NHS GDPR Compliance Tool

{
  "id": "047760-2025",
  "tag": [
    "award",
    "contract"
  ],
  "bids": {
    "statistics": [
      {
        "id": "1",
        "value": 4,
        "measure": "bids",
        "relatedLot": "1"
      },
      {
        "id": "2",
        "value": 3,
        "measure": "smeBids",
        "relatedLot": "1"
      },
      {
        "id": "3",
        "value": 0,
        "measure": "foreignBidsFromEU",
        "relatedLot": "1"
      },
      {
        "id": "4",
        "value": 4,
        "measure": "foreignBidsFromNonEU",
        "relatedLot": "1"
      },
      {
        "id": "5",
        "value": 4,
        "measure": "electronicBids",
        "relatedLot": "1"
      }
    ]
  },
  "date": "2025-08-11T16:33:44+01:00",
  "ocid": "ocds-h6vhtk-046f75",
  "buyer": {
    "id": "GB-FTS-115937",
    "name": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)"
  },
  "links": [
    {
      "rel": "canonical",
      "href": "https://api.publiccontractsscotland.gov.uk/v1/Notice?id=ocds-r6ebe6-0000784857"
    }
  ],
  "awards": [
    {
      "id": "047760-2025-NP610424-1",
      "status": "active",
      "suppliers": [
        {
          "id": "GB-FTS-157636",
          "name": "AWTG LTD"
        }
      ],
      "relatedLots": [
        "1"
      ]
    }
  ],
  "tender": {
    "id": "ocds-h6vhtk-046f75",
    "lots": [
      {
        "id": "1",
        "status": "cancelled",
        "hasOptions": false,
        "description": "Procurement of a GDPR Compliance Tool to support NHS Scotland Information Governance with the delivery of their core compliance activities which include completion and review of Data Protection Impact Assessments, maintenance of Information Asset Registers and Records of Processing.",
        "awardCriteria": {
          "criteria": [
            {
              "name": "Functional Requirements",
              "type": "quality",
              "description": "40"
            },
            {
              "name": "Non-Functional Requirements",
              "type": "quality",
              "description": "30"
            },
            {
              "type": "price",
              "description": "30"
            }
          ]
        }
      }
    ],
    "items": [
      {
        "id": "1",
        "relatedLot": "1",
        "deliveryLocation": {
          "description": "Scotland"
        },
        "deliveryAddresses": [
          {
            "region": "UKM"
          }
        ]
      }
    ],
    "title": "NHS GDPR Compliance Tool",
    "status": "complete",
    "coveredBy": [
      "GPA"
    ],
    "legalBasis": {
      "id": "32014L0024",
      "scheme": "CELEX"
    },
    "description": "Procurement of a GDPR Compliance Tool to support NHS Scotland Information Governance with the delivery of their core compliance activities which include completion and review of Data Protection Impact Assessments, maintenance of Information Asset Registers and  Records of Processing.",
    "reviewDetails": "Economic operators should approach the contracting authority in the first instance. However, the only formal remedy is to apply to the courts:\nAn economic operator that suffers, or is at risk of suffering, loss or damage attributable to a breach of duty under the Public Contracts (Scotland) Regulations 2015 or the Procurement Reform (Scotland) Act 2014, may bring proceedings in the Sheriff Court or the Court of Session.",
    "classification": {
      "id": "72000000",
      "scheme": "CPV",
      "description": "IT services: consulting, software development, Internet and support"
    },
    "procurementMethod": "open",
    "mainProcurementCategory": "services",
    "procurementMethodDetails": "Open procedure"
  },
  "parties": [
    {
      "id": "GB-FTS-115937",
      "name": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)",
      "roles": [
        "buyer",
        "centralPurchasingBody"
      ],
      "address": {
        "region": "UKM",
        "locality": "Edinburgh",
        "postalCode": "EH12 9EB",
        "countryName": "United Kingdom",
        "streetAddress": "1 South Gyle Crescent"
      },
      "details": {
        "url": "http://www.nss.nhs.scot/browse/procurement-and-logistics",
        "buyerProfile": "https://www.publiccontractsscotland.gov.uk/search/Search_AuthProfile.aspx?ID=AA11883",
        "classifications": [
          {
            "id": "BODY_PUBLIC",
            "scheme": "TED_CA_TYPE",
            "description": "Body governed by public law"
          },
          {
            "id": "07",
            "scheme": "COFOG",
            "description": "Health"
          }
        ]
      },
      "identifier": {
        "legalName": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)"
      },
      "contactPoint": {
        "email": "michael.walker3@nhs.scot",
        "telephone": "+44 1312756000"
      }
    },
    {
      "id": "GB-FTS-157636",
      "name": "AWTG LTD",
      "roles": [
        "supplier"
      ],
      "address": {
        "region": "UKI",
        "locality": "London",
        "postalCode": "W37SR",
        "countryName": "United Kingdom",
        "streetAddress": "8 Canham Mews, Canham Road"
      },
      "details": {
        "scale": "sme"
      },
      "identifier": {
        "legalName": "AWTG LTD"
      },
      "contactPoint": {
        "telephone": "+44 02035155151"
      }
    },
    {
      "id": "GB-FTS-324",
      "name": "Sheriff Court House",
      "roles": [
        "reviewBody"
      ],
      "address": {
        "locality": "Edinburgh",
        "postalCode": "EH1 1LB",
        "countryName": "United Kingdom",
        "streetAddress": "27 Chambers Street"
      },
      "identifier": {
        "legalName": "Sheriff Court House"
      }
    }
  ],
  "language": "en",
  "contracts": [
    {
      "id": "047760-2025-NP610424-1",
      "value": {
        "amount": 512000,
        "currency": "GBP"
      },
      "status": "active",
      "awardID": "047760-2025-NP610424-1",
      "dateSigned": "2025-07-22T00:00:00+01:00"
    }
  ],
  "description": "Estimated Value:\nThe estimated value provided in sections II.1.7 and V.2.4 includes the initial 36 month contract period and the two optional extension periods of 12 months each.\n(SC Ref:807004)",
  "initiationType": "tender"
}

{
  "id": "040058-2024",
  "tag": [
    "tender"
  ],
  "date": "2024-12-12T11:47:19Z",
  "ocid": "ocds-h6vhtk-046f75",
  "buyer": {
    "id": "GB-FTS-115937",
    "name": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)"
  },
  "links": [
    {
      "rel": "canonical",
      "href": "https://api.publiccontractsscotland.gov.uk/v1/Notice?id=ocds-r6ebe6-0000784857"
    }
  ],
  "tender": {
    "id": "ocds-h6vhtk-046f75",
    "lots": [
      {
        "id": "1",
        "value": {
          "amount": 900000,
          "currency": "GBP"
        },
        "status": "active",
        "renewal": {
          "description": "The Agreement includes two optional extension periods of 12 months each."
        },
        "hasOptions": false,
        "hasRenewal": true,
        "description": "Procurement of a GDPR Compliance Tool to support NHS Scotland Information Governance with the delivery of their core compliance activities which include completion and review of Data Protection Impact Assessments, maintenance of Information Asset Registers and Records of Processing.\nThe solution is required to enable NHS Scotland Information Governance to effectively deliver better and more efficient services to their colleagues, their organisation and third parties that they work with. The solution will also provide ease in carrying out the administrative activities, making tasks such as maintaining an archive of past assessments, templates, reporting, import and export of data more seamless, thereby improving NHS Scotland Information Governance business processes.",
        "awardCriteria": {
          "criteria": [
            {
              "name": "Functional Requirements",
              "type": "quality",
              "description": "40"
            },
            {
              "name": "Non-Functional Requirements",
              "type": "quality",
              "description": "30"
            },
            {
              "type": "price",
              "description": "30"
            }
          ]
        },
        "contractPeriod": {
          "durationInDays": 1080
        },
        "submissionTerms": {
          "variantPolicy": "notAllowed"
        }
      }
    ],
    "items": [
      {
        "id": "1",
        "relatedLot": "1",
        "deliveryLocation": {
          "description": "Scotland"
        },
        "deliveryAddresses": [
          {
            "region": "UKM"
          }
        ]
      }
    ],
    "title": "NHS GDPR Compliance Tool",
    "value": {
      "amount": 900000,
      "currency": "GBP"
    },
    "status": "active",
    "coveredBy": [
      "GPA"
    ],
    "bidOpening": {
      "date": "2025-01-27T12:00:00Z"
    },
    "legalBasis": {
      "id": "32014L0024",
      "scheme": "CELEX"
    },
    "awardPeriod": {
      "startDate": "2025-01-27T12:00:00Z"
    },
    "description": "Procurement of a GDPR Compliance Tool to support NHS Scotland Information Governance with the delivery of their core compliance activities which include completion and review of Data Protection Impact Assessments, maintenance of Information Asset Registers and  Records of Processing.",
    "tenderPeriod": {
      "endDate": "2025-01-27T12:00:00Z"
    },
    "contractTerms": {
      "hasElectronicPayment": true,
      "hasElectronicOrdering": true,
      "electronicInvoicingPolicy": "allowed"
    },
    "hasRecurrence": false,
    "reviewDetails": "Economic operators should approach the contracting authority in the first instance. However, the only formal remedy is to apply to the courts:\nAn economic operator that suffers, or is at risk of suffering, loss or damage attributable to a breach of duty under the Public Contracts (Scotland) Regulations 2015 or the Procurement Reform (Scotland) Act 2014, may bring proceedings in the Sheriff Court or the Court of Session.",
    "classification": {
      "id": "72000000",
      "scheme": "CPV",
      "description": "IT services: consulting, software development, Internet and support"
    },
    "submissionTerms": {
      "languages": [
        "en"
      ]
    },
    "submissionMethod": [
      "electronicSubmission"
    ],
    "procurementMethod": "open",
    "selectionCriteria": {
      "criteria": [
        {
          "type": "economic",
          "appliesTo": [
            "supplier"
          ],
          "description": "SPD Q.4B.1.1: Bidders are required to provide statement of accounts or extracts relating to their business for the previous 3 years. Where any are risks identified by NSS as part of the due diligence carried out on the above information NSS may require Bidders to provide additional information to demonstrate financial standing. Additional information can include but not be limited to:\n- parent company accounts (if applicable)\n- deeds of guarantee\n- bankers statements and references\n- accountants’ references\n- management accounts\n- financial projections, including cash flow forecasts\n- details and evidence of previous contracts, including contract values\n- capital availability.\nBidders who cannot provide suitable evidence of a secure financial standing may be excluded from the procurement.\nQ.4B.5.1 and Q.4B.5.2: It is a requirement of this contract that bidders hold, or can commit to obtain prior to the commence of any subsequently awarded contract, the types and levels of insurance indicated below:\nEmployers liability insurance: 5 000 000 GBP;\nPublic liability insurance: 1 000 000 GBP;\nProfessional indemnity insurance: 1 000 000 GBP"
        },
        {
          "type": "technical",
          "appliesTo": [
            "supplier"
          ],
          "description": "4C.1.2 Please provide details of three relevant examples of services carried out during the last three years.\n4.C.2 Bidders are required to confirm compliance with standards, such as ISO or equivalent, set by technical bodies, especially those responsible for quality control. Please provide examples such as the following:\n- Cyber Essentials\n- ISO 9001 - Quality Management Systems\n- ISO 27001 - Information Security Management\n- ISO 27017 - Code of practice for information security controls\n- ISO 27018 - Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors\n- UK Government 14 Cloud Security Principles\nPlease state the relevance of any such educational and professional qualifications.\n4C.6: Bidders will be required to confirm that they and/or the service provider have relevant educational and professional qualifications such as the following: ISO27001 or equivalent ITIL qualifications [Helpdesk, etc] or equivalent other professional qualifications relevant to the Services outlined in the Contract Notice.\nAnd:\n4C.6.1: Bidders will be required to confirm that they and/or the service provider's managerial staff have relevant educational and professional qualifications such as the following: ISO27001 or equivalent ITIL qualifications [Helpdesk, etc] or equivalent other professional qualifications relevant to the Services outlined in the Contract Notice.\n4C.10: Bidders will be required to confirm whether they intend to subcontract and, if so, for what proportion of the contract"
        }
      ]
    },
    "mainProcurementCategory": "services",
    "submissionMethodDetails": "http://www.publictendersscotland.publiccontractsscotland.gov.uk/",
    "procurementMethodDetails": "Open procedure"
  },
  "parties": [
    {
      "id": "GB-FTS-115937",
      "name": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)",
      "roles": [
        "buyer",
        "centralPurchasingBody"
      ],
      "address": {
        "region": "UKM",
        "locality": "Edinburgh",
        "postalCode": "EH12 9EB",
        "countryName": "United Kingdom",
        "streetAddress": "1 South Gyle Crescent"
      },
      "details": {
        "url": "http://www.nss.nhs.scot/browse/procurement-and-logistics",
        "buyerProfile": "https://www.publiccontractsscotland.gov.uk/search/Search_AuthProfile.aspx?ID=AA11883",
        "classifications": [
          {
            "id": "BODY_PUBLIC",
            "scheme": "TED_CA_TYPE",
            "description": "Body governed by public law"
          },
          {
            "id": "07",
            "scheme": "COFOG",
            "description": "Health"
          }
        ]
      },
      "identifier": {
        "legalName": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)"
      },
      "contactPoint": {
        "url": "http://www.publictendersscotland.publiccontractsscotland.gov.uk/",
        "email": "michael.walker3@nhs.scot",
        "telephone": "+44 1312756000"
      }
    },
    {
      "id": "GB-FTS-20205",
      "name": "Sheriff Court House",
      "roles": [
        "reviewBody"
      ],
      "address": {
        "locality": "Edinburgh",
        "postalCode": "EH1 1LB",
        "countryName": "United Kingdom"
      },
      "identifier": {
        "legalName": "Sheriff Court House"
      }
    }
  ],
  "language": "en",
  "description": "Estimated Value:\nThe estimated value provided in sections II.1.5 and II.2.6 includes the initial 36 month contract period and the two optional extension periods of 12 months each.\nCyber Security:\nIt is a mandatory requirement that Bidders complete and pass a cyber security questionnaire which will be issued by Core to Cloud. Potential Bidders who plan to submit a Tender should, at the earliest possible opportunity, provide the following information to NSS via the PCS-T message board to allow Core to Cloud to issue the questionnaire:\n-\tBidder name\n-\tContact email\n-\tContact telephone number\nSuccessful Bidders must take part in the NHS Scotland cyber security monitoring programme.\nFair Work Practices:\nBidders must describe how they will commit to fair work practices for workers (including any agency or subcontractor workers) engaged in the delivery of the contract as detailed within the ITT.\nCarbon Reduction:\nBidders must provide their Carbon Reduction Plan for the main organisation(s) where the service or systems will be operated from under the Contract. This information will be used to demonstrate that suppliers awarded to public sector contracts are supporting the Scottish ambition of a net zero position by 2040.\nScottish Landscape:\nAll Bidders must provide as much of the following information as possible:\n- number of employees in Scotland.\n- number and location of any bases in Scotland\n- total spend in Scotland used to support your business\n- use of local sub-contractors\n- rent for office or warehouses\n- salaries\n- hotels & transportation\n- goods/services provided by local businesses\n- other expenses\nThe buyer is using PCS-Tender to conduct this ITT exercise. The Project code is 28095. For more information see: http://www.publiccontractsscotland.gov.uk/info/InfoCentre.aspx?ID=2343\nCommunity benefits are included in this requirement. For more information see: https://www.gov.scot/policies/public-sector-procurement/community-benefits-in-procurement/\nA summary of the expected community benefits has been provided as follows:\nIt is a mandatory requirement that Bidders agree to support the concept, provision and ongoing development of community benefits provision in relation to this Agreement. Bidders are required to agree to this mandatory requirement. They are also requested to provide a brief summary of the community benefits that have recently been delivered within Scotland, and also what impact and outcomes these have achieved. Bidders are required to summarise any community/social benefits that will be delivered as part of this Agreement if successful, or, alternatively, Bidders confirm that they will engage with the NHS Scotland Community Benefits Gateway (CBG). This gateway, developed through requests from suppliers seeking opportunities to support the delivery of community benefits within the contracting region, provides information community benefit opportunities. The CBG is a free and easy to use online service that connects NHS Scotland suppliers with third sector community organisations within Scotland and will be used for tracking and reporting, and is an approved, compliant route to the realisation of community benefits. For further information please visit: https://www.nss.nhs.scot/procurement-and-logistics/sustainability/access-our-community-benefit-gateway/.\n(SC Ref:784857)",
  "initiationType": "tender"
}

{
  "id": "018198-2024",
  "tag": [
    "planning"
  ],
  "date": "2024-06-12T14:50:23+01:00",
  "ocid": "ocds-h6vhtk-046f75",
  "buyer": {
    "id": "GB-FTS-115937",
    "name": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)"
  },
  "links": [
    {
      "rel": "canonical",
      "href": "https://api.publiccontractsscotland.gov.uk/v1/Notice?id=ocds-r6ebe6-0000769283"
    }
  ],
  "tender": {
    "id": "ocds-h6vhtk-046f75",
    "lots": [
      {
        "id": "1",
        "status": "planned",
        "description": "NHS Scotland are looking to procure a national data mapping compliance tool (DMCT) for all NHS Scotland health boards. For NHS Scotland IG to achieve its core objectives. An efficient, innovative, consistent, and reliable Data Mapping tool is required to enable better delivery of its services. Further information can be found within the PIN Questionnaire attached to this Notice."
      }
    ],
    "items": [
      {
        "id": "1",
        "relatedLot": "1",
        "deliveryLocation": {
          "description": "Scotland"
        },
        "deliveryAddresses": [
          {
            "region": "UKM"
          }
        ]
      }
    ],
    "title": "NHS Scotland Data Mapping Compliance Tool",
    "status": "planned",
    "coveredBy": [
      "GPA"
    ],
    "legalBasis": {
      "id": "32014L0024",
      "scheme": "CELEX"
    },
    "description": "NHS Scotland are looking to procure a national data mapping compliance tool (DMCT) for use by all NHS Scotland health boards.",
    "communication": {
      "futureNoticeDate": "2024-10-01T00:00:00+01:00"
    },
    "classification": {
      "id": "48000000",
      "scheme": "CPV",
      "description": "Software package and information systems"
    },
    "mainProcurementCategory": "goods"
  },
  "parties": [
    {
      "id": "GB-FTS-115937",
      "name": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)",
      "roles": [
        "buyer",
        "centralPurchasingBody"
      ],
      "address": {
        "region": "UKM",
        "locality": "Edinburgh",
        "postalCode": "EH12 9EB",
        "countryName": "United Kingdom",
        "streetAddress": "1 South Gyle Crescent"
      },
      "details": {
        "url": "http://www.nss.nhs.scot/browse/procurement-and-logistics",
        "buyerProfile": "https://www.publiccontractsscotland.gov.uk/search/Search_AuthProfile.aspx?ID=AA11883",
        "classifications": [
          {
            "id": "BODY_PUBLIC",
            "scheme": "TED_CA_TYPE",
            "description": "Body governed by public law"
          },
          {
            "id": "07",
            "scheme": "COFOG",
            "description": "Health"
          }
        ]
      },
      "identifier": {
        "legalName": "The Common Services Agency (more commonly known as NHS National Services Scotland) (NSS)"
      },
      "contactPoint": {
        "email": "michael.walker3@nhs.scot",
        "telephone": "+44 7919392110"
      }
    }
  ],
  "language": "en",
  "description": "Interested parties should complete the attached 'NHS DMCT PIN Questionnaire V1' and return to paul.mckinney@nhs.scot by noon on\nWednesday 3 July 2024.\nNOTE: To register your interest in this notice and obtain any additional information please visit the Public Contracts Scotland Web Site at https://www.publiccontractsscotland.gov.uk/Search/Search_Switch.aspx?ID=769283.\n(SC Ref:769283)",
  "initiationType": "tender"
}