Winning work through a tender can not only bring in vital income to the business, but rewards the time, often a significant amount, spent on completing the documentation.
GDPR, compliance, data protection, security and privacy are asked about in tenders – and you’ll need to demonstrate that everything is in order; not only in your own house, but in your suppliers’ too.
A business simply cannot risk allowing a third party to be privy to sensitive information without the correct permissions as well as the reassurance that they will handle it properly and securely.
That’s why if your business is involved in the tendering process, demonstrating your data protection credentials is essential to success; you may be favourable in all areas of the tender, but if you aren’t compliant with the data protection framework, this could be your downfall.
Having everything in place before you start a tender is a good idea – because you might run out of time before the tender submission date if you need to make changes.
There are a number of measures you could be asked to prove when bidding for work; it might seem a long list at first glance but don’t worry, many of these processes are simple to put in place if you’ve not quite got your GDPR all in order.
Every business is different in how it handles data and the level of security and compliance it needs –knowing what you already have in place is a sensible place to start, then you know what you need to do.
1. Data minimisation
You should only ever collect and process personal data necessary for a particular project and be able to demonstrate why and how it’ll be used. An additional benefit is that it demonstrates your systems are organised and efficient, rather than overloaded with information that is of no benefit to your business. Keep what you need and delete or archive what you don’t.
2. Retention
A retention policy outlines what data you have collected, how it’s been stored and how long you will keep it for. You should only keep and securely store information for as long as you need it in line with legal requirements and best practice, after which time it needs to be responsibly archived or deleted from your systems and personnel access.
3. Security
Cyber-attacks are becoming more sophisticated; even more reason why protecting your data is critical. Outline in the tender any specific measures you have in place that protect you from cyber-attack or data breach as a result. Include information on relevant certifications, such as ISO27001, an internationally recognised best practice information security system, as well as Cyber Essential and Cyber Essentials Plus, which are government-backed schemes that help protect your data. Any investment in time, software and processes that fit into security, particularly related to cyber-attack, should be included.
4. Privacy risks
Do you carry out Data Protection Impact Assessments? This is a process for identifying and assessing potential risks to data, as well as mitigating them. It’s a task that should be undertaken whenever working on a large project that involves processing data. Be ready to explain when and how you do this when talking to potential partners through a tender process.
5. Data subject rights
Can you demonstrate that your customers or clients understand why you want their personal information and what you’re going to do with it? Is this clearly explained to them at the point of sharing their details with you? It’s important to demonstrate that the people you hold data on, know exactly what they can expect about how you will use, store and share their data, plus at which point deletion or archiving occurs too.
6. Customer contact
Be prepared to explain how you handle contact from your customers. This could be simply making changes to the information you have about them, or responding to a Data Subject Access Request. The latter is a more detailed process that must be completed within a specific timeframe, so having detailed, meticulously organised records is vital to making this process easier and achievable in the timeframe it requires.
7. Data sharing
Part of the tender process might involve sharing data with third parties; in which case, you will need to show how your process complies with data protection rules. This could involve drawing up a data processing agreement to outline individual responsibilities and any required safeguarding.
8. Data Protection Officer
Most small businesses will not have the capacity or need for a full-time data protection officer. However, there should be someone within your organisation who is responsible for overseeing GDPR policies and ensuring that data protection is compliant. You’ll need to show that the member of staff is adequately trained and regularly updated. Alternatively, this might be a role that you outsource to an expert on an ad-hoc basis. (Ask us about our Data Protection Officer service).
9. Training
Training staff so that everyone in a team understands how they should and should not store, access and use data helps to avoid potentially serious issues such as data breaches and reputational damage. Explain how you keep staff up to date with the latest guidelines and what you do to promote data protection compliance. If a data breach occurs due to lack of training, future tenders and your reputation could be jeopardised.
10. Documents
Show that you keep detailed records of how you process data, any risk assessments and how you ensure compliance. These not only demonstrate that you are compliant in data protection, but can be invaluable when it comes to being audited.
If your business has all these points covered, well done – you are likely to have all you need for your next tender.
But if you can’t tick any or very few, or you’re just not entirely confident you’ve got them all covered, don’t fret – get in touch for some friendly, expert advice.
Ask about our assessment to identify where you are and next steps to tender-ready compliance.
Call on 0207 294 7599 or email hello@businesstamer.co.uk