2026M039_Internet - Framework service agreement on Internet access for the Walloon Public Service

✓On the scope of the contract, the convention itself covers only the personal-data aspects of the wider Internet-access framework.

✓The object of the processing (Annexe I) is that the sous-traitant grants named SPW staff access to its reporting/monitoring systems, where personal data of staff may appear and where all accesses are recorded (logs) and can be analysed in real time or afterwards.

✓Such as: logging access via codes, maintaining data temporarily for analysis, extracting access logs, creating temporary backups, and using the data strictly technically to perform analyses.

✓Categories of data subjects are SPW “membres du personnel”; the data are mainly “données d’identification” (identification data), with sensitive data boxes left unchecked.

✓The duration of processing is limited to the time strictly necessary to perform the services under the framework market; at the end of the market or of the processing, data must be returned or deleted within 30 days, in a structured, commonly used digital format, with proof of destruction thereafter.

❓Quantities and detailed service levels for Internet access are not described in this extract; they are in the “cahier spécial des charges” referenced but not reproduced.

❓As to award criteria and their weighting, the provided text does not spell out any selection or award criteria (such as price, quality, security scores, references, turnover, insurance thresholds, etc.) nor any explicit weighting.

❓It only indicates compliance obligations (GDPR, CCB basic level, SPW PSSI) and documentation/audit duties, which will likely be linked to suitability or technical capacity in the main tender documents but are not described here.

✓In other words, within this convention the bidder’s obligations are framed as mandatory conditions of contract performance and compliance rather than scored award criteria.

✓On risks and special conditions, the convention contains several important clauses.

✓Such as: a specific penalty regime whereby, in case of a data breach or violation of Articles 6 or 8 of the convention, the adjudicataire is exposed to a penalty of 2.5% of the executed amount of the market at the date of the triggering event, with cumulative application for multiple events, without prejudice to damages, criminal prosecution or “mesures d’office” under the Belgian Royal Decree of 14 January 2013.

✓Responsibility is governed by Article 82 GDPR; the sous-traitant must indemnify the responsable du traitement for all damages, including reputational harm, costs, legal fees, fines or penalties connected to its or its sub‑processors’ breaches, and must intervene in guarantee in court proceedings.

✓Subcontracting is allowed on a general basis but subject to a prior agreed list (Annexe III); the sous-traitant must notify any changes 60 days in advance, allow the controller to object, flow down essentially identical data-protection obligations to sub‑processors, remain fully liable for them, and include a third-party beneficiary clause so that, if the main sous-traitant disappears or becomes insolvent, the controller can instruct the sub‑processor to delete or return the data.

✓International transfers are heavily restricted, and data-breach handling is tightly framed: the sous-traitant must maintain detailed logs, deploy incident-detection tools, perform at least annual penetration tests, notify incidents via a specific form on the e‑procurement site to the DPO, and cooperate fully in investigations and remedial measures.

✓The validity period of the convention is for as long as the sous-traitant delivers the services under the market; confidentiality, liability and applicable-law clauses survive termination.

❓No question deadline or site visit requirement appears in the extracts.

✓Concerning contradictions or corrections within the documents, there is an explicit hierarchy clause and another clause that partly conflicts with it.

✓Clause 4 (“Hiérarchie”) states that, in case of contradiction between this convention and other provisions of the “cahier spécial des charges” or its annexes, the “cahier spécial des charges” prevails.

❓However, later, in clause 13.1 (“Dispositions finales”), it is stipulated that, in case of conflict between this convention and the “Marché” referred to in the recitals, the provisions of this convention prevail so as to ensure GDPR-compliant execution.

✓Since the cahier spécial des charges forms part of the Marché, these two statements are difficult to reconcile and create ambiguity as to which text ultimately governs in case of conflict.

✓From a data-protection perspective, the intention is clearly that any clause needed to ensure compliance with GDPR should prevail over other market provisions; yet the explicit hierarchy in clause 4 favours the special specifications.

❓In practice, this should be interpreted such that the cahier spécial des charges governs general contractual aspects, but the convention prevails wherever necessary to maintain GDPR compliance; however, this interpretative reconciliation is not spelled out and represents a genuine internal tension.

✓Another minor duplication appears in the incident-notification paragraph, where the sentence about using the e‑procurement form and sending it to the DPO is repeated almost identically; the substantive rule (use the e-procurement incident form, send to DPO) is clear despite this redundancy.

Answers on the required criteria

Must securities be provided (bid bond, performance or warranty guarantee)? If so: which, in what amount and by when?

❓As for the other requested topics (securities/bonds, site visit, tender language, validity period of tenders, deadline for bidder questions), the provided text does not contain explicit procurement‑procedure clauses.

Is subcontracting allowed? If so: with which limits and which disclosure duties?

✓Regarding subcontracting: the texts explicitly allow “sous‑traitants ultérieurs” (sub‑processors) under conditions.

✓Such as, the main contractor has a general authorisation to recruit further subcontractors on the basis of a pre‑agreed list (Annexe III), must notify the contracting authority in writing of any change to that list at least 60 days in advance, and must provide the information needed for the authority to exercise a right of objection.

✓Any sub‑subcontract must impose, in substance, the same GDPR and security obligations as those in the convention, including audit rights and compliance with SPW PSSI.

✓The main contractor remains fully responsible for the acts and omissions of sub‑processors, must inform SPW of any breach by them, and must agree a third‑party‑beneficiary clause allowing SPW to terminate the sub‑processor’s contract and order deletion/return of data if the main contractor disappears or becomes insolvent.

✓Sub‑processing must also comply with any conditions set in the cahier des charges, and international transfers to non‑EU states are forbidden without prior written consent, except where required by EU or member‑state law.

How long is the bidder bound by the tender (validity period), and is there a deadline for bidder questions? If so: until when?

❓There is no mention, such as, of bid bonds, performance or warranty guarantees, their amounts or timing; no clause on a site visit or mandatory attendance; no stipulation of the language in which the tender and supporting documents must be submitted or whether other languages are accepted; and no provision on how long the bidder is bound by its offer or by when questions from bidders must be submitted.

Further details

✓The input text concerns an SPW Digital (Service public de Wallonie) public contract for internet access (reference 2026-S2300000-115, cahier des charges SPW-DIGITAL_2026M039) and, in particular, the annexed GDPR data-processing agreement (Annexe 05) and internal SPW information‑security policies (PSSI).

✓The country context is Belgium (Walloon Region), and the rules are drafted from the perspective of the Walloon administration as contracting authority (“pouvoir adjudicateur”) and GDPR controller (“responsable du traitement”) dealing with a contractor (“adjudicataire/sous‑traitant”).

✓The documents focus on GDPR‑compliant processing of personal data and SPW’s information‑security framework.

✓They describe, such as, the obligations of the contractor as data processor, requirements to comply with the Belgian Centre for Cybersecurity’s CyberFundamental Framework, and the obligation to respect the SPW PSSI, including detailed policies on application development, access to resources, audit, confidentiality and security documentation.

✓They also set out how logs must be kept, how data breaches are reported via e‑procurement to the SPW DPO, and how audits and security contacts are organised.

❓Any such requirements would have to be looked up in the main cahier spécial des charges of the 2026M039 tender or in the general Belgian public‑procurement regulations referenced (e.g.

❓AR 14 janvier 2013), but they are not included in the extracted text.