Blog

A few years ago, a procurement questionnaire from a large retailer or Original Equipment Manufacturer (OEM) was mostly about price, capacity and quality certifications. Today, somewhere in that same questionnaire, you’ll find a new question: “How does your organisation protect personal information?”

If you’re a manufacturer wondering why a customer’s data question suddenly feels as important as your ISO certificate, you’re not imagining it. Data protection has quietly become a procurement criterion, and how well you meet it can impact whether a deal is won or lost.

How POPIA Extends into the Supply Chain

Under the Protection of Personal Information Act (POPIA), a company that shares personal information with a supplier retains responsibility for the data, along with the risk that comes with it. If your systems leak employee records, delivery addresses or customer details that you’re processing on a client’s behalf, the client is still answerable to the Information Regulator for what happened to their data subjects.

That single fact has reshaped how large buyers think about their supply chain. A manufacturer is now a source of goods as well as a potential point of failure in someone else’s compliance chain. These organisations are aware of this, and their legal and compliance teams have started acting on it. Vendor risk assessments, operator clauses in contracts and POPIA-specific due diligence questionnaires are now standard practice for any supplier that handles personal information, even indirectly — whether that’s payroll data shared for invoicing, contact details in a CRM integration or driver information for logistics.

Questions to Expect

Buyers are now asking a number of questions to support their own compliance. While most of these don’t mention POPIA directly, they all trace back to it:

• Do you have a documented data protection or information security policy?
• Who is your Information Officer?
• Are you aware of your POPIA obligations?
• What is your process in the event of a data breach, and will you notify us of it in time?
• Do you share personal information with any sub-contractors? If so, have you checked that they are compliant too?

The answers to these questions, along with supporting evidence such as training records that reflect actual attendance, audit logs and a register of what you process and why, are what prove ongoing compliance.

What’s Fuelling Buyer Caution

Supplier scrutiny is set to intensify, driven by three key forces:

• Enforcement is maturing: Because the Information Regulator has moved from warnings to fines and public enforcement notices, buyers are watching data management closely. Nobody wants to be the next cautionary tale due to a supplier mishandling data on their behalf.
• Contracts are tightening: Standard supply agreements increasingly include POPIA “operator” clauses. This legal mechanism makes obligations explicit and auditable rather than just implied. As these clauses become the norm, more suppliers will be held contractually accountable for how they handle personal information.
• Reputational exposure travels upstream: A breach at a small supplier can make headlines under a much bigger brand’s name, because that’s whose customers were affected. Large buyers have learned this through experience and are taking steps to avoid a repeat.
• Becoming the Supplier that Buyers Choose

The manufacturers winning this conversation are the ones who can answer buyers’ questions quickly, with specific detail, and with evidence on hand. A few things make the difference:

• Have a named Information Officer: Even in a small organisation, someone needs to own the answer when a buyer asks.
• Keep a live data processing register: This needs to be reviewed regularly enough to reflect what is actually happening in the business.
• Run training that leaves a paper trail: Attendance registers and regularly refreshed content show an active, ongoing programme.
• Have an incident response process you can describe in two sentences: Buyers want to know that you’ll detect and report an incident quickly.
• Treat your own sub-contractors the way your buyers treat you: Due diligence needs to flow all the way down the chain to carry any weight.

This doesn’t need to be elaborate, provided it is current and ready to show. A supplier who can pull up a data processing register and a training log in the middle of a call immediately comes across as a lower-risk partner, even where a competitor who promises to “get back to you” is equally compliant in substance.

Reading the Signal from Buyers

The deeper story here is that data protection maturity is becoming a real differentiator in supplier selection, sitting alongside established considerations such as quality and price. Buyers are, in effect, using POPIA questions as a proxy for a broader question: How well-run is this organisation, really?

Manufacturers who get ahead of this by putting the necessary policies, processes, records and training in place before a client asks are protecting their existing deals and positioning themselves as the supplier that makes procurement’s life easier. In a competitive market, that’s a meaningful advantage.

The buyers asking about POPIA today are sending a clear signal about where procurement is heading. The question worth asking in return is whether your business is ready to be the supplier buyers choose.