How to check proposal software UK regulations before you buy

What to take away

Checking proposal software UK regulations starts with one answer: confirm what the supplier does with your data before you sign, not after. In England, the ICO enforces the UK GDPR and the Privacy and Electronic Communications Regulations 2003, so you carry duties even when a vendor hosts everything.

Ask for the processing terms, the security evidence and the retention schedule in writing. Test whether the audit trail satisfies your own record-keeping obligations. Budget for a review each time the vendor changes subprocessors.

Start with the data roles

You are the controller for prospect data you upload; the vendor is normally your processor. The ICO's Guide to the UK GDPR section on controllers and processors explains those roles. The controller answers to the regulator.

Controller vs Processor Roles

Who answers to the ICO?

Yes

You are controller -> you answer

Vendor is processor -> vendor assists

The ICO explains obligations when using data brokers for marketing; this logic covers enrichment data piped into quoting tools. If a vendor buys contact records from a broker and drops them into your pipeline, you inherit the risk.

Ask which lawful basis covers that data and get the answer in writing. For example, a data processing agreement clause could set a 12-month retention period for unsuccessful proposal records and require deletion within 30 days of contract end.

Ask where the data sits, who can access it, and which transfer mechanism applies if it leaves the UK. The ICO's guidance on international transfers and its transfer risk assessment tool set out the options. A prospect who asks for a record to be corrected or erased sets a deadline that the processor must help you meet.

Check the security evidence

A vendor's security page is marketing, not evidence. Ask for the current certificate scope, the penetration test summary and the subprocessor list. Ask who signs the security questionnaire and when it was last updated.

Ask for ISO/IEC 27001 certification and, where relevant, Cyber Essentials. The digital risk management standards from BSI are not a substitute for ISO/IEC 27001, which is the certificate UK buyers usually request, or Cyber Essentials for basic technical controls.

Security Evidence to Request

Current certificate scope
Penetration test summary
Subprocessor list
Security questionnaire signer
Last updated date
Certificate expiry date

Certificates expire, so note the expiry date in your file. A team paying £400 a month for quoting software should expect the same evidence it would demand from any other processor handling client names and pricing.

Map the disclosure rules

Every outbound document is a disclosure decision. Pricing, case studies and named referees all leave the building, and some sectors restrict what may be shared before contract award. Our guide to a proposal software disclosure policy in England sets out how to classify content before a template is reused.

Review templates at least twice a year, because a clause that was safe last year may not be now. Keep the approval record attached to the version that was actually sent. Name one owner for the template library and record why each clause exists, so the next reviewer does not have to guess.

Watch public sector procurement

If you sell to government buyers, the procurement rules travel with the contract. The Federal Acquisition Regulation is the US rulebook, not a UK source. In England, read the Procurement Act 2023 and the Public Contracts Regulations 2015, and check Find a Tender for notices.

The Procurement Act 2023 and the Public Contracts Regulations 2015 govern UK public contracts, so read the tender documents rather than assuming. The practical step is to list every clause a buyer can impose on your tooling and check which ones your software can actually satisfy.

Build a before and after check

The table below compares the questions teams typically ask before a compliance review with the ones they ask afterwards.

Before and after check

Question asked

Before: Does the vendor say it is compliant?
Before: Is data stored in the UK?
After: Which lawful basis covers enrichment data?
After: What is the certificate scope and expiry?
After: How long are sent documents retained?
After: How do we hear about a new subprocessor?
After: Who approves a new template clause?

Evidence expected

Before: A web page and a logo
Before: A verbal assurance
After: A signed processing agreement
After: The current certificate and report
After: A written retention schedule
After: Written notice and a right to object in the DPA
After: A named approver and version log

Set a review rhythm

Treat compliance as a running cycle rather than a once-a-year purchase. Diarise a check when the vendor changes subprocessors, when you add a new data source, and when your own retention period ends. Our wider proposal software rules and compliance guide for 2027 explains how those triggers fit together across a buying cycle.

Keep one owner for the vendor file. If nobody owns it, the first audit request will find the gaps for you. Set that review alongside the renewal date, while you still have room to negotiate changes.

Common questions

Does UK GDPR apply to proposal software hosted outside the UK?

Yes, if you are established in the UK and the processing relates to people in the UK. The vendor's location changes the transfer mechanism you need, not whether the rules apply.

Do we need a data processing agreement for a quoting tool?

In practice, yes, because the vendor processes personal data on your behalf. The agreement should set out purpose, duration, security and subprocessors.

Can we rely on the vendor's certificate alone?

No. Check the scope covers the service you bought and note the expiry date. Certificates are evidence of a process, not a guarantee for your configuration.

Is this legal advice?

No. This is general guidance only, and individual cases need a qualified adviser who can review your contracts and data flows.