POPIA-friendly RFQs: protecting your drawings and supplier shortlists

South Africa's Protection of Personal Information Act (POPIA) doesn't only apply to consumer-facing apps — it shapes how industrial procurement teams handle supplier data, employee contact details and even the metadata in a quote spreadsheet.

What POPIA actually requires from procurement

POPIA's eight conditions for lawful processing all apply to a B2B RFQ flow:

1. Accountability: someone in your business owns the data, end-to-end.
2. Processing limitation: only collect what you need to award the job.
3. Purpose specification: tell suppliers what you'll use their data for.
4. Further processing limitation: don't recycle supplier data into a marketing list without consent.
5. Information quality: keep contact details current.
6. Openness: publish a POPIA notice with your information officer's name.
7. Security safeguards: encrypt drawings, use access control, and breach-notify.
8. Data subject participation: let suppliers request, correct or delete their data.

Where most procurement teams trip up

Three common failures, in order of severity:

1. Email-based RFQ flows. Forwarding the same email to five suppliers exposes everyone's address in the "to" or "cc" line. POPIA treats this as an unintended disclosure of identifiable personal information.
2. Shared quote spreadsheets. A consolidated "quote comparison" workbook sent back to losing bidders reveals competitor pricing — and creates contractual exposure even before POPIA enters the conversation.
3. No NDA in the loop. Drawings of patented assemblies, mould tooling and IP-sensitive components should never leave your firewall without a signed NDA.

How V Intellect handles this

Every RFQ on V Intellect is processed 1-to-1 with each matched supplier. We never expose a supplier's identity to other bidders, never copy quote data between bidders, and never use supplier data for marketing without explicit consent. Drawings are stored in private storage with short-lived signed download URLs.

• POPIA notice published at /popia
• Privacy policy at /privacy
• Information officer contactable via the support form
• Consent captured and timestamped at registration
• Audit log retained for 180 days (admin-visible only)

What you can do today

Even if you're not yet using V Intellect:

• Move RFQs off broadcast email — use BCC at minimum, or a structured tool.
• Add an NDA acceptance step before drawings are released.
• Stop sending quote comparison spreadsheets back to suppliers.
• Publish your POPIA notice and name an information officer.
• Encrypt drawings at rest if you store them on a NAS — at minimum, restrict folder permissions.

Final thought

POPIA isn't an obstacle to good procurement — it's a forcing function for the discipline you should already have. Treat supplier data the same way you'd want a buyer to treat your data, and you'll be in the right place both legally and ethically.

Run your next RFQ through V Intellect — POPIA-friendly by design.