The Authority confirms that it will keep confidential and will not disclose to third parties any information obtained from a named customer reference where requested as part of a tender, other than to the Cabinet Office, individuals involved in the procurement process and/or contracting authorities defined by the Procurement Act 2023.
As a public body, the Authority is subject to the provisions of the Freedom of Information Act 2000 (FOIA) in respect of information it holds (including third-party information). Any member of the public or other interested party may make a request for information.
The Authority shall treat all Suppliers' responses as confidential during any procurement process. Requests for information received following any procurement process shall be considered on a case-by-case basis, applying the principles of FOIA, which permits certain information to be withheld, for example where disclosure would be prejudicial to a party’s commercial interests, and in accordance with the Authority’s transparency obligations.
Suppliers are responsible for ensuring that any confidential or commercially sensitive information, the disclosure of which would be likely to diminish the Supplier’s competitive edge, has been clearly identified to the Authority in the tender submission.
All Suppliers are required to comply with all applicable requirements of the Data Protection Legislation which means:
- The General Data Protection Regulation (Regulation (EU) 2016/679), the Law Enforcement Directive (Directive (EU) 2016/680) and any applicable national implementing laws amended from time to time;
- The Data Protection Act 2018 to the extent that it relates to processing of Personal Data and privacy
- All applicable law about the processing of Personal Data and privacy
In addition, all Suppliers shall have in place appropriate Protective Measures which are appropriate technical and organisational measures which may include: pseudonymising and encrypting Personal Data, ensuring confidentiality, integrity, availability and resilience of systems and services, ensuring that availability of and access to Personal Data can be restored in a timely manner after an incident, and regularly assessing and evaluating the effectiveness of such measures adopted by it.
Suppliers shall bear their own costs in relation to compliance with the Data Protection Legislation.