Call for tenders' details

The deadline to submit tenders has been extended. The time limit for receipt tenders is: 11/11/2019, at 10:00 (Brussels time) Conditions for opening tenders is: 11/11/2019, at 15:00 (Brussels time)
Service Contract for the Provision of a Study on ‘High Power Electromagnetic Mun...
Contracting authority:
European Defence Agency (EDA)
TED publication date:
Time limit for receipt of tenders:
English (en)
Question details
Service Contract II.9.2 Processing of personal data by the contractor
Please note that this section II.9.2 is not entirely acceptable: the purpose of the contract not being the processing of personal data, the controller doesn’t act as data processor (under art. 28 GDPR) but rather as data controller. As such, it processes the data collected under the contract – which is exclusively business data - in compliance with its own, internal, management methods and procedures. As such, we kindly request that this be drafted as follows: “The processing of personal data by the contractor shall meet the requirements of Regulation (EU) No 2018/1725 and be processed solely for the purposes set out by the controller. The contractor shall assist the controller for the fulfilment of the controller’s obligations under Chapter III (Articles 14-25) of Regulation (EU) No 2018/1725. Should the controller be made aware directly of any such requests the contractor shall inform, without delay, the controller about such requests.”
Please note EDA is not in a position to modify the general conditions of the service contract. Please also note that the GDPR does not apply to EDA. The applicable legal framework to the contract is indeed Regulation 2018/1725. EDA is the ‘data controller’ meaning that EDA defines the purpose and means of the processing of personal data. The contractor assists the data controller and acts on its behalf under its supervision and instructions. Finally, business data is rather of a commercial nature and therefore, not subject to data protection rules.