The limits of GDPR clauses in calls for tenders
Here we are. New calls for tenders now include GDPR annexes.
An extract from the annex to a recent call for tenders:
“The contractor shall make available to the [Data Controller] the documentation needed to demonstrate compliance with all of its obligations and to allow audits, including inspections, to be carried out by [the Data Controller] or another auditor it has appointed, and shall contribute to these audits […]”
It also refers to keeping an up-to-date record, ensuring the confidentiality of data, having a Data Protection Officer (DPO), etc.
The subcontractor therefore makes a contractual commitment. Perfect. But is that enough?
To state the obvious, it is the bare minimum, since it is quite simply a matter of complying with the law. It also makes it possible to set out a few principles for sharing the burden should the authorities step in (the CNIL, the French data protection authority).
On the other hand, by limiting yourself to a purely declarative contractual annex, you do not know where the subcontractor stands in terms of its maturity and its GDPR compliance. And yet a few indicators could provide an initial assessment.
Assessing your suppliers’ GDPR maturity: where do you start?
To go beyond a simple contractual clause, it is important to assess the GDPR maturity of subcontractors in concrete terms. Here are a few examples of questions to ask:
- Do you have an autonomous DPO with the appropriate professional qualifications?
- Have you made all your employees who handle personal data aware of the issues?
- Do you host personal data outside the European Union? If it is in the United States, have you checked whether your provider appears on the list of companies certified under the Data Privacy Framework (which replaced the Privacy Shield, invalidated in 2020)?
- Provide the description of the processing for the B2B customer relationship
- Do you have a Chief Information Security Officer (CISO) or equivalent?
- …
For each question, evidence should be provided. This comes close to what some companies do when they assess the cybersecurity compliance of their partners. Step by step, you thus build up an appreciation of the subcontractor’s commitment to protecting personal data, via a Compliance Assurance Plan, a cousin of the Supplier Security Assurance Plan.
Clearly, this can take time, but tools exist to make the process smoother. And, as this GDPR annex points out, it is necessary to “take into account, with regard to its tools, products, applications or services, the principles of data protection by design and data protection by default”. This Privacy by Design principle should become widespread, with clients building the assessment of their future subcontractors’ practices into the consultation phase, together with purchasing.
