The Provision of Data Protection Officer Managed Services [611]

The CRU is required under Article 37 of the General Data Protection Regulations (GDPR) to appoint a designated Data Protection Officer (DPO). The DPO is a critical role in the CRU’s governance structure and must carry out their duties independently. The CRU is seeking to engage data protection services to fulfil the role of DPO. The contract commencement date will be January 2026 for an initial period of 1 year, with the option to extend by an additional year subject to satisfactory performance, budget availability and ongoing business needs. The DPO services may be required initially for 1 to 2 days per week.