Data Protection Advice Service

Description

The Group’s Information Governance Team oversees, investigates, and triages activities associated with data protection. The Team currently consists of a Head of Information Governance and Assurance and two Data and Information Security Officers. One of these Officer posts is currently vacant, and a structural review is being considered. A mature Information Governance Framework exists within the Group with relevant policies, processes, and procedures in place as well as a reporting framework on key activities to a Group Data Protection and Cyber Security Forum and to the Group Executive Risk Committee. The Information Governance Team aspires to continually improve its knowledge and application of the legislation both to ensure customer’s rights are fully met and that both service operations and development occur efficiently, effectively, and compliantly Lot 1: The Group’s Information Governance Team oversees, investigates, and triages activities associated with data protection. The Team currently consists of a Head of Information Governance and Assurance and two Data and Information Security Officers. One of these Officer posts is currently vacant, and a structural review is being considered. A mature Information Governance Framework exists within the Group with relevant policies, processes, and procedures in place as well as a reporting framework on key activities to a Group Data Protection and Cyber Security Forum and to the Group Executive Risk Committee. The Information Governance Team aspires to continually improve its knowledge and application of the legislation both to ensure customer’s rights are fully met and that both service operations and development occur efficiently, effectively, and compliantly. Cyber Security is dealt with by another Team in the Information Directorate although close working practices exist between the Teams. The Group is ISO27001 certified. With a fairly small team, activities prioritised tend to be reactive to events and therefore focus on data subject access requests, personal data incident investigations and advice on information sharing. Proactive activities including detailed data protection impact assessments, auditing, and understanding information assets and other processing activities, reviewing of contract clauses and drafting of data processing agreements do not always get the time and focus they may merit particularly where they may be classed as lower risk activities. The desire in the team is to free up time spent on Data Subject Access Requests, contract clause reviews and researching less routine data protection issues in order to focus on proactive, preventative activities with the business. Particular emphasis is to be placed on alignment with the Groups Enterprise Programme Management Office activities, enterprise architecture, data processing supply chain and procurement. To this end, we are looking to be able to collaborate with a partner organisation who would be able: 1)Assist in the compilation, de-duplication and redaction of data subject access request records when needed, 2)provide a data protection expert advice and support service, and 3)act as a critical friend advising on process and policy improvements. This procurement is initially for 12 months to understand and trial the costs incurred against the benefits outlined above. The SARs service will be reviewed after 12 months in terms of compliance with statutory deadlines, quality of Customer Copy SARs, the number and type of follow up queries received by customers against in-house comparators, the number of queries received from the ICO. In addition, staff time freed up to undertake proactive preventative actions will also be measured. Additional information: To respond to this opportunity please click here: https://www.delta-esourcing.com/respond/3C7Y97CZQC