Signing a private security contract does not transfer every responsibility of a business to its supplier. A sound procurement file treats security authorisation, workforce obligations, occupational health and safety, and personal data processing as separate subjects. Their inclusion in one contract does not make their legal rules interchangeable.
Before concentrating on staffing numbers and the monthly fee, agree how each obligation will be verified and who will monitor it. The following framework brings together questions for legal, human resources, facilities and security teams before service begins.
1. Separate the supplier's licence from the site's arrangements
A company operating licence under Law No. 5188 does not authorise every possible service at every location. The site's private security permission, valid officer identification, assignment and notification procedures, and the suitability of armed or unarmed provision require separate consideration. A licence also does not substantiate every specialist capability described in a sales presentation.
Define the assignment area, duties and reporting chain in the tender documents. Private security powers depend on statutory conditions. A contractual instruction cannot expand them, and an out-of-scope expectation should not become an accepted duty during price negotiations.
2. Do not treat insurance as a guaranteed outcome
Private security liability insurance under Law No. 5188 is a separate document to verify. Check the insured parties, validity period, coverage and consistency with the assignment. Where necessary, confirm current mandatory requirements with the insurer and legal advisers.
The existence of a policy does not mean that every loss is automatically or fully recoverable. Assign responsibility for incident notification, preservation of evidence and preparation of the claim. A supplier's contractual indemnity and insurance coverage are different forms of protection.
3. Monitor workforce payments without excessive data collection
The Ministry of Labour's guidance explains that, where a principal employer-subcontractor relationship exists, joint responsibility can arise for specified employment obligations connected with the workplace. Do not assume that a disclaimer in the commercial contract removes employees' statutory rights. The nature of the relationship and the particular obligations still require assessment.
Specify what evidence of wage and social security compliance is needed, how often it will be reviewed and who may receive it. An audit purpose does not justify unlimited disclosure of employees' private information. The contract should describe how missing documents, payment delays and staffing changes are followed up and corrected.
4. Define safety and data responsibilities separately
Outsourcing does not remove employers' occupational health and safety duties. Assess the risks affecting security posts, including vehicle movements, weather exposure, lone working and the site's industrial activities. Document how the host business and contractor will exchange risk information, training requirements, emergency arrangements and change notifications. Do not assume one hazard classification applies to every guarding assignment.
Visitor registers, camera images and biometric identification are also different processing activities. An ordinary image is not automatically biometric data; how it is processed matters. Controller and processor roles should reflect who actually determines processing purposes and means, rather than simply the labels used in the contract.
Approve mobilisation against evidence
Create one mobilisation checklist covering permissions, insurance, post instructions, workforce compliance monitoring, safety coordination and data access rules. Give each item a document owner, review date and record of outstanding gaps. General guidance cannot determine the outcome of a particular dispute. Have qualified advisers examine material uncertainties before the assignment starts, rather than relying on broad promises that all legal risk has been transferred.
