Public tenders and SaaS: the sovereignty clauses you will be asked for

The sovereignty clauses in a public tender tend to be written late, copied from the last tender, and discovered to be unworkable at the evaluation stage, usually by the person who has to explain why the only compliant bid is also the most expensive one.

They are far easier to get right at the start. Here is what keeps coming up, and what to check before the specification goes out rather than after.

Where the requirements come from

Three sources, which is why they look scattered.

Personal data law. The GDPR does not forbid using a non-European supplier, but it frames transfers outside the EEA and it makes the controller, you, the guarantor of the chain. Practical consequence: you have to be able to describe where the personal data goes and who can reach it.

Public procurement rules. Procurement codes allow technical requirements proportionate to the subject matter of the contract. Hosting location and applicable law can be among them where the data justifies it. "Proportionate" is the word that matters, and it is where the challenges land.

Sector rules. Social services, health, enforcement, critical infrastructure: each brings its own, and they generally take precedence over the general case.

The clauses that keep coming up

Six, roughly in the order they cause trouble.

1. Where it is hosted

Easy to write and easy to satisfy, which is why it is rarely sufficient on its own. Specify the region, and specify whether it is contractual or a matter of goodwill. Ask whether backups and disaster recovery copies are covered by the same clause; very often they are not.

2. Applicable law and the supplier's nationality

The clause that genuinely discriminates between bids, and the one most often forgotten. Hosting location is a hosting decision; the law a company answers to is a fact about that company, and no quantity of European infrastructure changes it. The legal mechanism behind that distinction is set out in what hosting in Ireland does not settle. Ask for the contracting entity, its country of registration, and its ultimate parent. The last one is where European-sounding subsidiaries come apart.

3. The subprocessing chain

A fully European supplier with an American analytics provider, an American mail relay and American support has an American chain. Require the list, with countries, and require notice before it changes.

4. Exit and getting your data back

Everybody writes that clause. I have yet to see anyone test it. "The supplier returns the data at the end of the contract" is not a specification, it is a sentiment.

Write instead: in what format, within how many days, attachments included, history included, and at whose cost. Then require an exit test during the contract. A supplier unable to produce your data on demand in year two will be no more able to in year five, and year two is when you can still act.

5. Audit and transparency

The right to audit, or to receive the supplier's audit reports. And one precise obligation: that the supplier inform you, as far as the law permits, of any request from a foreign authority concerning your data.

6. Continuity and change of control

What happens if the supplier is acquired. For a sovereignty requirement this is not theoretical: acquisition is precisely how a compliant supplier becomes non-compliant, without anything changing in the service. It is the first caveat to put to a European supplier.

The questions that sort fastest

Four, at the questionnaire stage, before anyone writes a bid.

1. Name the contracting entity, its country of registration, and that of its ultimate parent.
2. List every subprocessor with access to the data, with countries.
3. Describe the exit procedure concretely: format, timescale, scope, cost.
4. State whether you are subject to any non-European law requiring you to disclose data under your control.

The fourth is the good one. The answer is yes or no, the question is short, and it is uncomfortable to dodge in writing.

A note on proportionality

It is worth resisting the temptation to put maximum sovereignty requirements into every tender. A meeting-room booking contract does not need the clauses above, and a specification that overreaches is a specification that gets challenged, or that produces a single compliant bid at an indefensible price.

Fit the clauses to the data. Citizens' records, enforcement files and tender documents justify them. Most other things do not.

Where we sit

We answer those four questions the same way every time, so we may as well do it here: Belgian company, no parent elsewhere, hosting in European data centres (Scaleway in France, Hetzner in Germany) or on your own servers, and subject to no non-European disclosure law.

Klaro Cards is used by local government for roads, public buildings and contractor tracking. If you are drafting the replacement for something being withdrawn, Jira Data Center for instance, the clauses above are worth settling before the calendar settles them for you.

This article describes a practice. It is not legal advice. Have any clause reviewed by your own legal team before it goes into a specification.