Data protection in procurement
Supplier data protection · Procurement privacy
Data protection in procurement is the set of legal and contractual controls applied when suppliers or procurement systems process personal data, including lawful basis, security, retention, transfers and individual rights.
Saved terms stay in this browser. No account or server request is involved.
Simply put
What it means in ordinary work
It covers how personal data is handled when a supplier or software tool touches it. Procurement needs to understand the data, the roles and the required contract terms.
Why it matters
Outsourcing or software can create privacy risk and legal obligations. Weak contract terms and supplier controls can lead to breaches and regulatory action.
A hypothetical in practice
A hypothetical HR software purchase identifies employee data flows, assigns controller and processor roles, requires security measures and defines deletion and assistance obligations in the contract.
Common pitfalls
A generic data-processing clause may not match the actual service. Map the data flow first.
A supplier's certification does not by itself prove compliance with the buyer's obligations.
Scope and limits
General educational overview only. Privacy obligations depend on the parties, data, jurisdiction and current law. Obtain qualified advice before relying on a specific requirement.
Regional lens
How this lands where you work
The global explanation is canonical. Regional notes are additive, separately sourced and shown with their own review state. They never replace the global meaning.
Loading your saved region.
As-of date for date-sensitive regional content: 5 November 2026. Read the review policy.