UK supplier guide
GDPR bid management:
check the data, roles and contracts
GDPR bid management starts with the personal data your bid uses, why you process it, who controls it and what happens when you share it with a service provider.
Find a notice and check its requirements →Checked against primary sources4 sources linked below
- Identify the personal data
- Define purpose and roles
- Check providers and sharing
- Limit access and retention
Map the data
Identify personal data in the evidence pack and proposed uploads.Determine roles
Document purposes, means and controller/processor responsibilities.Review the contract
Check processing terms, subprocessors and end-of-contract arrangements.
What does GDPR bid management evidence establish?
GDPR bid management starts with the personal data your bid uses, why you process it, who controls it and what happens when you share it with a service provider.
PERSONAL DATA
- Identify why the personal data is needed.
- Who decides purposes and means?
- Who acts on documented instructions?
- Identify recipients and service providers.
Which bid documents need a personal-data review?
Read the requested evidence before deciding what your organisation can claim.
| Question | Evidence | Action |
|---|---|---|
| Staff CVs | Names, contact details and work histories | Limit content to what the response needs |
| Reference contacts | Named individuals and contact details | Check the basis and purpose for sharing |
| Service-provider uploads | Personal data shared with another organisation | Determine roles and contractual requirements |
How do you trace personal data through a bid workflow?
Start with the information and purpose, then check the roles, sharing and retention.
- Start with the source01
Identify the personal data
List the people and information included in evidence, correspondence and supplier records. - Define the scope02
Define purpose and roles
Establish why the data is used and who determines the processing. - Read the evidence03
Check providers and sharing
Review the contract, access and transfer arrangements relevant to the workflow. - Make the decision04
Limit access and retention
Keep the information needed for the task and define how long it remains available. - Name the next action05
Record and review
Keep the decisions and supporting evidence with an owner, using the ICO's current guidance.
A supplier’s review sequence, based on the primary sources below. It is not a measured outcome or a prescribed buyer timetable.
How would a supplier plan evidence for Northumbrian Water’s deadline?
Read the relevant lot documents and resolve the evidence question before the expression-of-interest deadline.
Northumbrian Water’s FA08-31 Commercial Services framework closes expressions of interest on 3 November 2026 at noon UK time.
Before responding for a relevant lot, a consultancy reviews the buyer’s requested evidence and identifies any staff CVs or named reference contacts it proposes to share.
It determines the purpose, the relevant organisation roles and any service-provider processing terms before uploading personal data.
CVs and reference contacts are illustrative evidence choices, not confirmed requirements of this notice or a claim that Northumbrian Water approved a particular platform.
- Who decides what data is processed and why?
- What does the service provider actually do?
- Does the agreement cover the processing?
- Who can evidence the applicable obligations?
What will the evidence review cost your team?
Estimate internal bid preparation using your own hours and hourly cost.
The ICO lists eight areas in its minimum contract terms: documented instructions, confidentiality, security, subprocessors, individuals’ rights, assistance, end-of-contract provisions and audits. Missing contract detail can leave bid data responsibilities unclear. This is a count of the ICO’s listed topics, not a compliance score. Read the primary source ↗
Enter the team hours spent gathering and reviewing this evidence per bid.
This calculator excludes certification, membership and external audit fees; it is not a compliance verdict.
Your bid effort
Starting figures are an illustration, not a measured average or a saving promised by RFP Quest.
£4,000 and 80 team hours each month if you prepare every bid.
Use the estimate to decide how much work to authorise before drafting starts.
It excludes software fees and external costs.
- This bid£2,000
- Other bids this month£2,000
What should the evidence owner check before you answer?
Check the actual evidence against the buyer’s wording.
CHECK THE PACK
- Record the agreed processing purposes.
- Check who can see bid personal data.
- Agree when the data is returned or deleted.
- Request evidence about provider safeguards.
What should the bid lead do first?
Resolve the requirement and evidence gaps before authorising the response.
- Before you start01
Use the current documents
Check the primary publication and later changes before using the sequence below. - Check 202
Map the data
Identify personal data in the evidence pack and proposed uploads. - Check 303
Determine roles
Document purposes, means and controller/processor responsibilities. - Check 404
Review the contract
Check processing terms, subprocessors and end-of-contract arrangements. - Follow through05
Approve sharing
Have the responsible person review the final files and recipients.
An editorial order of work, not a buyer's fixed timetable. The current notice and documents determine participation and submission.
What must you avoid promising in this bid?
State only the status and controls your organisation can substantiate.
CLAIM LIMITS
- A UK location alone does not establish compliance.
- Security measures are part of a wider assessment.
- Check provider processing and training terms before uploading.
- Keep the decisions and contract review on record.
Know why the bid needs personal data before deciding where to send it.
Map the data
Identify personal data in the evidence pack and proposed uploads.Determine roles
Document purposes, means and controller/processor responsibilities.Review the contract
Check processing terms, subprocessors and end-of-contract arrangements.
Read the official notice and the buyer’s current documents before allocating bid effort.
What else should you know about GDPR bid management?
Check these points before committing your team’s time.
Does UK data residency make bid software GDPR compliant?
Is encryption enough for GDPR compliance?
Do I need a data processing agreement for bid software?
Can I upload staff CVs to an AI tool?
Does this guide prove RFP Quest is GDPR compliant?
Where can you check the evidence?
Read the primary publication and the buyer’s current documents before acting.
| Source | What it supports |
|---|---|
| Northumbrian Water FA08-31 ↗ | Expression-of-interest deadline; no ISO or personal-data requirement inferred. |
| ICO — 1 ↗ | Roles depend on purposes and means, not contract labels. |
| ICO — 2 ↗ | Controller–processor contract topics. |
| Cabinet Office — 3 ↗ | Proportionate participation conditions under the Procurement Act regime. |
The ICO marks its controller–processor guidance as under review following changes made by the Data (Use and Access) Act; check the current guidance before relying on it.
Which guide answers your next question?
Follow the part of the bid you need to work on next.
