19. What privacy and security questions should MLS and NWSL clubs ask scouting suppliers?

Map the personal information and decision process before deciding which obligations apply. Do not assume professional-athlete information is outside privacy regulation: California’s regulator confirms that the employment-related and business-to-business exemptions expired on 31 December 2022. Applicability still depends on the organisation and processing. (cppa.ca.gov)

A particularly relevant date distinction: California’s newer regulations became effective on 1 January 2026, while the regulator states that businesses must comply with the ADMT-specific requirements by 1 January 2027. As of this review, that latter deadline is still ahead; ask counsel whether your player-ranking or selection workflow falls within scope. Do not assume every analytical tool does. (cppa.ca.gov)

Use this procurement checklist:

• What personal information enters the service, and from whom?
• Which fields are necessary for the stated recruitment task?
• Who can access raw data, reports and confidential shortlists?
• Which subprocessors and external AI providers are involved?
• Where is information stored and processed?
• What are the retention, correction and deletion processes?
• Is club material used for supplier model improvement?
• How are access revocation, audit logs and incidents handled?
• What evidence supports the supplier’s security claims?

For the evaluation itself, use redacted contracts and the minimum player information necessary. Keep medical material and other sensitive records out of a general procurement trial unless specifically authorised and necessary.

This checklist is not a complete state-by-state, international or employment-law assessment.