not amount to approval of their sufficiency by the Controller). This is following concerns raised as to (a) the resources available to check the sufficiency of Protective Measures each time; and (b) the risk that a Processor might argue that the approval of inadequate protective measures would excuse Controller’s the Controller of its failure to provide effective measures. Updates in Annex B: Model selection stage questions at 2.6. Model award-stage question at 2.11. A new Annex D on technical security considerations. Dissemination and Scope 4. The contents of this Procurement Policy Note (PPN) apply to all Central Government Departments, their Executive Agencies and Non Departmental Public Bodies. Together these are referred to in this PPN as public bodies will also be ‘In-Scope Organisations’. Other subject to the new data protection legislation and may wish to apply the approaches set out in this PPN. 5. In-Scope Organisations should circulate this PPN widely across their organisations, and work closely with Data Protection/Information Assurance leads within their organisations on implementation. Timing 6. In-Scope Organisations should already be working towards GDPR compliance for their existing commercial agreements as set out in PPN 03/17, to be compliant by 25 May 2018. This PPN enhances and builds on the content of PPN 03/17, so any contract amendments made using PPN 03/17 are valid. However, for any contract amendments yet to be agreed and for new contracts to be let after 25 May, you should use the provisions of this PPN including the updated standard generic clauses at Annex A. For contracts that concern law enforcement processing, amendments should take effect from the date that the Data Protection Bill comes into force. Action 7. In line with PPN 03/17 in-Scope Organisations should already have identified existing contracts involving processing personal data which will be in place after 25 May 2018 (organisations should have a GDPR implementation lead who will have been compiling this information), and then:
not amount to approval of their sufficiency by the Controller). This is following concerns raised as to (a) the resources available to check the sufficiency of Protective Measures each time; and (b) the risk that a Processor might argue that the Controller’s approval of inadequate protective measures would excuse the Controller of its failure to provide effective measures. Updates in Annex B: Model selection stage questions at 2.6. Model award-stage question at 2.11. A new Annex D on technical security considerations. Dissemination and Scope 4. The contents of this Procurement Policy Note (PPN) apply to all Central Government Departments, their Executive Agencies and Non Departmental Public Bodies. Together these are referred to in this PPN as ‘In-Scope Organisations’. Other public bodies will also be subject to the new data protection legislation and may wish to apply the approaches set out in this PPN. 5. In-Scope Organisations should circulate this PPN widely across their organisations, and work closely with Data Protection/Information Assurance leads within their organisations on implementation. Timing 6. In-Scope Organisations should already be working towards GDPR compliance for their existing commercial agreements as set out in PPN 03/17, to be compliant by 25 May 2018. This PPN enhances and builds on the content of PPN 03/17, so any contract amendments made using PPN 03/17 are valid. However, for any contract amendments yet to be agreed and for new contracts to be let after 25 May, you should use the provisions of this PPN including the updated standard generic clauses at Annex A. For contracts that concern law enforcement processing, amendments should take effect from the date that the Data Protection Bill comes into force. Action 7. In line with PPN 03/17 in-Scope Organisations should already have identified existing contracts involving processing personal data which will be in place after 25 May 2018 (organisations should have a GDPR implementation lead who will have been compiling this information), and then:
GDPR_PPN_02-18__May_Release__Final1.docx