The AEPD tenders consultancy for its adaptation to the National Security Framework

The Spanish Data Protection Agency (AEPD) has published a tender announcement in the Official State Gazette to contract a consulting service aimed at its adaptation to the National Security Framework (ENS). The contract, processed under file EX20260032, is published in BOE number 216, dated September 2, 2026, section V-A, page 46100, and is signed by the president of the Agency, Lorenzo Cotino Hueso.

The announcement, submitted on August 26, 2026, responds to the obligation of public bodies to align their information systems with the ENS, the regulatory framework that governs the security of public administration systems. The AEPD, a state authority based in Madrid, acts here as the contracting authority in its capacity as the data protection supervisory body.

Object and characteristics of the contract

The service consists of the provision of consulting for the Agency’s adaptation to the National Security Framework, with an estimated value of 47,273.92 euros. The contract will be executed over 12 months, starting from the day following its formalization, and no variants will be admitted.

• CPV Codes: 72246000 (systems consultancy services) and 79417000 (security consultancy services).
• Place of performance: ES300 (Madrid).
• Procedure: open.
• Language of bids: Spanish.

Award criteria and solvency

The award will be resolved through an open procedure in which the price will weigh 35%, quantifiable criteria via formulas other than price 20%, and criteria assessable by value judgment 45%. Bidders must prove the capacity to act, not be subject to any prohibition from contracting, and present declarations of economic and technical solvency.

The execution of the contract also incorporates environmental considerations included in the characteristics table of the specific administrative clauses document.

Deadlines and opening of bids

Bids may be submitted until 12:00 PM on September 11, 2026, electronically, at the headquarters of the AEPD (Paseo de la Castellana 141, 28046 Madrid). The bidder must maintain their offer for 5 months.

• Opening of the administrative envelope: September 17, 2026 at 10:00, electronically.
• Opening of the economic envelope: September 24, 2026 at 10:00, electronically.
• Deadline for filing appeals: 1 month.

The tender is processed entirely electronically, with electronic submission of bids, orders, invoicing, and payment, and the specifications are freely and gratuitement accessible through the Public Sector Procurement Platform.

Relevance for the sector

This contract, of moderate value but high strategic importance, opens an opportunity for ICT and cybersecurity consulting firms specializing in compliance with the National Security Framework (Esquema Nacional de Seguridad). As it involves the data protection supervisory authority itself, the adaptation of its systems reinforces the organization’s credibility as a benchmark for information security within the Spanish public sector.

Source: Official State Gazette, no. 216, September 2, 2026, Sec. V-A, page 46100 (official reference: BOE-B-2026-28403).