Privacy protection

Privacy protection is the handling of personal information in a way that guards it against unauthorized access, use, disclosure, alteration or loss, while respecting applicable privacy rights and legal requirements. NATO describes personal-data protection as applying across the entire processing lifecycle, with data handled fairly, lawfully, confidentially and securely.

In Canadian federal procurement, the term refers to the privacy and security requirements that apply to solicitations, contracts, standing offers and supply arrangements when personal or other sensitive information is collected, accessed, used, stored or disclosed. Public Services and Procurement Canada (PSPC) directs buyers to identify these requirements and build them into procurement documents.

Privacy requirements in federal solicitations and contracts

PSPC's buyer guidance on contract security and privacy requirements states that privacy and security requirements apply to federal contracts, solicitations of offers, standing offers and supply arrangements. Buyers are expected to assess which requirements apply and include them. Privacy is not limited to a particular procurement method.

Related Canadian concepts include personal information, privacy impact assessment (PIA), privacy notice, access, correction and protection of personal information, and contract security requirements. These ideas often appear together in the same solicitation.

How CanadaBuys handles personal information

The government's own procurement platform is subject to privacy rules. The CanadaBuys privacy and security page states that PSPC collects personal information to register businesses, evaluate bids, procure goods and services, settle payments, troubleshoot technical issues, and maintain system security and operability.

CanadaBuys also states that the collection is authorized under the federal Privacy Act. Individuals must be informed of the purpose of the collection and of how to exercise their access rights. Suppliers who register on the platform or submit bids are therefore providing personal information under a defined legal authority.

A defence example: Privacy Impact Assessment Specialists

A Department of National Defence notice for a Task-Based Informatics Professional Services (TBIPS) requirement shows how privacy work appears as a contracted service. The award notice sought Privacy Impact Assessment Specialists to assess defence programs and activities. These included CAF reconstitution, conduct and culture, Canadian Forces Intelligence Command, data strategy and digitization, military justice reform, and total health and wellness.

The same notice set out separate security requirements: Secret corporate and resource security, and Protected B document safeguarding. Privacy assessment and security clearance are distinct requirements, and a single solicitation can include both.

NATO's personal data protection framework

The term is also used internationally. NATO's Personal Data Protection Framework Policy, launched in 2024, establishes principles, rules for sharing, transferring and disclosing personal data, governance arrangements and data-subject rights. Its principles cover lawful and fair processing, purpose limitation, security, confidentiality, retention, disclosure and data-subject rights.

According to NATO's personal data protection publication, the framework applies to all personal data processed by NATO bodies or on behalf of NATO bodies. Suppliers who process data for a NATO body fall within that scope.

What it means for a supplier bidding on Canadian public contracts

A supplier's obligations depend on the solicitation and the resulting contract. Where privacy requirements apply, the supplier must follow the specified rules for handling personal or confidential information. It must also meet any stated security, safeguarding, access, assessment, reporting or personnel requirements.

• Read the privacy and security sections of each solicitation before pricing or staffing the bid.
• Check whether the contract calls for corporate or personnel security levels, such as Secret, or document safeguarding, such as Protected B.
• Confirm whether a privacy impact assessment is part of the work or a condition of it.
• Expect that information you provide through CanadaBuys is collected under the Privacy Act for the purposes the platform states.

PSPC treats privacy and security requirements as items to be addressed in procurement documents and contracts, so bid teams should address them in the proposal as well.