GDPR in Procurement - Data Privacy in Purchasing
Where personal data occurs in procurement and what GDPR expects
Procurement processes personal data too: supplier contacts, requesters, approvers and user accounts. This article explains in plain terms how GDPR applies to purchasing - from the legal basis and where data is stored to the rights of the people whose data you handle.
- Focus on data minimization
- EU hosting possible
- Role and rights management
- Audit trail and change logs
What Does GDPR Mean for Procurement?
GDPR in procurement refers to applying the General Data Protection Regulation to purchasing processes in which personal data of supplier contacts, requesters, approvers and system users is processed. Procurement is affected in two ways: as a function that processes such data in its own workflows, and as the function that selects service providers who process personal data on the company's behalf.
Which Personal Data Arises in Procurement
The GDPR protects natural persons. Pure company data such as the name, address or revenue of a legal entity is not covered, but the data of the contact persons there and the data of sole traders is.
| Area | Typical data | Data subjects |
|---|---|---|
| Supplier master data | Names, business email addresses and phone numbers of contacts; for sole traders also address and bank details | Supplier employees, sole traders |
| Purchase requisition and purchase order | Requester, delivery address with recipient name, cost center | Own employees |
| Approvals | Who approved or rejected what and when, comments | Own employees |
| User accounts | Name, user ID, role, login times | Own employees, users of the supplier portal |
| Punchout | User details passed to the supplier shop | Own employees |
| Procurement of services | Names, qualifications and deployment times of the people assigned | Employees of service providers, freelancers |
Legal Bases for Processing
Every processing of personal data needs a legal basis under Art. 6 GDPR. Three are particularly relevant in procurement: performance of a contract with the data subject (Art. 6(1)(b)), for example with sole traders; compliance with a legal obligation (point (c)), for example statutory retention duties for order and invoice documents; and legitimate interests (point (f)), on which the processing of contact data of supplier contacts is generally based.
For data of the company's own employees who appear in the system as requesters or approvers, the rules on employee data protection apply in addition. Which basis applies in a given case is determined by the company together with its data protection officer.
The Key Obligations at a Glance
| Topic | Reference | Relevance in procurement |
|---|---|---|
| Principles of processing | Art. 5 GDPR | Purpose limitation, data minimization and storage limitation also apply to supplier and order data |
| Information obligations | Art. 13 and 14 GDPR | Supplier contacts and portal users must be told which data is processed and why |
| Data subject rights | Art. 15 to 21 GDPR | Access, rectification, erasure, restriction and objection have to be feasible within the process |
| Processors | Art. 28 GDPR | A data processing agreement is required with service providers that process data on your behalf |
| Records of processing activities | Art. 30 GDPR | Procurement processes involving personal data belong in the records |
| Security of processing | Art. 32 GDPR | Technical and organizational measures such as role concept, encryption and logging |
| Transfers to third countries | Art. 44 et seq. GDPR | Relevant when software or service providers process data outside the EU and EEA |
This entry gives a general overview and is not legal advice. Assessment of individual cases belongs with your data protection officer or legal counsel.
Retention and Erasure
The principle of storage limitation requires personal data to be erased once it is no longer needed for its purpose. In procurement this meets statutory retention duties under commercial and tax law that apply to purchase orders, invoices and business correspondence. While those periods run, the documents may not be deleted, but their use should be restricted to that purpose.
In practice this means an erasure concept with different periods: documents are kept for the statutory retention period, while contact data of suppliers that are no longer active, expired user accounts and logs that are no longer needed are erased or anonymized earlier.
Procurement as the Buyer: Data Protection in Supplier Selection
When procurement buys software or services where the vendor processes personal data on the company's behalf, data protection becomes an award criterion. Before contracting, it should be clear whether the vendor provides sufficient guarantees for GDPR-compliant processing.
- Does the vendor act as a processor, and is there an agreement under Art. 28 GDPR?
- Where is the data stored and processed, and which sub-processors are involved?
- Which technical and organizational measures does the vendor document?
- How is data returned or erased when the contract ends?
- How does the vendor support access and erasure requests from data subjects?
Typical Pitfalls in Procurement Systems
- Punchout: user data is passed when jumping to a supplier shop. One technical login per customer without names and email addresses is often enough.
- Audit trail: approval and change logs are needed for traceability but contain personal data. Access and retention period should be limited.
- Reporting: reports on the ordering and approval behavior of individuals may be subject to co-determination by employee representatives, for example the works council in Germany.
- Free-text fields: comments and attachments easily end up containing data that does not belong there.
- Supplier portal: suppliers maintain contact data themselves; the portal needs its own privacy notice and a role concept.
Related Terms and Matching Ovenca Modules
- Audit trail
Logs of approvals and changes and their role as evidence.
- Approval matrix
Roles and value thresholds whose application is logged.
- Setting up the OCI interface
Which user data a catalog call really has to pass.
- Supplier portal
Suppliers maintain their catalog data themselves in a separate environment, apart from the requesters' shop.
- Roles, permissions and logs in the admin area
Define who sees which data and trace access.
- Supply chain act software
Further checking and documentation duties towards suppliers.
Where GDPR Applies in Procurement
From legal basis to data-subject rights
Legal Basis and Data Minimization
Any processing of personal data in procurement needs a legal basis, such as performance of a contract or a legitimate interest. Only the data genuinely required for the specific purpose should be collected in the first place.
- Define the purpose up front
- Collect only necessary fields
- Set retention periods
Storage Location and Hosting
Where data resides matters for data privacy. A deliberately chosen storage location and a transparent hosting concept make compliance easier, especially when data is meant to remain within the EU.
- Choose storage location deliberately
- Review EU hosting
- Document access
Data Processing and Subject Rights
When a service provider processes data on your behalf, a data processing agreement is usually required. At the same time, data subjects hold rights such as access, correction and erasure, which the process must be able to honor.
- Agreement with providers
- Enable access and erasure
- Handle requests traceably
Privacy-Friendly Procurement with Ovenca
As an ERP-agnostic procurement platform, Ovenca is built to support GDPR-compliant operation. The following points are general information and not legal advice.
- You Control the Storage Location
- Ovenca runs on-premise, as a private cloud or hybrid, so you decide where your data resides. EU hosting is possible, and with on-premise operation data stays with you rather than with an external SaaS provider.
- Roles, Rights and Traceability
- Granular role and rights management controls who sees which data. Audit trail and change logs make access and changes traceable - a solid basis for supporting data-subject rights and information obligations.
- DACH Team and Proven Operation
- Ovenca is developed and supported by a DACH-based team and is in use at an MDAX corporation (LANXESS) that has worked with Onveda since 2014. Proximity to European data protection requirements is therefore part of everyday practice.
GDPR in Procurement: Questions and Answers
Putting Data Privacy in Procurement into Practice?
Talk to us about what a procurement process can look like when data minimization, storage-location control and traceability are considered from the start - tailored to your requirements.