RFP Data Privacy Questionnaire Summary

This is a Data Privacy Questionnaire assessment tool for the City of Phoenix's Enterprise Asset Management software and implementation RFP. The questionnaire is designed to evaluate vendor privacy risk across three weighted criteria: implementation of a comprehensive privacy program covering all operations and systems processing personal data, existence of an incident/breach escalation and response plan, and any reportable privacy or security breaches within the past two years. Each question carries a risk score with "No" responses or no response rated as high risk (5 points), and "Yes" responses rated as low risk (1 point). The total possible score of 15 points determines an overall privacy risk rating, with scores of 1-4 classified as low risk, 5-7 as medium risk, and 8 and above as high risk. The questionnaire is to be distributed to all vendors participating in the RFP, not limited to those in the competitive range, and does not require Data Protection Officer review.

The questionnaire serves as an evaluation mechanism to assist the RFP panel in making informed decisions regarding vendor privacy capabilities for a complex, multi-departmental contract involving extensive personal and operational data. Given the City of Phoenix's significant technological ecosystem managing 443 properties across 11 client departments with over 10 million square feet and 2.1 million tracked assets, vendor privacy risk assessment is critical for protecting sensitive information across integrations with existing systems including eChris, SAP, SCADA, and various Building Automation Systems. This privacy evaluation component complements the broader 675-point evaluation framework that assesses system capabilities, experience qualifications, and implementation methodology for the five-year Enterprise Asset Management contract commencing May or July 2026.