The Office of the Privacy Commissioner of Canada (OPC) has published guidance on how organizations should assess third-party service providers when handling personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA).

The guidance addresses a central accountability question for Canadian businesses: an organization that transfers personal information to a vendor remains responsible for that information under PIPEDA. Selecting a service provider is therefore not merely a procurement decision but a compliance obligation.

What the Guidance Covers

The OPC framework directs organizations to evaluate prospective service providers before entering into contracts and to continue monitoring them throughout the relationship. The assessment process centers on several elements.

Organizations should first determine whether the vendor has appropriate safeguards in place to protect the personal information it will handle. This includes physical, organizational and technological measures. The depth of the assessment should be proportionate to the sensitivity of the information involved and the volume of data the provider will process.

Second, the guidance expects organizations to verify the vendor's privacy policies and practices, confirming they align with PIPEDA's requirements. Where the provider operates cross-border, organizations must consider the legal regime governing the data in the foreign jurisdiction and whether it permits access that would conflict with Canadian privacy law.

Third, contracts matter. The OPC emphasizes that organizations should impose contractual terms requiring the service provider to protect personal information with a comparable level of care, and to use it only for the purposes the organization specifies. Ongoing monitoring should follow, rather than ending at signature.

Practical Consequences for Practitioners

For in-house counsel and privacy officers, the guidance signals that the OPC expects documented, risk-based vendor due diligence, not a one-time checklist. Organizations handling sensitive personal information — health, financial, or minors' data — should prepare for closer scrutiny of their vendor assessment files if the OPC opens an investigation or audit. Contract review processes should be updated to include privacy-specific clauses, and vendor relationships involving cross-border transfers may require legal analysis of foreign access laws before data leaves Canada. Counsel advising clients on procurement should treat the assessment record itself as evidence of accountability under PIPEDA's accountability principle, which makes organizations responsible for personal information in the hands of their agents.

Compliance teams should also note the reputational dimension. A data breach traced to a poorly vetted vendor will still attach to the organization that chose that vendor, both in regulatory findings and in the Canadian market for privacy-sensitive services.