01 / 04
Place one: the enquiry process
An enquiry to five suppliers transmits personal data — names, telephone numbers and email addresses of contacts — to five recipients. Send it through a portal and that portal's own providers are added. Without consent or a workable legal basis, that is a transfer without permission.
The workable answer is restraint: in the shortlisting stage technical details are transmitted, not contact details. Only when the buyer releases a provider is the contact made. That is also the procedure buyers prefer, because it reduces unwanted calls to nil.
02 / 04
Place two: the exchange of technical documents
Drawings, bills of materials and inspection plans regularly contain personal data — the designer's name in the title block, inspector initials, release notes. Put such files into a cloud portal whose provider processes outside the EEA and you have triggered a third-country transfer without deciding to.
A simple rule helps here: store and transmit technical documents only through systems processing inside the EU, documented in the record of processing activities. And glance at the title block before a file leaves the building.
03 / 04
Place three: remote maintenance and machine data
Remote maintenance access is the most inconspicuous data protection incident in waiting. A plant supplier with permanent VPN access can in practice reach operational and frequently employee data — shift allocation, operator IDs, performance figures.
Three things are needed: a data processing agreement under Art. 28 GDPR with the plant supplier, access that is enabled only on request, and logging that shows who saw what and when. All three are contractually negotiable — but only before the award.
04 / 04
The effort is smaller than the reputation
None of these points requires a major programme. They require data protection to be thought about during procurement rather than added afterwards: evidence requirements in the specification, a data processing agreement as a condition of award, EU processing as an exclusion criterion.
Set it up that way and you gain two things at once: audit readiness and a negotiating position. After the award, both are considerably more expensive.