How to Write Requirements for Video Anonymization Software in an RFP or Public Tender
TL;DR: Most anonymization tenders are decided on price because the specification gave the evaluators nothing else to score. Write deployment model, measured recall and an acceptance test into the requirements and the decision becomes defensible. This guide is for procurement leads, DPOs and IT managers in municipalities, universities, hospitals and transport operators, with notes on where Gallio PRO fits.
The requirement that disqualifies every honest bidder
Start with the clause that causes the most damage, because it appears in a large share of published tenders:
"The software shall automatically detect and obscure all personal data appearing in the recording."
No product does this. Automatic detection in commercial anonymization software covers faces and license plates. Name badges, monitor screens, documents, tattoos and logos are redacted manually. A bidder who reads the clause literally either withdraws or prices in a risk premium. A bidder who does not read it carefully wins, and the gap surfaces during acceptance.
Write instead: "The software shall automatically detect and obscure faces and vehicle license plates, and shall provide a manual editing capability for obscuring additional objects selected by the operator, including badges, documents and screens." That clause is satisfiable, comparable across bids and honest about the workflow you are buying.
What the procurement rules let you do
Public buyers in the EU often assume they must award on lowest price. Directive 2014/24/EU says otherwise. Article 67 provides for award on the most economically advantageous tender, which may include quality, technical merit and after sales service, with cost assessed on a life cycle basis under Article 68. Article 42 requires technical specifications to give equal access and not create unjustified obstacles, which is why requirements should describe capabilities and measurable outcomes rather than naming a product.
United States buyers have the equivalent latitude. Federal acquisitions under the FAR allow a best value tradeoff rather than lowest price technically acceptable, and most state and local procurement codes permit evaluated criteria. In both systems the constraint is that criteria must be stated in advance and applied as written.
Five requirement blocks
Block | What to specify | Why it matters |
Functional | Automatic detection of faces and license plates, manual editor, selective blur removal, supported input formats | Defines the actual workflow rather than an aspiration |
Deployment and security | Local processing, no transmission of footage to the supplier, what the software writes to disk, offline installation, update delivery | This is where most of the compliance value sits |
Performance | Throughput at stated resolution, hardware acceleration, concurrency and licensing model | Makes bids comparable on something other than price |
Support and lifecycle | Support channel and hours, update frequency, licence continuity, exit arrangements | Determines cost in years two and three |
Acceptance | Test on the buyer's own sample, stated pass criteria, defined review method | The only clause that proves anything |
Clauses worth copying
On processing location. "All processing shall take place on infrastructure controlled by the contracting authority. No recording, frame or derived data shall be transmitted to the supplier or to any third party at any stage." This single clause resolves most of the data protection assessment and reflects how Gallio PRO operates, with processing fully local on the buyer's own hardware.
On logging. "The software shall not create or retain logs containing personal data, including records of detected objects." Gallio PRO stores no detection logs and no personal data, which prevents the tool from becoming a second, unmanaged record of who appeared on camera.
On formats. Name the formats you actually hold. Gallio PRO supports JPG and PNG for images and MP4 and MOV for video, so a tender demanding proprietary VMS containers needs either an export step or a different scope.
On scope of processing. "The software shall process recorded files. Live stream processing is not required." State this if it is true, because leaving it ambiguous invites bids for a different and more expensive product category.
On deployment options. "The supplier shall state which of the following are available: desktop application, silent installer for managed estates, container image, command line interface, and application programming interface." Gallio PRO offers desktop applications for Windows, macOS and Linux, an MSI installer, a Docker container, a Linux command line interface and a REST API, with the container, CLI and API on the Enterprise plan.
Our checklist for purchasing video anonymization software and our comparison of selection criteria expand each of these into evaluation questions.
The acceptance test is the specification
Everything above can be answered on paper. The acceptance test is what converts claims into evidence, and it belongs in the tender documents rather than being negotiated after award.
Specify four things. First, the test material: 200 to 500 frames or 30 minutes of the authority's own footage, covering normal and difficult conditions, supplied to all bidders equally. Second, the metric: missed detections per thousand frames, counted by a named reviewer, rather than a vendor supplied accuracy percentage. Third, the threshold: a pass level set from a pilot rather than invented, which is why running your own baseline first matters. Fourth, the remedy: what happens on failure, and who bears the cost of a retest.
Bidders can test against the same standard in advance. The free Gallio PRO demo is unlimited and watermarked at up to 720p, which is enough to establish recall on a sample before a bid is priced.
Suggested weighting
Criterion | Weight |
Detection quality on the authority's own sample | 30 percent |
Deployment model and data protection compliance | 25 percent |
Life cycle cost over 36 months, including support | 25 percent |
Usability of the manual editor and operator workload | 10 percent |
Support, updates and references | 10 percent |
Adjust the numbers to your own rules, but keep price below half. A tender that weights price at 80 percent will select the cheapest tool regardless of whether it redacts reliably, and the cost of that choice appears later as operator hours and disclosure incidents.
How to build the specification in six steps
- Inventory what you actually process. Sources, formats, resolutions, annual volume and who requests exports. Specifications written without this produce unusable bids.
- Run an internal baseline first. Process a sample yourself before writing thresholds, so the pass criteria are grounded in measurement rather than in a brochure.
- Separate mandatory from evaluated. Mandatory requirements exclude bidders, so keep them to genuine minimums. Everything else belongs in scored criteria.
- Write the acceptance test into the tender documents. Material, metric, threshold and remedy, all four, before publication.
- Describe capabilities, not products. Under Directive 2014/24/EU Article 42, technical specifications must not unjustifiably favour a particular supplier, and capability based wording also produces better bids.
- Budget the operator time. Include manual redaction work in the cost model. A tool that automates faces and plates still leaves badges, screens and documents to a person.
After award
The obligations do not stop at signature. GDPR Article 5(2) requires the controller to demonstrate compliance, and Article 30 requires records of processing activities, so the contract should oblige the supplier to provide documentation adequate for an audit. Our guide to preparing anonymization documentation for a GDPR auditor sets out what that file contains.
For technical details, deployment options and licensing that can be quoted directly into a specification, see Gallio PRO video anonymization.
FAQ
Can a public tender require on-premise processing?
Yes, where it is justified by the subject matter. A requirement that footage is processed on the authority's own infrastructure and never transmitted to the supplier describes a capability rather than a product, which is consistent with Directive 2014/24/EU Article 42.
Do we have to award to the lowest price?
No. Directive 2014/24/EU Article 67 provides for award on the most economically advantageous tender, including quality and technical merit, with life cycle costing under Article 68. US federal and most state rules similarly allow best value tradeoffs.
What accuracy level should we require?
Specify missed detections per thousand frames measured on your own sample rather than a vendor accuracy percentage, and set the threshold from an internal baseline test instead of inventing a figure.
Should the specification require automatic detection of all personal data?
No. No product does this. Require automatic detection of faces and license plates plus a manual editing capability for additional objects such as badges, documents and screens.
What deployment options should we ask bidders to declare?
Desktop application, silent installer for managed estates, container image, command line interface and API. Gallio PRO offers all five, with the container, CLI and API on the Enterprise plan.
