Data Protection Advice, Consultancy and Related Services II

This prior information notice serves as announcement of EBA´s market consultation. EBA wants to obtain information from the economic operators on this relevant market. Please request the questionnaire by email to tenders@eba.europa.eu and fill it in to help EBA in its market analysis. This market consultation will be open until 13/12/2024. When performing their tasks stemming from the EU legislation, the contracting authorities are required to assess and analyse complex technical and legal aspects in order to implement appropriate legal, technical and organisational measures to adhere to data protection principles such as lawfulness, fairness and transparency, , accuracy, data minimisation and security (in terms of integrity and confidentiality) of personal data processing. The services covered under the framework contract should provide the contracting authorities with the information and assistance required on privacy and the protection of personal data, including but not limited to:

- Provide general support and advice to contracting authorities on effective ways to process personal data in compliance with existing regulation(s) and policies, including advice on privacy and data protection software. - preparation of drafts and revision of existing or new policies, processes and/or manuals addressed to experts, staff, external stakeholders and/or management;

- establishment of technical, organisational and operational measures for the implementation of policies;

- definition and documentation of technical standards required for the efficient and sustainable establishment of policies;

- definition and documentation of working instructions required for the efficient and sustainable establishment of policies;

- monitoring and assessment of the effectiveness of the current and future implementation of policies, proposing working instructions;

- preparation and execution of regular exercises to verify the preparedness of staff of the contracting authorities and the correctness of the policies and the procedures/working instructions, including updates of the documentation;

- conducting audits and compliance checks;

- defining and proposing master plans or short/medium term remediation plans, with the aim to reduce the risks and to remove threats also in the event of predictable changes in the existing legislation and standards;

- organisation and delivery of training and awareness raising actions for staff of the contracting authorities and other stakeholders. In providing advice and assistance to the contracting authorities as part of the services described above and further specified below, the contractors may provide support to the Data Protection Officers of the contracting authorities. Nevertheless, for any services which may be provided as described above and further specified below, the contractors shall not replace the Data Protection Officers in the performance of their tasks.

When performing their tasks stemming from the EU legislation, the contracting authorities are required to assess and analyse complex technical and legal aspects in order to implement appropriate legal, technical and organisational measures to adhere to data protection principles such as lawfulness, fairness and transparency, , accuracy, data minimisation and security (in terms of integrity and confidentiality) of personal data processing. The services covered under the framework contract should provide the contracting authorities with the information and assistance required on privacy and the protection of personal data, including but not limited to:

- preparation of drafts and revision of existing or new policies, processes and/or manuals addressed to experts, staff, external stakeholders and/or management;

- establishment of technical, organisational and operational measures for the implementation of policies;

- definition and documentation of technical standards required for the efficient and sustainable establishment of policies;

- definition and documentation of working instructions required for the efficient and sustainable establishment of policies;

- monitoring and assessment of the effectiveness of the current and future implementation of policies, proposing working instructions;

- preparation and execution of regular exercises to verify the preparedness of staff of the contracting authorities and the correctness of the policies and the procedures/working instructions, including updates of the documentation;

- conducting audits and compliance checks;

- defining and proposing master plans or short/medium term remediation plans, with the aim to reduce the risks and to remove threats also in the event of predictable changes in the existing legislation and standards;

- organisation and delivery of training and awareness raising actions for staff of the contracting authorities and other stakeholders. In providing advice and assistance to the contracting authorities as part of the services described above and further specified below, the contractors may provide support to the Data Protection Officers of the contracting authorities. Nevertheless, for any services which may be provided as described above and further specified below, the contractors shall not replace the Data Protection Officers in the performance of their tasks.