IT service contract for the maintenance and evolution of the PACE system and user support

❓On minimum qualification and technical requirements, the text does not explicitly state turnover or insurance thresholds, but it does specify technical compliance obligations.

✓For example, the sous‑traitant must at least meet the “CyberFundamental Framework” of the Centre pour la Cybersécurité Belgique (CCB) at basic level, using the CCB tool, following its specific rules and maturity levels; the completed and fully documented CCB Excel file must be submitted with the offer.

✓Furthermore, where the contractor develops, hosts, manages or operates components of the SPW information systems or exchanges data with SPW systems, they must comply with the SPW Politique de sécurité des systèmes informatiques (PSSI), including policies and standards, and be able to produce audit results (internal or external) on implementation.

✓The DUME also allows bidders to indicate whether they are on official lists of approved operators and whether such registration covers all selection criteria, implying that certificates for tax and social‑security compliance must be available or accessible to the contracting authority via national databases.

❓As to deadlines, dates and procedural periods, the input text mainly covers the post‑award remedies, not the initial tender timetable.

✓For instance, it explains that if an operator disagrees with the motivated award decision, it may file a “requête en annulation” before the Conseil d’État within 60 days from the day after notification (taking the later of the email or registered letter dates) and, in extreme urgency, a “demande de suspension et/ou de mesures provisoires” within 15 days on the same basis.

✓These remedies run under Belgian law (loi du 17 juin 2013, laws on the Conseil d’État, arrêté du Régent du 23 août 1948).

✓While the main submission deadline and offer validity period are not quoted in the excerpts, the data‑processing convention indicates timing requirements such as the need to submit requests for authorization of further subcontractors at offer submission and at least 60 days before recruiting a new sub‑processor, and to provide annual proof of adherence to the EU‑US Data Privacy Framework where transfers rely on that adequacy decision.

❓Concerning award criteria and weighting, the provided text does not detail price/quality scoring or explicit weighting for award.

✓Instead, it emphasizes selection and exclusion criteria via the DUME and legal compliance with EU procurement directives and GDPR.

✓Bidders must declare that they satisfy all selection criteria (Part IV, “Il satisfait à tous les critères de sélection exigés”) and accept that false declarations or concealment of information may constitute exclusion grounds.

✓The tender also stresses that operators that have previously advised or otherwise been associated with preparation of the procedure must declare this, as well as any conflict of interest, which could affect eligibility and evaluation.

✓On risks and special conditions, the addendum contains a dense set of obligations and sanctions.

✓For example, the sous‑traitant must implement all appropriate technical and organisational measures, ensure confidentiality, limit access to personal data to strictly necessary staff and sub‑contractors, apply data protection by design and by default, and maintain a regularly tested security regime.

✓For sensitive data (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade‑union membership, genetic or biometric data, health, sex life or orientation, criminal convictions, national register data), the sous‑traitant must apply specific limitations and additional safeguards under Belgian law, including an up‑to‑date list of authorised persons with precise role descriptions and specific confidentiality undertakings.

✓In case of data breaches, the contractor must promptly fill in the prescribed incident notification form and send it to the DPO, take remedial measures, and not inform data subjects or third parties without explicit authorization.

✓Regarding subcontracting, any further sous‑traitant ultérieur requires prior specific written authorization, a contract imposing essentially the same data‑protection obligations, and a “clause du tiers bénéficiaire” allowing the controller to terminate and require deletion/return of data if the main subcontractor disappears or becomes insolvent.

✓For international data transfers, only transfers complying with GDPR Chapter V are allowed, for example based on an adequacy decision (including the 10 July 2023 EU‑US decision) or appropriate safeguards (Article 46 GDPR) evidenced by completed Standard Contractual Clauses and a transfer impact assessment demonstrating effective rights and remedies for data subjects; if adequacy is withdrawn or invalidated, processing in the relevant third country must cease immediately.

✓Finally, in terms of penalties, any breach of Articles 6 or 8 of the convention (notably security and transfer obligations) or any data‑breach violation exposes the adjudicataire to a penalty of 2.5% of the executed contract amount at the date of the triggering event, cumulative for multiple events, and the authority may suspend processing or terminate the market if non‑compliance is serious or persistent, without prejudice to application of the arrêté royal du 14 janvier 2013 (measures d’office) and GDPR Article 82 liability for damage to third parties.