Answer an RFP privacy question before design is final

Scope

Freeze the question before classifying the parties

A privacy role is not an attribute of a company in the abstract. It belongs to identified processing. Begin with the current invitation, questionnaire, draft contract, definitions, clarifications and evaluation method. Record whether the buyer wants a legal characterization, a proposed operating model, an Article 28 schedule, a description of safeguards or all four. Fix the jurisdiction and the date at which the answer must be true. A statement due at bid submission can differ from a configuration that must exist before live data enters the service.

Define the offer next. Northborough is a fictional authority, and its facts are illustrative. Its proposed service has applicant intake, eligibility review, placement matching, messaging, user administration, support and optional outcome reporting. The bidder has several service editions and cannot answer from a group privacy policy. The record must name the contracting entity, operating entities, selected functions, buyer-controlled settings, integrations, providers and material data flows.

The procurement rule still matters. Current UK guidance says award criteria and the assessment method must be sufficiently clear, measurable, specific and tied to the contract. Mirror the requested answer form and expose the evidence the evaluator can assess. Do not turn a legal caveat into an empty response. State what is known, which design branch changes the answer and who closes it.

Activity model

A product boundary is too coarse for a role decision

Split the service when the reason for using personal data changes. Northborough processes applications to administer a public programme. The supplier may process those applications on documented instructions. Supplier account administration protects access to the service. Support diagnosis may use a bounded copy to resolve a ticket. Cross-programme analysis may serve the buyer, several commissioning bodies or the supplier. These are not one purpose merely because the same platform touches them.

For each activity, describe the affected people, data categories, source, operations, recipients, duration and disposal. Then record who decides why it happens. Capture the decisions about essential means: which people and data are in scope, what material operations occur, who receives data and how long identifiable records are needed. Record practical implementation choices separately. The EDPB explains that a processor can decide non-essential means, such as specific technical implementation, while purposes and essential means remain decisive for the controller analysis.

One party can hold different roles for different activities. A supplier could be proposed as processor for buyer-directed case handling while acting in another capacity for its own account-security records. That possibility is neither an admission nor a conclusion. It is a reason to avoid the word “solely” until each material activity has been assessed.

Role branches

Write a role hypothesis that another reviewer can disprove

A useful role row contains a proposed classification and the facts on which it depends. “Supplier is processor” is incomplete. A reviewable position says that the buyer determines the apprenticeship-case purpose, applicant categories, mandatory fields, eligibility logic, authorized recipients and retention; the supplier performs named operations under documented instructions and chooses bounded implementation details. It also states which fact would defeat the position, such as a supplier-determined secondary purpose for identifiable applications.

Joint control needs its own analysis. Cooperation, a shared database or a contract does not settle it. The EDPB asks whether parties make common decisions or separate decisions that converge so the processing would not occur in the same way without both. If that hypothesis is confirmed, the schedule must lead to an allocation of responsibilities, an accessible account of the arrangement and working rights routes. It must not imply that every responsibility is equal or that one arrangement covers separate activities automatically.

Do not negotiate the label before understanding the function. Article 28 contracts matter when one party processes on behalf of another, but the contract must describe the real processing. Under the GDPR, a processor that determines purposes and means contrary to the regulation is treated as controller for that processing. The schedule therefore precedes the contract schedule and feeds it; a heading in the contract cannot repair contradictory product behavior.

Consequences

A changed role changes more than the contract noun

Follow the branch into each affected duty. A processor branch needs documented instructions, a contract or legal act with the required processing detail, confidentiality, security, assistance, return or deletion, audit support and controlled appointment of subprocessors. A joint-controller hypothesis raises an Article 26 arrangement and a transparent account of responsibilities. A separate controller activity needs its own purpose, legal basis, transparency, rights route, retention and accountability analysis. Qualified counsel must decide the exact consequence under the applicable regime.

Privacy by design belongs at the branch decision, not after award. The EDPB’s Article 25 guidance links safeguards to the choice of means and to processing itself. Record data that can be excluded, defaults, access, retention, separation and evidence for each branch. If an option is likely to create high risk, route it to the controller that must decide whether and how to complete an impact assessment before the processing begins. The bid should not promise that another party’s statutory judgment has already been made.

Trace provider chains too. EDPB Opinion 22/2024 says controllers should have the identity of processors and subprocessors readily available and must verify sufficient guarantees, with the depth of verification varying according to risk. For the offer, identify which branch invokes which provider, processing, data and location. This article does not answer the separate residency and transfer question, but the chosen role and chain must link to that analysis.

• Identify the party that issues and changes instructions for each processor activity.
• Describe who gives privacy information and who receives each type of rights request.
• Update the processing records and contract annex with the selected purpose, data and duration.
• Name the owner of any impact-assessment decision and the event before which it must close.
• Link each provider to the activity and branch that makes it necessary.
• Keep data-location and international-transfer conclusions in their dedicated assessment.

Evidence

Evidence the facts that drive the role, not the label itself

Role evidence is distributed. The tender and service description show intended outcomes. Configuration records show who can select fields, rules and recipients. Product decisions explain why optional telemetry or improvement uses exist. Data-flow records show operations and parties. Processing records, privacy information and contract drafts show the documented position. None is decisive alone. Index the facts and contradictions that counsel needs, with service version, date, owner and disclosure class.

Use separate states. A verified fact has current evidence for the offered configuration. A proposal is a deliverable commitment that still needs implementation. An assumption is a condition supplied by the buyer or bid team. A legal hypothesis is pending authorized review. An unknown lacks a defensible value. These states keep the bid useful without letting “proposed” or “expected” disappear during editing.

The evidence pack should be proportionate to the evaluated claim. Provide the answer, branch schedule and safe references in the response. Keep personal data, internal legal advice, sensitive configurations, security findings and customer-confidential material out of public or broadly shared annexes. A controlled diligence route can expose further evidence only when the procurement permits it and the owner approves access.

Response form

Give the evaluator a direct answer and a controlled condition

Do not open with a lecture on data-protection law. Answer the stated proposition, identify the exception and point to the schedule. For Northborough, an approved response might say: “For buyer-directed application, case-management and configured matching activities, we propose that Northborough acts as controller and the supplier as processor. That position depends on Northborough determining the purposes, applicant data, material rules, recipients and retention described in Schedule PR-02. Optional supplier-defined comparative analysis is excluded from the offer. Account-security processing is assessed separately and is not covered by the blanket processor statement.” Counsel must approve the wording for the real facts and jurisdiction.

If the buyer requires a yes or no field, use the permitted qualification route rather than forcing a misleading absolute. A response can select “No” and explain the activity-level exception, or select the value specified by an official clarification. Do not alter a mandatory form silently. If the instructions prohibit qualification and the absolute statement remains inaccurate, escalate the commercial and legal decision before submission.

Keep the short answer consistent with the data-processing schedule, service description, subprocessor disclosure, security response, implementation plan, privacy information and price. A product option excluded to preserve the stated model cannot reappear in a demo script or implementation work package. The role schedule is the control record; the evaluator receives the portion needed to understand the offered design.

Decision gate

Make the last responsible decision date explicit

Every conditional row needs a trigger and a final safe state. Northborough may choose its matching configuration after a dialogue stage but before final tender. The schedule records who may choose, the latest date, evidence required and what the bidder offers if no choice arrives. The fallback might exclude the option, use a buyer-defined rule set or stop the affected processing. Silence must not activate the branch with the largest privacy consequence.

Some decisions can close after award but before live processing if the tender and contract allow it. Mark them as delivery conditions rather than current facts. Tie them to design approval, test evidence, contract schedules, privacy information, impact-assessment status and operational readiness. The commercial owner confirms that the condition is deliverable; the relevant controller retains its statutory decisions.

A branch is not ready because every cell is filled. It is ready when the controlling source is current, the facts cover the exact offer, contradictory evidence is resolved or visible, the correct authority has approved the role position and the response wording matches the decision. Record dissent and limitations. A neat table should never suppress a material disagreement.

Change control

Reopen the affected activity when the design moves

Link every released privacy statement to activity and branch identifiers. Reopen them if a purpose, material input, affected population, recipient, duration, instruction, provider, feature default or decision authority changes. Also reopen when legislation, regulator guidance or a binding procurement clarification alters the review frame. Give the new position a version and effective date; do not overwrite the record that supported the submitted bid.

The detailed ICO controller and processor guidance currently says it is under review because of changes made by the Data (Use and Access) Act. That notice is part of the source state. A UK bid approved later must check the current statute and regulator material again. It should not repeat this article as legal authority or assume a 2026 web page will remain unchanged.

After award, reconcile the selected branch with the signed terms and implemented service before personal data enters the system. During operation, product change, provider change and new uses of data return to the same purpose-and-means analysis. This preserves the bid commitment without pretending that a role characterization can never change.