What does a procurement process ask about privacy?

Procurements primarily request demonstrable GDPR compliance

A procurement rarely asks for an extensive legal document, but rather for evidence that a bidder has its affairs in order. In practice, it concerns a few recurring topics: whether a data processing agreement will be concluded when the contract involves personal data, what security measures are taken, whether subcontractors (sub-processors) are engaged and where they are established, and whether the bidder can demonstrate that it knows and documents its own processing activities.

Many contracting authorities additionally explicitly ask whether a bidder has appointed a data protection officer, and sometimes whether there is experience with a data protection impact assessment. Whether such an officer is mandatory depends on the bidder's own situation and the country where it is established: in the Netherlands, the obligation follows from Article 37 of the GDPR without a staff threshold, whereas in Germany a threshold of twenty employees applies under national law. What remains the same everywhere is that a bidder must be able to demonstrate what it does and why that complies — not that it submits one specific document.

This follows from the accountability principle and the rules for processors

The fact that a procurement asks for demonstrability instead of a certification mark aligns with Article 5 of the GDPR: the accountability principle means that an organisation must be able to demonstrate that it complies with the principles of the regulation, without the regulation prescribing via which specific document that occurs. When the contract entails that the bidder processes personal data on behalf of the contracting authority, Article 28 of the GDPR is the basis for the requirement that a data processing agreement is concluded, including inter alia arrangements on sub-processors and security measures. For the question of when a data protection officer is mandatory, and to whom a data breach is reported, a bidder in the Netherlands applies the Dutch Authority for Data Protection and the Implementation Act GDPR; for a bidder in another country, their own national supervisory authority and legislation apply, even though the core of the GDPR is the same everywhere.