Document template · Free
GDPR and data protection statement
What wins points
A clear, concrete data‑protection by design statement demonstrates compliance with EU law and can earn positive weighting under Article 67 award criteria when the authority values risk mitigation.
What gets bids disqualified
Missing or vague data‑protection statements cause failure of eligibility checks and may lead to outright disqualification for not meeting the technical specifications requirement (Article 42).
Evaluator's view
Check that the statement explicitly references Article 42 and includes measurable protection measures such as encryption, pseudonymisation, and DPIA evidence.
GDPR and data protection statement
What this is
A concise statement describing how the contractor will comply with EU data protection requirements in the procurement, particularly regarding "data protection by design" when drafting technical specifications.
When you need it
Needed during the preparation of technical specifications (Article 42) and any part of the tender where personal data will be processed. It is usually mandatory for public‑sector contracts that involve handling personal data.
How to fill it in
- Identify whether the contract requires processing of personal data (check the procurement documents).\
- Summarise the measures you will implement to ensure data protection by design and by default (e.g., pseudonymisation, access controls, retention periods).\
- Reference any certifications or standards you comply with (ISO 27001, GDPR compliance audit).\
- State the contact person for data‑protection queries.
Template
**GDPR and Data Protection Statement** 1. **Scope of Personal Data Processing**: ___________________________________________ 2. **Data‑Protection by Design Measures**: - ______________________ - ______________________ - ______________________ 3. **Relevant Certifications / Standards**: ________________________________________ 4. **Contact for Data‑Protection Queries**: _______________________________________ (Name, Email, Phone) 5. **Reference to Tender Requirement**: Article 42 – Technical specifications; Recital 77 of Directive 2014/24/EU (data protection by design).
Paste your draft response — free teaser, €9 full report
Already filled this in? We'll score your actual text against the same wins-points / disqualifies rubric above and quote your own words back for every finding.
Evaluate my draft →Related guides
Get the daily EU tender brief
Free templates, plus the live tenders that match your capability — one email a day, no card required.