How to write a data protection tender answer that scores

Most tenders for services that handle personal information include a question about data protection. It might ask how you’ll keep service users’ records secure, how you comply with UK GDPR or what happens if something goes wrong. Teams often answer it by pasting in last year’s policy summary, and that’s where marks slip away.

This guide explains what a data protection tender answer needs to cover and how to write one an evaluator can score well.

What is a data protection tender question?

A data protection tender question asks you to explain what personal information you’ll handle during the contract, how you’ll protect it and who is responsible. Buyers ask it because if you win, their service users’ data sits with you and they remain accountable for it.

It usually shows up in two places:

• Pass or fail evidence at selection stage. For procurements under the Procurement Act 2023, this sits in the Procurement Specific Questionnaire (PSQ), which replaced the Standard Selection Questionnaire in February 2025. Buyers may ask for Cyber Essentials, ICO registration or, for NHS work, a completed Data Security and Protection Toolkit.
• A scored quality question in the tender itself. For example, “Describe how you will protect personal data and comply with UK GDPR throughout the contract.” You’ll see this a lot in health, social care, education, IT and any service that holds information about the public.

The first decides whether your bid progresses at all, and the second is where you earn marks. A well-written quality answer can’t make up for a missing certificate, so track both from the day the tender lands. If you’re bidding to a Scottish public body, its procurement rules and forms differ, so check its own documents before reusing anything from an English tender.

Work out your role and your data before you write

Under UK GDPR, a controller decides why and how personal data is processed. A processor handles it on the controller’s behalf and follows its documented instructions. Most suppliers delivering a public service are processors for the buyer’s data and controllers for their own staff records, but check the actual activities and the draft contract before you commit to a label. If the tender leaves it unclear, raise a clarification question.

Then map how information moves through the service, from the moment you receive it to the point you return or delete it. Note what personal information is involved and whose it is. Add which systems hold it and who can access it, including any partners. Health information is likely to be special category data, which brings extra legal conditions, and the ICO’s rules on special category data are worth reading if your service involves it.

That map gives you the facts for your answer. Without it, even a tidy policy summary can miss the work you’re bidding to do.

Answer the part the evaluator scores

The evaluator marks your data protection tender response against the question and the scoring criteria. If the question asks about storage, access, incidents and deletion, answer each part in that order and use the buyer’s wording as your headings. You can leave out the long introduction about your organisation’s values.

For each part, say what the control is, who owns it and how you check it works. A sentence like “data is stored securely” leaves the evaluator guessing. Explain who approves access, how permissions are removed when someone leaves and how records are backed up. The ICO guide to data security is a useful prompt for what to cover.

Be clear about timing too. “We use role-based access in our current system” and “We will set up role-based access before go-live” are both fine when they’re true, and the buyer needs to know which one you’re claiming. Name who owns any future action and when the buyer can check it’s done, such as at mobilisation.

Back each claim with evidence the tender allows you to submit, such as an approved policy, a current certificate or training records. If a certificate is requested, check it covers the legal entity that’s bidding, the right scope and the right dates. Cyber Essentials, Cyber Essentials Plus and ISO 27001 test different things, as the NCSC’s Cyber Essentials overview explains, so one won’t automatically stand in for another. The ICO data protection fee is a registration, so avoid presenting it as a security certification.

Keep every promise consistent with the draft contract and your price. An answer that commits to checks your team can’t resource becomes a problem the day you win.

Cover subcontractors, people, incidents and retention

If a hosting provider or delivery partner will handle the buyer’s data, name them and explain their role. As a processor, you’ll need the buyer’s approval to use them, and the terms you agree with the buyer have to flow down the supply chain. The ICO guidance on processor contracts sets out what those terms must include.

Say how staff are trained for their role, how access is reviewed and who handles an incident. For a small team, named responsibility can be a real strength, as long as you’re honest about cover during leave and out of hours.

Describe how someone reports a suspected breach internally, who assesses it and how the buyer is told. Use the timescale the contract sets and avoid inventing your own. Retention deserves the same care, so explain how you’ll follow the agreed schedule and how records are returned or deleted at the end of the contract.

Mistakes that cost marks, and a final check

The weakest answers often feel safe because the team has used them before. Watch for these during review:

• A generic GDPR statement with nothing about this service’s data
• A policy that’s mentioned without explaining how staff use it
• An expired or out-of-scope certificate submitted for a mandatory requirement
• Incident timescales, retention periods or checks that delivery colleagues haven’t agreed
• A subcontractor who handles personal data but is missing from the answer
• A future control described as though it’s already in place

Then give someone who didn’t write the answer enough time to read it against the tender pack. A check at 11.57pm is rarely anyone’s finest work. Before you upload, ask:

• Have we answered every part of the question within the word limit?
• Is our controller or processor role right for each activity?
• Can we evidence every claim, and is every certificate current and correctly named?
• Do the answer, price, subcontractor details and draft contract all say the same thing?

Conclusion

A strong data protection tender answer makes the buyer’s risk easier to assess. It explains what you’ll do with their data, who is responsible and what proves you can deliver it. Start from the question, map the data, back every claim with current evidence and check it all against the contract.

An independent bid review can pick up the gaps a familiar draft hides. If you’d like an experienced second pair of eyes, book a free fit call to talk about whether a bid review or ongoing support suits your pipeline.

Frequently asked questions