A municipality is replacing its management application. Two suppliers offer similar functions but divide hosting, support and data access differently. A useful comparison connects those differences to procurement rules and the municipality’s responsibilities.
The provider’s domicile and certifications provide evidence, but do not settle the whole legal framework. The municipality first describes its public task, intended processing and contract duration. It can then examine the procurement procedure and supplier commitments on a common scope.
Identify the task and applicable framework
A Vaud municipality carrying out public tasks is generally subject to cantonal data-protection law. The LPrD and the cantonal authority’s guidance are the starting point. The federal FADP governs, among other things, private persons and federal bodies; it does not automatically replace the municipality’s cantonal framework.
The supplier may have its own duties for its private activities. The contract must nevertheless address the processing the municipality entrusts to it. A general statement of GDPR compliance does not establish the legal basis or the instructions governing that work.
For the application in this example, the municipality identifies the data, purposes and authorised staff. It records necessary exchanges with other authorities and retention requirements. This description helps establish whether a proposed function fits an authorised task.
Estimate the value of the whole engagement
Procurement value accounts for duration and the related payments, including options and renewals under the applicable rules. The estimate must cover the engagement rather than only the first annual expense.
For services, the Vaud guidance sets out the ordinary thresholds below, excluding VAT.
| Estimated value | Procedure indicated |
|---|---|
| Below CHF 150,000 | Direct award |
| From CHF 150,000 to below CHF 250,000 | Invitation procedure |
| From CHF 250,000 | Open or selective procedure |
A firm three-year engagement at CHF 60,000 a year totals CHF 180,000 before other items that may need inclusion. On that scope, the invitation procedure would normally be examined. Artificially dividing the work to remain below a threshold is not permitted.
The same estimate helps compare offers. A low licence fee may leave migration, interfaces or operations outside the price. Candidates need common assumptions so an initial purchase is not compared with several years of service.
Put processing and access conditions into the contract
Outsourcing leaves the municipality responsible for the processing it entrusts. The agreement records instructions and safeguards, along with authorised actors and controls. It cannot supply a missing legal basis for collection or disclosure.
The Vaud checklist dated 6 August 2025 provides a framework for examining those terms. The analysis covers processing and access locations, subprocessors, confidentiality, incident handling and return of the data.
Support access needs a concrete description of the people, systems and conditions involved. The municipality checks accounts and permissions as well as available logs and the removal procedure. A confidentiality clause alone does not implement those decisions.
Where official secrecy applies, the analysis also addresses the status and duties of people with access. Calling someone an auxiliary does not automatically establish every criminal-law consequence of the engagement. The municipality refers the relevant cases to its legal advisers.
For a provider governed by foreign law, the assessment includes potential authority access and the controls that apply to it. Swiss data residency is one element. The Federal Council’s CLOUD Act report explains why location alone does not settle the issue.
Prepare handover and public scrutiny
The contract defines usable return formats and the transition needed by a successor. An export test checks whether records, attachments and history can be taken over. The agreement also specifies the treatment of remaining copies, taking retention duties into account.
Transition arrangements must preserve service while data is migrated and assign responsibilities to each participant. A readable file is not necessarily a complete handover if the next team lacks the metadata or knowledge required to use it.
A contract held by a municipality may be an official document accessible in principle under Vaud information law. Privacy and certain business secrets can justify statutory exceptions, which require specific examination. A confidentiality clause does not automatically make the whole document inaccessible.
The decision record ultimately connects the need with procurement value, access conditions and exit arrangements. That continuity lets the municipality compare equivalent commitments and later verify the service delivered.
Scope
This article concerns Vaud. The market classification, procedure and lawfulness of processing depend on the case. The competent legal service validates particular situations.