Contract award and challenges

This practical guidance relates to the pre-Procurement Act 2023 regime

This subtopic contains a range of resources for contracting authorities conducting a public procurement exercise commenced before the Procurement Act 2023 (PA 2023) came into force on 24 February 2025. In-scope procurements begun on or after this date are governed by PA 2023. Under the transitional and savings provisions for PA 2023, the previous regimes continue to apply to the extent necessary to allow contracting authorities to complete and manage procurements commenced before PA 2023 came into force (ie ongoing procurements).

This subtopic considers matters that a contracting authority conducting an ongoing procurement will need to address once it reaches its decision on contract award, with particular focus on public procurement procedures under the Public Contracts Regulations 2015 (PCR 2015), SI 2015/102. It also examines some of the issues the parties may encounter after a contract has been awarded, for instance in the event of a subsequent modification or legal challenge.

This overview focuses on the law and principles applicable under the pre-PA 2023 regime. For guidance on

To view the latest version of this document and thousands of others like it, sign-in with LexisNexis or register for a free trial.

Powered by Lexis+®
Latest Public Law News

Data by any other name—Court of Appeal reverses Upper Tribunal’s ruling on the protection of ‘personal data’ (DSG v ICO)

Information Law analysis: In this case, the Court of Appeal unanimously allowed the appeal brought by the Information Commissioner’s Office (ICO), holding that it is sufficient that data which has been subjected to unauthorised or unlawful processing by a third party still constitutes personal data from the perspective of the data controller, even if it is pseudonymised ‘in the hands of’ the data controller and therefore anonymised ‘in the hands of’ the attacker. Accordingly, the court held, the data controller is required to take ‘appropriate technical and organisational measures’ (ATOMs) to protect that personal data against such hackers, even where those third parties cannot themselves identify the individuals to whom the data relates. Even though this judgment is under the Data Protection Act 1998 (DPA 1998), this decision is significant as it confirms, in terms equally applicable to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), that the scope of the security obligation is not diminished merely because stolen or exfiltrated data would be anonymised in the hands of the third party with unlawful access. This development expands and makes more pressing the obligation on controllers to assess and guard against a broader range of threats—including ransomware, data destruction, and bulk exfiltration, regardless of the attacker's capacity to re-identify data subjects. Written by Adelaide Lopez, senior associate at Wiggin LLP.

View Public Law by content type :

Popular documents