Data Protection Advice, Consultancy and Related Services II

The services covered under the framework contract shall provide the Contracting Authorities with the information and assistance required on privacy and the protection of personal data, including but not limited to: provision of general support and advice to Contracting Authorities on effective ways to process personal data in compliance with existing regulation(s) and policies, including advice on privacy and data protection software; preparation of drafts and revision of existing or new policies, processes and/or manuals addressed to experts, staff, external stakeholders and/or management; establishment of technical, organisational and operational measures for the implementation of policies; definition and documentation of technical standards required for the efficient and sustainable establishment of policies; definition and documentation of working instructions required for the efficient and sustainable establishment of policies; monitoring and assessment of the effectiveness of the current and future implementation of policies, proposing working instructions; preparation and execution of regular exercises to verify the preparedness of staff of the Contracting Authorities and the correctness of the policies and the procedures/working instructions, including updates of the documentation; conducting audits and compliance checks; defining and proposing master plans or short/medium term remediation plans, with the aim to reduce the risks and to remove threats also in the event of predictable changes in the existing legislation and standards; organisation and delivery of training and awareness raising actions for staff of the Contracting Authorities and other stakeholders. In providing advice and assistance to the Contracting Authorities as part of the services described above and further specified below, the contractors may provide support to the Data Protection Officers of the Contracting Authorities. Nevertheless, for any services which may be provided as described above and further specified below, the contractors shall not replace the Data Protection Officers in the performance of their tasks.