Which data-processing terms change the proposed service?

Review inputs

Read the schedule with the service it would bind

Start with the buyer’s complete issued package. A processing schedule may incorporate a security standard, a supplier policy, a retention table and provisions in the main agreement. Record each document’s version, exact clause location and stated priority. Follow references into annexes and clarification answers. If an attachment is unavailable or two documents impose conflicting duties, keep that uncertainty in the review; do not substitute the supplier’s usual agreement for the missing buyer text.

Beside this package, freeze the service being bid: contracting entity, product edition, optional functions, delivery countries, support model, subcontracted activities and planned start. A diagram of a different edition cannot prove this one. Distinguish what exists now, what can be configured, what needs development and what depends on a third party’s consent. Use controlled references to confidential architecture and contracts rather than copying them into a broadly circulated bid log.

For an EU processor arrangement, Article 28 GDPR defines the required agreement content and duties. The buyer can also ask for contractual detail or tighter operating conditions. Keep those bases apart. A twelve-hour notification promise may come from this schedule; it should not be introduced as a universal GDPR deadline. A rule allowing processing only in named countries may constrain a flow even where counsel identifies an available international-transfer mechanism.

Give each gap a stable identifier and enough fields to survive handover: clause, obligation, affected activity, current evidence, mismatch, treatment, owner, due date, cost, approval, blocked action and reopen trigger. The useful result is a decision about this service, not a percentage of clauses whose wording resembles the standard agreement.

Roles and instructions

Separate processing purposes before accepting the role labels

Complete the processing description using the buyer’s actual intended use: subject matter, duration, operations, purposes, personal-data types and categories of people. Include exceptional inputs such as health details in a support attachment when the service permits them. A blank annex or a field saying all customer data conceals the scope the teams need to assess. Ask the buyer to resolve missing intended-use facts through the authorized route, and refer lawful-basis or special-category questions to privacy counsel. A signed processing agreement alone does not establish that the proposed collection is lawful.

A schedule that names the supplier a processor for everything still needs a factual review. Draw distinct rows for the buyer’s core workload, support requests, product telemetry, fraud prevention, billing and any proposed reuse. Record who decides why each activity occurs and its essential parameters. EDPB Guidelines 07/2020 treat these roles as functional and activity-specific; the contract’s label does not settle a contradictory factual arrangement.

Consider a fictional permit service whose optional analytics function combines identifiable user journeys across customers. If the tender limits processing to the buyer’s instructions for permit administration, the reviewer must identify the conflict. Possible treatments include disabling the function for this service, changing the processing design, or asking counsel to assess whether a separate purpose can lawfully and contractually be offered. Calling the data telemetry, or replacing names with identifiers, does not resolve the question.

Document the instruction channel as an operating mechanism. Who at the buyer may issue an instruction, who receives it, how is it authenticated, and how are urgent instructions recorded? Separate a permitted processing instruction from a commercial scope change. A pricing dispute does not authorize ignoring a legal duty, and an instruction does not automatically authorize new development or a new processing purpose. Route suspected unlawful instructions to the appointed privacy and legal owners before action; Article 28(3) includes an obligation to inform the controller when the processor considers an instruction unlawful.

Supplier and location changes

Trace the receiving entity, not only the hosting country

The supplier chain must be able to perform the promises the prime bidder makes. Under Article 28(4), the relevant data-protection obligations must be imposed on the further processor, and the initial processor remains responsible to the controller for that further processor’s performance. Compare the relevant contracts with the proposed schedule: confidentiality of authorized personnel, assistance, security, audit cooperation and deletion. An authorization to appoint the provider does not prove that its contract or service can support these duties.

Follow the data through live processing, support attachments, diagnostics, message delivery, backups, disaster recovery and exit exports. For each flow, identify the receiving legal entity, processing function, actual access location and storage location. Record the conditions under which access becomes possible. A support organization can be relevant even when it rarely opens customer records. Verify that the bid’s regional hosting statement covers only the facts it has actually established.

Article 28 distinguishes prior specific and general written authorization for another processor; general authorization includes notice of intended additions or replacements and an opportunity to object. Translate the issued mechanism into dates and responsibilities. Compare the buyer’s required notice period with the notice the supplier receives from its own provider. If the upstream notice arrives too late, the gap needs a supplier agreement, an alternative service path or an authorized contractual treatment.

EDPB Opinion 22/2024 addresses visibility of the processing chain and verification of sufficient guarantees. Its position includes keeping the identities of processors and subprocessors available to the controller. For the bid record, separate this disclosure from approval status. A name on a website does not prove that this buyer authorized that entity for this activity. Keep protected contact and contractual evidence in the designated review channel.

Transfer analysis needs the entities and circumstances as well as the countries. EDPB Guidelines 05/2021 distinguish disclosure to another controller or processor abroad from access by an employee within the same entity; other security duties still matter. Ask counsel to classify the actual flow. The Article 28 clauses in Decision 2021/915 expressly do not themselves satisfy Chapter V transfer obligations. Neither those clauses nor a lawful transfer route overrides a tighter location restriction in the issued tender.

Operating workload

Test incident, rights and assurance duties against a working day

Security measures need a service-specific response. If the annex requires customer-controlled keys, segregation of particular data, a testing cadence or a defined restoration target, identify the relevant component, configuration, responsible team and evidence. Decide whether the feature is included in the proposed edition and price. Article 32 GDPR requires measures appropriate to risk; a certificate or a standard security paragraph does not prove that an additional buyer requirement is implemented.

For incident reporting, separate the event that starts the clock, the recipient and the content expected at each stage. Article 33(2) requires a processor to notify the controller without undue delay after awareness of a personal data breach. The qualified seventy-two-hour supervisory notification rule in Article 33(1) concerns the controller. The tender may demand earlier or broader contractual reporting. Test who can send an initial report overnight, how missing facts are labelled and when updates follow, without waiting for a finished root-cause report unless the applicable duty permits that.

Rights-request and impact-assessment assistance also consume people’s time. Take one request through receipt, buyer authentication, record identification, extraction, quality review and secure handover. Preserve the buyer’s decision authority and avoid disclosing other people’s records. Estimate normal demand and a bounded surge case. If the schedule requires assistance at no additional charge, show the associated staffing or contingency in the bid price rather than assuming the work is negligible.

Review audit cooperation at the level needed to identify a service gap. Check whether the supplier can provide the evidence and access contemplated by Article 28(3)(h) and the issued annex while protecting other customers. Note unavailable provider access, prohibited disclosures and conflicts between schedules. Refer the detailed inspection protocol and remediation terms to the audit-rights review. An attractive evidence package cannot silently replace an inspection right.

Copies and exit

Make the deletion promise account for recovery copies

Inventory the data populations covered by return and deletion: live records, search indexes, exports, support attachments, replicated stores, backups and copies held by subprocessors. Separate the buyer’s retention instructions during service from obligations after processing services end. Article 28(3)(g) addresses the controller’s choice of return or deletion and deletion of existing copies, subject to the stated legal-storage exception. It does not provide a general exemption for inconvenient backup design.

Test the exact deadline in the issued schedule. If backups are immutable for ninety days and the draft requires every copy removed within thirty, record a sixty-day difference. Do not call the thirty-day duty satisfied merely because ordinary users cannot access the copy. Ask the technical owner what can be changed, with what recovery consequences, and ask counsel what wording is permissible. Any proposed restricted-retention arrangement remains a proposal until the required legal and contractual basis is resolved.

Restoration can reintroduce data that was deleted from live systems. The review therefore needs a treatment for deletion instructions after recovery, the point at which ordinary processing resumes and the evidence of completion. For legally required retention, record the applicable basis, dataset, duration, access limitation and approving owner. A vague reference to compliance retention is insufficient. Reconcile return format, transfer security, deletion verification and subprocessor confirmation before pricing exit assistance.

Worked case

A booking-service bid needs four changes before acceptance

In a fictional EU procurement, Alderwick Cultural Authority is buying a workshop-booking service. Schedule P version 4 permits personal-data access only from the EEA, names an advance approval process for subprocessors, requires an initial notice of a covered incident within twelve hours and requires deletion of all copies within thirty days after the processing service ends. These are stipulated contract terms, not standard legal thresholds. The proposed service uses an overseas affiliate for night support and retains immutable backups for ninety days.

The reviewer opens four rows. The support owner proposes EEA-only coverage and removes the affiliate from this offer’s access model. The messaging supplier has not yet supplied the approval evidence required by the buyer. The incident owner demonstrates an on-call reporting route but still needs approval for the exact notification wording. The backup owner identifies a customer-specific thirty-day design that requires implementation and recovery testing. None of these proposals is recorded as already delivered.

Finance estimates €14,000 for the support transition, €22,000 for backup changes and €4,000 for incident preparation: €40,000 once. The new support coverage costs €18,000 each year. Over a three-year base term, the listed changes total €94,000 before tax, excluding unpriced messaging changes and any extension. The €94,000 is therefore a partial change estimate, not an approved fixed-price uplift or the full cost of data protection. Delivery lead times must fit the tender’s actual milestone dates.

The result is a hold on unconditional schedule acceptance. Release requires the messaging evidence and authorization route, successful backup testing, approval of the service description and incident language, and commercial authority for the revised costs. If the procurement does not permit a needed departure, the team must meet the issued obligation or reconsider the bid. A note buried in an architecture appendix would not cure contradictory unconditional acceptance.

Release and handover

Release a decision that delivery can carry out

Use explicit row states: evidenced fit, change approved but not completed, clarification required, departure required, legal characterization unresolved, supplier evidence missing or unacceptable as offered. A change can be approved for delivery after award only where the actual tender allows that timing and the authorized reviewers accept its feasibility. State the proof and milestone required; do not describe future work as a present control.

Reconcile the decision with the main agreement, limitation clauses, insurance assumptions, solution description, security questionnaire, service levels and price. If the data schedule imposes a remedy or liability treatment, pass the issue to the relevant contract reviewer rather than calculating its legal effect here. Have privacy counsel own characterization and legal questions, security and service owners own feasibility, and commercial authority own the resulting commitment. One signature cannot be assumed to cover every delegation.

An agent can extract public clauses, compare approved versions, draft gap rows and reproduce the disclosed calculations. It must stop before accessing an unapproved confidential repository, sending evidence to an external tool, deciding legal roles, accepting a clause, contacting a supplier or buyer, or submitting the bid without specific authority. The safe handover identifies the unresolved question, required evidence, owner and next permitted action. A new subprocessor, access country, retention rule, service edition or buyer amendment reopens affected decisions.