POPIA and Tender Packs: Share Evidence Without Publishing Personal Data

A bid pack is not a public marketing folder

Tender evidence can contain identity numbers, signatures, private contact details, CVs, qualifications and reference contacts. A team may need some of it to prepare a compliant response, but that does not justify unrestricted access or later publication on a website. Map the information flow from the person supplying evidence to your repository, reviewers, consultants and final issuer submission.

POPIA requires a lawful processing approach, not a blanket ban on supplying tender evidence. Do not withhold mandatory documents merely because they contain personal information. Instead, identify the requirement, lawful basis, purpose, minimum necessary information and safeguards, then seek clarification or advice where the requested handling is unclear.

Create a data inventory for the bid

List each document type, the person it concerns, why it is needed, who needs access, where it is stored, how it will be transmitted and when it will be reviewed for deletion. Distinguish corporate facts from personal information and identify particularly sensitive material requiring additional care.

Use the Information Regulator's official guidance to support your organisation's compliance framework and Information Officer process. A tender administrator should not invent a privacy policy in isolation. Escalate unusual requests, children-related information, special personal information or cross-border processing to the appropriate internal lead and adviser.

Inform staff and reference contacts about the intended use of their information, the recipient and relevant safeguards. Do not treat a casual permission to use a CV as unlimited authority to publish an identity document. Consent is not the only possible lawful basis, and relying on it requires attention to whether it is appropriate and valid.

Control working copies and sharing

Keep evidence in a permission-controlled folder rather than a public link. Give access only to people who need the information and review access when consultants leave or the bid closes. Use the issuer's authorised submission channel, checking recipients and attachment names carefully before sending.

Where a reviewer does not need a full identity number or private address, use a redacted working copy. Keep the source restricted and clearly label versions so a redacted draft is not accidentally submitted where complete evidence is mandatory. Redaction must actually remove the information, not merely cover selectable text with a coloured box.

Do not let privacy controls undermine compliance

Check the tender's precise evidence requirement before redacting the final submission. If complete evidence is required, ask whether a secure route or permitted alternative exists. Do not change forms or omit fields unilaterally and assume the issuer will accept the result. Keep any clarification and apply it consistently.

Illustrative example: a technical writer needs a staff member's experience and qualifications, but not the scanned identity document used by the compliance reviewer. The team gives the writer a limited working CV and stores the identity document separately. The authorised submitter then assembles the evidence required by the issuer and verifies the final bundle. This is a control example, not a universal prescribed submission format.

Review external bid support

Before giving evidence to a consultant, confirm the authorised purpose, access limits, security arrangements and return or deletion process. Check any operator responsibilities with your Information Officer and adviser. Avoid sending an entire historic evidence archive when only a few current files are needed. Keep a record of what was shared and with whom, and revoke access when the engagement ends rather than relying on a confidentiality sentence alone.

Plan retention and incident response

Choose retention periods based on the applicable law, contract, organisational policy and legitimate need; there is no single deletion date for every tender document. Preserve material subject to an audit, dispute or legal hold. Remove duplicate downloads and revoke public links when no longer needed, while retaining a defensible record of what was actually submitted.

If documents are sent to the wrong recipient or accessed without authority, notify your Information Officer promptly, preserve facts and follow the incident process. The Information Regulator's POPIA resources explain security-compromise responsibilities. Do not quietly delete a message and assume the incident is resolved, or promise that every mistaken email has identical notification consequences.

Review access and document-handling controls after each bid. Privacy protection works best as part of normal evidence management, not a last-minute disclaimer pasted onto an unrestricted folder.

• Map purpose, lawful basis and recipients.
• Restrict source evidence and working copies.
• Redact effectively only where permitted.
• Verify final mandatory evidence.
• Apply retention and incident procedures.