Data and GDPR starter pack for tender bidders
What buyers ask about your data, and the six simple documents that let you answer with confidence.
Government sites change. If a screen looks different, follow the screen.
1. Why buyers ask about data
Checked against ICO guidance on 13 October 2026. General information, not legal advice. Take advice from a data protection officer or solicitor for your own case.
If you will see, store or touch a buyer's personal data, they must be sure you will look after it. Expect questions in the selection questionnaire and in the quality questions. Weak or vague answers lose marks. A wrong answer can lose the contract.
- Where will data be stored, and where can it be accessed from?
- Who can see it?
- Do you use subcontractors or AI tools that handle it?
- What happens if there is a breach?
- Are you registered with the ICO and do you hold Cyber Essentials?
The rule
Never answer a data question from memory or hope. Know the facts first, write them down, and make sure what you say in a tender is true.
2. The basics in plain English
| Term | Plain meaning |
|---|---|
| TermPersonal data | Plain meaningAny information that identifies a living person: names, emails, patient or staff records, even IP addresses. |
| TermController | Plain meaningThe organisation that decides why and how personal data is used. Usually the buyer. |
| TermProcessor | Plain meaningAn organisation that handles personal data for a controller, on its instructions. Usually you, when you deliver a service. |
| TermUK GDPR and Data Protection Act 2018 | Plain meaningThe UK laws on how personal data must be handled. |
| TermICO | Plain meaningThe Information Commissioner's Office. The regulator, and where you pay the data protection fee. |
| TermRestricted transfer | Plain meaningSending personal data to, or giving access to it from, a separate organisation outside the UK. |
3. Your three starting jobs
Job 1. Pay the ICO data protection fee
- Organisations, including sole traders, that use personal information need to pay a fee unless exempt.
- Use the ICO self-assessment to check. It takes about 10 minutes.
- The tier one fee is £52, or £47 by direct debit. It takes about 15 minutes to pay.
- This is a registration and payment, not an exam or a certificate.
- Start here: ico.org.uk/for-organisations/data-protection-fee (opens in a new tab)
Job 2. Find out what personal data you handle
Use the data map in section 5. If you only handle your own business contacts, say so. If you will handle client or patient data, you need more.
Job 3. Write your six starter documents
Section 5 gives you simple templates. They take about two hours in total. Keep them short and true.
4. Working with people outside the UK
If someone in your team works abroad, check this before you promise anything to a buyer.
| Question | What it means |
|---|---|
| QuestionIs the person an employee or director of your company? | What it meansStaff of your own company are not a "separate organisation", but you must still protect the data and control access. |
| QuestionOr are they a separate business, such as their own company or a supplier? | What it meansGiving them access to personal data can be a "restricted transfer". The ICO says making data accessible to an overseas organisation counts, even if no data is sent. |
| QuestionWhat must you do for a restricted transfer? | What it meansUse one of the approved routes: UK adequacy regulations, an appropriate safeguard such as the ICO's International Data Transfer Agreement or the Addendum (with a transfer risk assessment), or a narrow exception. If none applies, you must not make the transfer. |
| QuestionWhat does the buyer say? | What it meansMany public sector buyers require data to stay in the UK or to be approved first. Read the tender and the contract. |
Do not look for a workaround
Using a UK-hosted virtual environment does not remove your duties. Where the data is stored and who can access it from where both matter. Be honest in the tender. If buyers need UK-only access and you cannot offer it, do not bid, or restructure so UK-based staff handle the personal data.
Simplest safe model for a new business: UK-based people handle any real personal data. People abroad work on build and testing with fake or anonymised data, unless the buyer approves in writing.
5. The six starter documents
Copy each into a document of your own. Fill in the brackets. Keep each to one page.
Document 1. Data map
| What data | Whose data | Where stored | Who can access | How long we keep it |
|---|---|---|---|---|
| What data[Example: client contact details] | Whose data[Clients] | Where stored[Cloud CRM, UK region] | Who can access[Director only] | How long we keep it[Until contract ends + 12 months] |
| What data | Whose data | Where stored | Who can access | How long we keep it |
| What data | Whose data | Where stored | Who can access | How long we keep it |
Document 2. Data location statement
"[Company name] stores [type of data] in [service name], hosted in [country or region]. Our team accesses it from [countries]. We do not transfer personal data outside the UK except [state exactly, or write: we do not]. If a client requires a different arrangement, we will agree it in writing before work starts."
Document 3. Access control summary
| Topic | What we do |
|---|---|
| TopicWho has an account | What we do[Named people only. No shared logins.] |
| TopicLevel of access | What we do[Least access needed to do the job.] |
| TopicSign-in | What we do[Multi-factor sign-in on all email and cloud tools.] |
| TopicLeavers | What we do[Accounts removed on the last day.] |
| TopicDevices | What we do[Company or approved devices. Updates and protection on. Screen locks.] |
Document 4. AI tools rules
| Tool | Allowed for | Never put in |
|---|---|---|
| Tool[Name of tool, business version] | Allowed for[Drafting, summarising our own material, no client data] | Never put in[Personal data, client confidential information, tender documents under embargo] |
| Tool[Public free tools] | Allowed for[General research only] | Never put in[Any client or personal data] |
- Check each tool's terms: where data goes, whether it is kept, and whether it is used to train models.
- Prefer a business account with data controls.
- Anything personal or confidential stays out unless the tool is approved for it.
- Write down who approved each tool and when.
Document 5. Subcontractor data checklist
- Written agreement in place with data protection terms.
- Told where they will store and access data from.
- They use only the tools we have approved.
- They tell us straight away about any breach.
- They delete or return data when the work ends.
- We have checked whether any access from outside the UK needs a safeguard.
Document 6. Breach response, one page
| Step | What to do |
|---|---|
| Step1. Stop it | What to doContain it: change passwords, remove access, disconnect the device. |
| Step2. Tell your lead | What to do[Name and phone] straight away. Write down what happened and when. |
| Step3. Decide if it is reportable | What to doIf there is a risk to people, you must tell the ICO within 72 hours of becoming aware. |
| Step4. Tell the client | What to doCheck your contract. Many require quick notice, often sooner than 72 hours. |
| Step5. Tell the people affected | What to doIf the risk to them is high. |
| Step6. Learn from it | What to doRecord the cause and the fix. |
6. How to answer in a tender
| They ask | A good answer includes |
|---|---|
| They askHow do you protect personal data? | A good answer includesYour access controls, Cyber Essentials, ICO registration, and who is responsible. |
| They askWhere is data stored? | A good answer includesYour location statement, with a specific country or region. |
| They askDo you use subcontractors or AI tools? | A good answer includesWho, for what, under what agreement, with what limits. |
| They askWhat if there is a breach? | A good answer includesYour one-page steps, and the 72-hour rule. |
| They askDo you transfer data outside the UK? | A good answer includesA plain yes or no, and the safeguard if yes. |
- Be specific. Names, places, dates and numbers score better than adjectives.
- Never claim a certificate or process you do not have.
- If you are unsure, ask a clarification or take advice.
7. When you need more
- A data protection impact assessment may be needed for high-risk uses of personal data, including some AI projects. Take advice.
- A written contract with each client is normally needed when you process their personal data. Check the buyer's contract terms.
- NHS and some health buyers ask for the Data Security and Protection Toolkit. See the Cyber Essentials guide.
- Some buyers ask for ISO 27001 or other certificates. Do not claim one until you hold it.
- A data protection officer or specialist adviser can check your documents before a big bid.
8. A two-hour plan
| Time | Do this |
|---|---|
| Time20 minutes | Do thisRun the ICO fee self-assessment. Pay if needed. |
| Time30 minutes | Do thisFill in the data map. |
| Time20 minutes | Do thisWrite the location statement. |
| Time20 minutes | Do thisWrite the access control summary. |
| Time20 minutes | Do thisWrite the AI tools rules. |
| Time10 minutes | Do thisWrite the subcontractor checklist and breach steps. |
9. Links
| For | Link |
|---|---|
| ForICO data protection fee | Linkico.org.uk: data protection fee (opens in a new tab) |
| ForICO fee self-assessment | Linkico.org.uk: fee self-assessment (opens in a new tab) |
| ForICO international transfers guide | Linkico.org.uk: international transfers guide (opens in a new tab) |
| ForICO UK GDPR guidance and resources | Linkico.org.uk: UK GDPR guidance and resources (opens in a new tab) |
| ForICO advice for small organisations | Linkico.org.uk: advice for small organisations (opens in a new tab) |
| ForContact the ICO | Linkico.org.uk/global/contact-us (opens in a new tab) |
| ForAsk the Buyer | LinkBook a call with Ask the Buyer (opens in a new tab) |
General information to help you get started. It is not legal advice. Check answers carefully and take advice where you are unsure. Its templates are general information too. Adapt each one to your own business and check it before you rely on it in a tender.