FOI 486/25 Data Protection Services

Enquiry Reference: FOI 486-25                                                                                        

I write in connection with regards to your Freedom of Information request.  Below is your request and our response.

Under the Freedom of Information Act 2000, please provide the following information about your procurement of any

(i) external Data Protection Officer (DPO),

(ii) Data protection GDPR compliance services for the period FY2022-23 to FY2024-25: 

1.⁠ ⁠Current DPO arrangements

1.1 Is the organisation’s DPO and other staff that work on data protection

compliance:

(a) An internal employee

(b) A DPO provided by an external service provider

(c) Hybrid (internal staff with external service provider support)

1.2 Where services are provided by external providers, please share the following information:

(a) The Company name(s)

(b) Annual spend by your organisation (FY2022/2023 through to

FY2024/2025)

(c) The highest day rate paid

(d) Contract dates (start/end/renewal terms)

(e) A brief description of the project or services provided (for instance, project title or internal reference)

(f) Services covered (e.g., audits, breach management, SAR management, delivery of DPIAs) •⁠  ⁠Please indicate what deliverables were produced •⁠  ⁠Procurement method (e.g., open competition, framework agreement, direct

award) and name of the procurement framework, if applicable. 2.⁠ ⁠Consultancy Spend

2.1 What is the organisation’s, total annual expenditure on data protection/GDPR consultancy services?

2.2 For SoW/projects which have a spend of more than £5k), please share the following information:

• ⁠ ⁠Supplier company name
• ⁠ ⁠The scope of the Project (e.g., "ICO investigation support", DPIA support, Internal Audit recommendation support) •⁠ ⁠Spend •⁠  ⁠Procurement method 3.⁠ ⁠Data Protection Compliance staffing

3.1 The Number of in-house data protection staff in the organisation?

(FTE)

3.2 Are there any vacant roles? (Yes/No)

3.3 Where there any ICO investigations, audits, or enforcement actions for the period from FY2022/2023 to FY 2024/2025?

4.⁠ ⁠Future Plans

4.1 Is your organisation planning to put out to tender for any DPO/GDPR services in the current financial year?

4.2 If yes please provide the following: Expected timeline Budget range Key service requirements Procurement method

Having made enquiries within the Force our answer on this occasion is no information held we do not procure any of the above services this is all completed in house.

The Cleveland Police response to your request is unique and it should be noted that Police Forces do not use generic systems or identical procedures to capture and record data therefore responses from Cleveland Police should not be used as a comparison with any other force response you receive.

If you are not satisfied with this response or any actions taken in dealing with your request, you have the right to request an independent internal review of your case under our review procedure. The Freedom of Information Code of Practice (see below link) states that a request for internal review should be made within 20 working days of the date on this response or 40 working days if extenuating circumstances to account for the delay can be evidenced. Public authorities are not obliged to accept internal reviews after this date.

https://www.gov.uk/government/publications/freedom-of-information-code-of-practice

Yours sincerely

Information Rights Decision Maker