance. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). Data processor management is a key requirement for GDPR compliance. Organisations must have relevant and appropriate contracts in place with all of their data processors. However, some organisations may not have the appropriate contract management in place. This lot required the provider to demonstrate how they will provide the services outlined below, including the provision of previous work carried out successfully in other organisations. The outcomes of this activity include: — full, organisation-wide information audit of paper and electronic records, and key application data including data flow mapping activities associated with each data set, — identification of key information metadata including asset ownership, — development of an information asset register, — development of an organisation record of processing activity, — training for organisation IG leads on how to conduct these activities in future. This training was required to be outlined within the tender documentation with an expectation that a minimum half day would be required to train the contract management staff within the commissioning Contracting Authority and should be accompanied by materials for the trained staff to refer to following contract completion. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). GDPR requires the culture of an organisation to have privacy and data protection principles at the foundation of all business practices involving the use of personal data. This is known by the Information Commissioner's Office (ICO) as Privacy by Design. Privacy by Design practices must be embedded within all work involving the collection and processing of personal data. The economic operator is required to: — identify all activities within the organisation which utilise personal data, — identify the Data Protection Impact Assessment for each activity, — if a DPIA has not been completed for an activity, create a DPIA for the activity, consulting with contracting authority IG leads throughout, — identify the privacy notices which have been created for each activity, — create a Privacy Notice if there is not one available for the activity, — work through the procedures relating to each activity and adjust the procedures to ensure these include privacy by design in future, — provide the contracting authority IG lead with a template DPIA and privacy notice and training on how to complete these in the future. This training was required to be outlined within the economic operator's tender documentation with the expectation that a minimum half day would be required to train the identified staff within the contracting authorities and should be accompanied by materials for the trained staff to refer to following contract completion. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). Organisations must have a clear and thorough knowledge of the information assets they hold, how they store their records and when they have destroyed records. This lot requires the economic operator to support the commissioning Contracting Authority with the establishment and management of a records management plan which, when followed, will enable GDPR compliance. The economic operator is required to conduct a comprehensive information asset audit, resulting in the creation of a comprehensive records management plan which will outline the current state of the records held by the commissioning Contracting Authority, both paper and electronic, and provide detailed recommendations of the changes and improvements which need to be implemented in order to successfully be able to achieve and retain GDPR compliance. The economic operator is also required to provide the commissioning Contracting Authority with templates and training to the IG leads to ensure compliance can be maintained. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). The GDPR requires personal data to be processed in a manner that ensures its security. This includes protection against accidental loss, destruction or damage and appropriate methods to report incidents to key personnel to ensure any mandatory reporting can be carried out. This lot requires the economic operator to: — identify suitable technical or organisational measures for the commissioning Contracting Authority. This should include writing policies and procedures, setting up incident reporting arrangements and mandatory notification procedures, — implement measures for incident reporting across all departments, including awareness raising and guidance documents for all staff. These measures will be sufficient to ensure that commissioning Contracting Authority's staff understand the requirements associated with information security incident management, and — give training on the new approaches/procedures to key members of staff with full guidance for reference at a later date. This training may be an hour long session for all members of staff, or it may be an online video for staff to complete in their own time, with auditable completion figures for the commissioning Contracting Authority. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). Organisations should have an established data protection framework which outlines the organisational policies, procedures and appropriate legislation guidance for their data protection activities. The economic operator is required to assess through a GAP analysis what policies, procedures and guidance the organisation currently has, determine their appropriateness for GDPR compliance and identify what is missing. The economic operator will then create and/or amend the policies, procedures and guidance documents the commissioning Contracting Authority will require to ensure that all data protection activities required by GDPR, have been identified and appropriately actioned within the framework. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). In order to embed data protection within all areas of an organisation, it is valuable for organisations to train their staff across the whole data protection spectrum. Where a commissioning Contracting Authority requires all staff to have training on data protection, the economic operator is required to work with the commissioning Contracting Authority to plan, deliver and follow up on training sessions delivered to organisational staff. Whilst other lots may provide training to the appropriate individuals on those specific topic areas, this lot requires generic data protection training, based upon the principles of GDPR and the wider responsibilities this legislation puts on all staff within the commissioning Contracting Authority. This training is expected to be delivered on site at the commissioning Contracting Authority's facility but could be provided through a range of media options. The economic operator should provide: — an organisation-wide assessment of learning needs, awareness challenges and knowledge gaps, — A multi-component campaign, tailored to the commissioning contracting authority's needs and culture, — evaluation measures to provide the organisation with a reliable audit trail of the success of the programme and completion logs for each participant. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”). This lot requires the economic operator to provide full Data Protection Officer (DPO) services to the commissioning Contracting Authority. The DPO should hold Information Governance and Assurance qualifications, preferably with specific DPO training. The DPO will be easily accessible by the commissioning Contracting Authority and will act as a point of contact for employees, individuals and the ICO. The DPO will perform the following tasks: — monitor compliance with the GDPR and other data protection laws, the commissioning Contracting Authority's data protection policies, awareness-raising, training, and audits, — provide advice and the information around the commissioning Contracting Authority’s data protection obligations, — monitor the DPIA process and provide advice as required, — acts as a contact point for the ICO, cooperating with the ICO, including during prior consultations under Article 36 of the GDPR, and will consult on any other matter, — have due regard to the risk associated with processing operations, and take into account the nature, scope, context and purposes of processing. The commissioning Contracting Authority will be required to purchase these services on an annual basis, with a rolling contract arrangement, renewed within one month of contract anniversary. The Framework Agreement will be available for use by the Council and other Contracting Authorities within the Borough of Kirklees; which include maintained schools and academy trusts (160+ organisations), Town and Parish Councils (5 organisations) and Housing Service providers (2 organisations). The Service is not subject to the implications of the Acquired Rights Directive EU2001/23/EC and the Transfer of Undertakings (Protection of Employment) Regulations 2006 (SI 2006/246) (as amended) (“TUPE”).