Software package and information systems

Tender description

A Data Privacy Impact Assessment tool was required to meet the requirements of the Data Protection Act 2018. The new EU GDPR regulation was adopted on 27.4.2016. It applies in the UK from 25.5.2018 after a 2-year transition period. The university is aiming to have an effective way for staff across the University to assess the privacy impact of proposals involving the use of personal data. Under the new Act the University needs to evidence its compliance with data protection legislation. The University of Edinburgh has elected to carry out this project as an EU tender to reach the widest possible market rather than because the expected value will be over the OJEU threshold for public procurement. The introduction of a Data Privacy Impact Assessment tool is a core part of the University’s strategy to meet the requirements of the Data Protection Act 2018. It will become compulsory for staff across the University to routinely carry these out when using personal data, for example when: A Data Privacy Impact Assessment tool is required to meet the requirements of the Data Protection Act. The new EU GDPR regulation was adopted on 27.4.2016. It applies in the UK from 25.5.2018 after a 2-year transition period. The university is aiming to have an effective way for staff across the University to assess the privacy impact of proposals involving the use of personal data. Under the new GDPR the University needs to evidence its compliance with data protection legislation. The tool is required to help staff across the University ensure their projects, strategies and initiatives are data protection compliant from the outset. The objective is to implement a process based solution to record all Privacy Impact Assessment documentation to meet the requirements of the Data Protection Act. Due to the Act for each business area retaining/moving/sharing personal info they need to complete a Privacy Impact Assessment). It is generally approved that this is delivered as a software as a service or licence/s, so each business area can call this off, complete record and it is maintained or published centrally. The introduction of a Privacy Impact Assessment tool is a core part of the University’s strategy to meet the requirements of the Data Protection Act. It will become compulsory for staff across the University to routinely carry these out when using personal data, for example when: — building new IT systems for storing or accessing personal data, — developing legislation, policy or strategies that have privacy implications, — embarking on a data sharing initiative or Using personal data for new purposes.