Wednesday, 14 March 2018 12:19

How TUCO are getting ready for GDPR

Written by
Rate this item
(0 votes)

The General Data Protection Regulation (GDPR) enforcement date is 25 May. This is also when the current Data Protection Act 1998 will be replaced by a new Data Protection Act 2018 – and there are actions we need to take before this date.TUCO Framework and Call-Off agreements are being amended and will be used to replace existing data protection clauses, so that our contracts comply with the GDPR and the new Data Protection Act.

Which TUCO frameworks and contracts are being updated and what will happen?

We have taken a risk-based prioritisation approach to implementing GDPR into our frameworks and contracts:

  • Low risk – where there is minimal or no personal data involved no change will be made to include the new GDPR compliant clauses. However, and regardless of risk, we will make changes to T&Cs of all in progress tenders.
  • Medium to High risk – where suppliers’ process personal data, new Call-Off T&Cs will be uploaded to the TUCO website. TUCO will identify these agreements and once identified we will write to you to confirm the agreements. We will also ask suppliers to complete GDPR assessment questionnaires which will be assessed by TUCO and where necessary the Framework T&Cs with each supplier will be varied. 

What about my ongoing call-off contracts?  

We will upload to the TUCO website, variations to Call-Off T&Cs and variation guidance, for members to follow. Members will be able to use the T&Cs or update their own Call-Off T&Cs, if used.Members will be responsible for issuing the variation to make these changes into any of your call-off contracts involving the processing of personal data. By mid April we will write to you and advise the agreements and suppliers and confirm the revised Call-Off T&Cs and variation guidance and framework T&Cs available.

Do suppliers have to accept the change? 

Yes, they are under a duty to comply with law, and the GDPR requires them to insert these provisions.

What are the key dates? 

The GDPR comes into force on 25 May 2018. Therefore, consortia and members must have contract clauses changed before this date. 
We are aiming to ensure that all framework changes are signed by the end of April. We will confirm to you when this has been done.
You will then have until 25 May to vary the changes to your call-off contracts.

Read 2369 times Last modified on Thursday, 10 May 2018 05:24



Advertising Opportunities: Dan Hillman

t: 0345 500 6008 e:

TUCO Magazine Editor: Morag Wilson

t: 01474 520 267 e:

Contact Us

The University Caterers Organisation Ltd

3rd Floor, National House

St Ann Street, Manchester

M2 7LE

t: 0161 713 3420 e: