Reviews
3 questions Edinburgh legal and public sector buyers ask proposal software vendors
Proposal software buyers in Edinburgh should ask vendors three questions: procurement route, data protection evidence and professional obligations.
What to take away
- Edinburgh legal and public sector teams buying proposal software should ask three questions: procurement route, data protection evidence, and professional obligations.
- Public sector buyers must check Public Contracts Scotland (PCS) alongside the Procurement Act 2023 and Find a Tender Service (FTS) notices before any vendor call.
- Data protection answers need ICO UK GDPR evidence, not marketing claims.
- Legal buyers should be able to show the Law Society of Scotland how client files and data are handled; firms with FCA permissions need the same evidence for their regulator.
- Cyber Essentials certification is a baseline ask for public sector and many legal buyers.
- Prepare written answers to all three before the next vendor call.
The procurement question Edinburgh buyers ask first
The first question from Edinburgh public sector buyers is: which procurement route are we using, and does this vendor appear on it?
That matters because Scotland's public bodies follow the Public Contracts (Scotland) Regulations 2015, while UK-wide policy sits in the Procurement Act 2023 and Public procurement policy - GOV.UK. Edinburgh buyers check Public Contracts Scotland (PCS) for Scottish notices and FTS for prior notices and call-off contracts.
A vendor that is not on a framework or does not appear in FTS creates a compliance problem before the demo. Ask for the framework name, lot number and contract reference.
Legal firms in Edinburgh's New Town apply similar discipline. They ask whether the vendor's contract can be assigned, how exit is handled, and what happens to data at termination.
Framework status also affects price. A CCS or Scotland Excel route usually caps rates, while a direct award leaves room for negotiation. Ask which applies before you discuss seat counts.
The data protection question and what evidence satisfies it
The data protection question is simple: where is our data stored, who can access it, and what happens if we ask you to delete it?
Edinburgh legal and public sector buyers want evidence, not reassurance. The ICO's UK GDPR guidance and resources | ICO sets out controller and processor duties under UK GDPR and the Data Protection Act 2018.
Ask for the vendor's Record of Processing Activities, a Data Processing Agreement, and the sub-processor list. If the vendor uses cloud hosting outside the UK, ask for the transfer mechanism and the safeguards in place.
A useful test is the deletion request. Ask the vendor to describe, in writing, how a client's data is deleted from backups and how long that takes. Vague answers are a red flag.
For a structured approach, vendor due diligence needs a written checklist so each answer is comparable across vendors.
Data protection evidence to request
- Data Processing Agreement with UK GDPR clauses
- Record of Processing Activities
- Sub-processor list with locations
- Retention and deletion schedule
- Breach notification process and timescales
- Cyber Essentials certification or equivalent
- Named Data Protection Officer or contact
Cyber Essentials is a baseline ask. The Cyber Essentials scheme: overview - GOV.UK explains the five controls and the certification route. Public sector buyers in Edinburgh often require it, and legal firms increasingly do too.
For staff vetting, some Edinburgh legal buyers ask about BS 7858. The Buy Standards: Discover BSI Knowledge | BSI page sets out the standard for screening staff in security environments. It is not mandatory for software vendors, but it signals maturity.
The professional obligations question and what evidence satisfies it
The third question comes from your own regulator: what do our professional obligations require, and can this vendor help us evidence them?
Vendor A vs Vendor B evidence
Vendor A
- DPA
- Provided
- Cyber Essentials
- Provided
- Compliance lead
- Named
- Materials sent
- Documents
Vendor B
- DPA
- Not provided
- Cyber Essentials
- Not provided
- Compliance lead
- Not named
- Materials sent
- Brochure
For solicitors in Edinburgh, that regulator is the Law Society of Scotland. Its practice rules on client confidentiality and record keeping mean the vendor's data handling has to be defensible, not just secure.
Legal firms that also hold FCA permissions ask about the vendor's own FCA status, whether it is authorised or an appointed representative, and how it handles outsourcing under SYSC 8.
Ask for the vendor's latest penetration test summary, its incident history and its business continuity plan. Regulated buyers need to show they have assessed third-party risk.
A worked example helps. Suppose a regulated Edinburgh buyer shortlists two vendors. Vendor A provides a DPA, Cyber Essentials and a named compliance lead. Vendor B provides a brochure. The choice is not about features; it is about evidence.
This is where proposal software UK regulations become practical: they shape what you can sign, not just what you can buy.
How to prepare answers before the next vendor call
Preparation beats improvisation. Build a one-page answer sheet before the call, covering procurement, data protection and FCA status.
Steps to follow:
- Procurement.Write down which procurement route you are using, then check the vendor against Public Contracts Scotland (PCS) and Find a Tender Service (FTS) notices.
- Data protection.List the documents you will ask for: a DPA, a Record of Processing Activities and a sub-processor list.
- Professional obligations.Note what your own regulator, the Law Society of Scotland for solicitors, expects you to be able to show on confidentiality and record keeping.
- Evidence.Email the vendor the same three questions about its proposal software and ask for documents, not links to marketing pages.
- Scoring.Score each answer against the one-page sheet and record what the vendor did not provide.
- Filing.Keep the completed sheet with the contract file so the decision can be shown to an auditor or regulator.
Prepare your answer sheet
- Confirm procurement route and framework reference
- List data protection evidence to request
- Check FCA regulation and outsourcing rules
- Write three questions for every vendor
- Assign one person to record answers
- Compare answers before any second call
A worked example: an Edinburgh legal firm runs a 30-minute vendor call. It asks for the DPA, Cyber Essentials certificate and the sub-processor list. Two vendors send documents within a day; one sends a link to a marketing page. The firm shortlists the two that sent documents.
Decide whether you are running a selection checklist or a demo-led shortlist. The checklist approach suits regulated buyers because it produces a written record.
Keep the answer sheet with the contract file. If the ICO or an internal auditor asks later, you can show how the decision was made.
