On 19 December 2017 the Crown Commercial Service (CCS) published Procurement Policy Note (PPN) 03/17 on Changes to Data Protection Legislation and General Data Protection Regulation.
PPN 03/17 applies to all central government departments, their executive agencies and non-departmental public bodies ('in-scope organisations'). CCS notes that other public bodies will also be subject to the new data protection legislation and may wish to apply the approaches set out in PPN 03/17.
In-scope organisations must begin to apply the provisions of this PPN immediately, ensuring any contract amendments take effect from 25 May 2018 and new provisions are applied to all new relevant contracts awarded on or after 25 May 2018. For contracts that concern law enforcement processing, amendments should take effect from 6 May 2018.