Data protection officer services, advice and compliance audits

Summary

The contract covers the provision of a Data Protection Officer (DPO) for the Balearic School of Public Administration (EBAP), together with data protection advice, consultancy and compliance audits. The contractor must appoint EBAP’s DPO, register the person with the Spanish Data Protection Agency and perform advisory, monitoring, audit and liaison duties. The work includes, among other tasks, preparing the processing activities register, analysing data-processing risks, advising on impact assessments, handling data-subject rights requests, and updating forms, the website, contracts, internal policies and security measures. The service also includes at least five hours of staff training each year. The processing register, review of information forms and risk analysis must be completed within the first six months; ordinary queries must be answered within seven working days, and a service report must be submitted every six months. The contract lasts 12 months from 1 November 2026, or from the day after signature if later, and may be extended up to four times for 12 months each. The budget is €7,660.22 excluding VAT (€9,268.87 including VAT). Bidders must demonstrate the required financial and technical capacity and appoint a DPO with the specified education, at least three years’ experience and required accredited certification. Subcontracting is not allowed.