# 19. What privacy and security questions should MLS and NWSL clubs ask scouting suppliers?


**Map the personal information and decision process before deciding which obligations apply.** Do not assume professional-athlete information is outside privacy regulation: California’s regulator confirms that the employment-related and business-to-business exemptions expired on 31 December 2022. Applicability still depends on the organisation and processing. ([cppa.ca.gov](https://www.cppa.ca.gov/faq.html))

A particularly relevant date distinction: California’s newer regulations became effective on **1 January 2026**, while the regulator states that businesses must comply with the ADMT-specific requirements by **1 January 2027**. As of this review, that latter deadline is still ahead; ask counsel whether your player-ranking or selection workflow falls within scope. Do not assume every analytical tool does. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html?utm_source=openai))

Use this procurement checklist:

- What personal information enters the service, and from whom?
- Which fields are necessary for the stated recruitment task?
- Who can access raw data, reports and confidential shortlists?
- Which subprocessors and external AI providers are involved?
- Where is information stored and processed?
- What are the retention, correction and deletion processes?
- Is club material used for supplier model improvement?
- How are access revocation, audit logs and incidents handled?
- What evidence supports the supplier’s security claims?

For the evaluation itself, use redacted contracts and the minimum player information necessary. Keep medical material and other sensitive records out of a general procurement trial unless specifically authorised and necessary.

This checklist is not a complete state-by-state, international or employment-law assessment.