Which documents do you need to demonstrate data protection compliance to a contracting authority or insurer?
When a contracting authority or an insurer asks you to demonstrate that you handle personal data carefully, it usually comes down to a fixed package: a record of processing activities, the data processing agreements with your own suppliers, a privacy notice, an overview of the security measures you apply, and a brief description of how you handle a data breach or a request from a data subject. In a procurement process, this often comes with a completed questionnaire or a declaration; with an insurer, it's more of an intake form for a cyber policy.
The reason this package keeps coming up is that the GDPR includes an accountability obligation: an organization must not only process personal data carefully, but also be able to demonstrate it. A contracting authority or insurer therefore does not test whether you "do something about privacy", but whether you can show it on paper. That is precisely the detail that matters at this purchasing moment: not the intention, but the proof.
The record of processing activities as the backbone
The record of processing activities is usually the first document that is requested, and also the document on which the rest is built. It states which personal data you process, for what purpose, who receives it, and how long you retain it. A contracting authority can quickly recognize from this whether an organization has structurally thought about its data flows, or whether the record was drawn up specifically for the application. What exactly must be included and how detailed, you can read in the knowledge base with explanations by topic.
Data processing agreements with your own suppliers
The second document that is almost always requested is an overview of data processing agreements: the agreements you have concluded with the SaaS tools and service providers that process personal data on your behalf. Think of a payroll package, a CRM system, or a cloud service for files. A contracting authority or insurer not only wants to see that these agreements exist, but also that they are current and match the tools that are actually used. A record that mentions three suppliers while eight are active in practice will quickly stand out in a thorough review.
Security and handling of incidents
In addition to the record and the agreements, organizations are often asked about the organizational and technical measures that have been taken: who has access to which systems, how is data encrypted, is there a backup strategy. Insurers often ask this explicitly in a questionnaire for premium calculation. An overview of the measures taken can be found on the page on security of personal data. In addition, organizations are regularly asked how they recognize and handle a data breach: is there a procedure, does someone know who to alert and within what timeframe. The decision tree that determines whether an incident is reportable can be worked through in a few questions to see where you roughly stand.
What a checklist does not solve
It is tempting to see these documents as a checklist that you tick off in one afternoon. That does not work well, and that is immediately the pitfall at this purchasing moment. A record of processing activities that does not match the actual tools, or a data processing agreement that has never been reviewed, will not stand up to thorough review. Supervisory authorities and contracting authorities also look at coherence: do the documents fit together, and is it plausible that they are kept up to date rather than drawn up once.
For this reason, it is more useful to see these documents as an ongoing whole that moves with the tools and processes you use, rather than as a one-time set of documents for a single application. How this structure looks and where the information comes from is explained on the page how the system is set up.
When should you consult a lawyer
A procurement condition or an insurance policy condition may impose specific requirements that go beyond the GDPR itself, for example a mandatory ISO certification or a liability clause. Whether your documents meet those requirements is a legal assessment that belongs to the specific contract or policy, and you are best advised to have it reviewed by a lawyer or, if you have doubts about the GDPR itself, to consult the Dutch Data Protection Authority.
Would you like to see which documents are already in order for your situation and which are still missing? Do the free quick-scan or read the other topics in the knowledge base to determine where you stand now.