OPC Provides New Guidance on Assessing Third-Party Service Providers

To listen to an audio recording of this article, click here.

Organizations increasingly rely on third-party providers to deliver cloud services, artificial intelligence (“AI”) tools and other technologies for core operations that collect, use or process personal information. While outsourcing these activities may be operationally necessary, it does not transfer the organization’s legal responsibility to protect the information to the service provider.

On September 10, 2026, the Office of the Privacy Commissioner of Canada (the “OPC”) issued its Guidance on assessing third-party service providers (the “Guidance”), which sets out best practices for organizations subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) when conducting privacy due diligence on prospective service providers.

The following sets out an overview of the Guidance and serves as a useful reminder of the steps required before onboarding a third party that accesses and/or processes personal information, the contractual requirements for engaging such third parties and the ongoing responsibilities that apply after the contract is signed.

While this article primarily focuses on third-party access to or processing of personal data, most of these principles and obligations should also be applied when a third party may have access to or process any sensitive or business-confidential information.

The Organization Remains Accountable

Anchored in PIPEDA’s accountability principle, an organization remains responsible for personal information in its possession or custody, including information transferred to a third party for processing. Organizations must use contractual or other means to ensure a level of protection comparable to that required under PIPEDA when personal information is processed by a third party.

Organizations are to treat third-party privacy assessments as part of the organization’s broader accountability framework. The pre-procurement due diligence on a third-party program and service provider must be sufficiently rigorous for the circumstances and carried out by individuals with appropriate training and expertise. Importantly, while the Guidance is not intended to be an exhaustive statement of an organization’s obligations under PIPEDA, it provides a baseline framework to which organizations are to adhere and can adapt depending on the nature of the information, technology and relationship involved.

What Should Organizations Examine?

The following are practical steps, considerations and questions organizations should consider and address before bringing a third party into their data environment.

1. Start With the Information, Not the Vendor

Organizations should:

Identify the information the third party may access, as well as information the third party will collect or process on the organization’s behalf.
Determine whether sensitive personal information is involved, including financial, health, biometric, genetic or other information that, given the context, may warrant heightened scrutiny.
Continue to apply scrutiny should a third party propose to collect or use publicly available information, as PIPEDA and other privacy laws can still apply to information available in public spaces or online.
Do not assume that information is no longer personal information simply because a provider describes it as “de-identified” or “anonymized.” De-identified data can still be considered personal information under privacy laws. Further, given information available and advances in technologies, the threshold to truly anonymize data is quite high. Organizations should understand the anonymization techniques being used and whether the resulting information can be re-identified.

2. Trace Where the Information Goes

Service providers frequently rely on their own stable of third-party service providers in the collection, use, transfer, storage and other processing of the personal information. Your organization remains responsible through the various levels of processors and sub-processors who process data on your behalf. The assessment should account for the full flow of personal information through sub-processors, rather than stopping with the primary service provider.

Map transfers among the individual, the organization, the service provider and any other sub- processors and parties involved in delivering the service to your organization.
Identify subcontractors and other sources from which the provider collects personal information on the organization’s behalf.
Determine where information will be stored, including cloud databases controlled by the provider or another third party.
Consider the jurisdictions in which personal information will be collected, used, disclosed or stored.

3. Establish What the Provider Can Actually Do With the Data

Organizations should distinguish between the purposes for which they engage a provider and any additional secondary purposes pursued by the provider itself.

Confirm each purpose for which the provider will collect, use or disclose personal information.
Determine whether the provider intends to use the information for its own purposes, such as training an algorithm, marketing or improving internal processes.

Should it be determined that a third party in the processing channel uses any of the personal information for their own purposes, this third party is no longer considered a service provider or processor. Sharing the information with such third party is considered a disclosure of information rather than a transfer, meaning the original organization’s obligations and risks under privacy laws may differ. For example, such organization must obtain appropriate informed express consents from the individuals for this disclosure, and associated risks of this disclosure to such third parties are potentially heightened.

4. Look Beyond the Sales Pitch

Understanding how the technology actually functions and whether its features create additional privacy risks is essential to assessing suitability.

Identify known risks associated with the technology, including security vulnerabilities, systemic bias, inaccuracy or discriminatory treatment.
Confirm what measures the provider has taken to address those risks.
Assess which functionalities are actually required and whether unnecessary features can be disabled.
Request additional technical or other materials where the technology is not sufficiently understood, and consider independent external resources where appropriate.
Determine how personal information can be stored and retrieved when the organization needs to conduct audits or respond to individual access requests.

5. Put Responsibility Where It Belongs

A privacy assessment should translate into clearly defined responsibilities between the organization and the provider.

Identify all subcontractors that will handle personal information and confirm their identities in writing.
Confirm that subcontractors will be subject to the same privacy protection standards as the primary provider.
Establish who is responsible for particular privacy obligations, including responding to individuals’ access requests.
Document the provider’s responsibilities and PIPEDA obligations in the agreement.
Ensure the contract sets out initial and ongoing obligations and responsibilities in the event of a data breach.
Consider incorporating a customized version of OPC’s guidance regarding best practices for provisions into the contract.

6. Address Cross-Border Data Flows

Organizations should understand where personal information will be handled outside Canada and assess the implications of those transfers for the information’s security and confidentiality.

Identify the jurisdictions in which the provider or any subcontractor will collect, use or disclose personal information on the organization’s behalf.
Understand the organization’s obligations under privacy laws where personal information is collected on its behalf in another jurisdiction or transferred from the organization to another jurisdiction.
Assess the risks to the integrity, security and confidentiality of personal information when it is transferred to a provider operating outside Canada.
Consider the OPC’s Guidelines for processing personal data across borders when assessing those risks and the provider’s safeguards.

7. Examine the Source of Training Data

Where a provider’s technology relies on training data, organizations should understand where that data came from and how it was obtained.

Confirm whether the technology uses training data to train an AI algorithm or test the technology’s functioning.
Request information about the source of the training data and how the provider collected it.
Consider whether the collection and sourcing of the training data is consistent with PIPEDA and the laws applicable in the jurisdictions where the data was collected.
Where appropriate, incorporate restrictions into the contractual framework on the provider’s use of the organization’s personal information for training purposes.

8. Evaluate Security Measures and Controls

Organizations should assess the safeguards that will protect personal information throughout the provider relationship, including the security features built into the technology itself.

Review the provider’s policies and practices for safeguarding personal information, including cybersecurity, physical access and work environment controls.
Identify security features built into the product or technology, including optional settings that can be enabled or disabled.
Confirm which party is responsible for configuring, enabling and maintaining those security features.
Establish how a privacy breach will be managed and clearly allocate responsibilities among the organization, provider and any subcontractors.

9. Plan for Vendor Dependency and Business Disruption

Organizations should consider what could happen if it becomes dependent on a provider’s technology or if the provider is no longer able to provide its services.

Assess the risk of vendor lock-in, including whether reliance on proprietary technology or data formats could make it difficult to move to another provider.
Consider whether vendor dependency could reduce the organization’s control over how personal information is processed.
Identify practical measures to facilitate a transition between providers, including contractual protections for data portability.
Assess the risk of vendor lock-out if the provider ceases operations, including the organization’s ability to access and recover personal information.
Consider factors such as the provider’s longevity, reliance on its own supply chain and regulatory constraints affecting its operating environment.

10. Address Retention, Return and Destruction

The organization should establish what will happen to personal information throughout its lifecycle and, in particular, when the provider no longer requires the information or the relationship ends.

Confirm how the provider will destroy personal information at the end of its lifecycle, including information stored on cloud servers, in backups and by subcontractors.
Establish what happens to personal information held by the provider and its subcontractors when the services are terminated.
Determine how personal information will be returned to the organization and in what format.
Confirm how remaining personal information will be deleted and disposed of following termination.

11. Establish Ongoing Oversight

Privacy due diligence should not end once a provider has been selected and the agreement has been signed. Organizations should consider how the provider’s privacy practices, technology and security will be monitored throughout the relationship.

Determine how the provider’s technology will be monitored and assessed after implementation, including through access logs, reporting tools and regular testing.
Consider whether independent audits are appropriate to assess the provider’s performance and security practices as part of ongoing oversight.
Establish mechanisms for monitoring the provider’s ongoing compliance with its privacy obligations in relation to personal information processed on the organization’s behalf.
Reassess the provider where changes to its technology, processing activities or use of subcontractors could affect the organization’s privacy risks.

Conclusion

The OPC’s position set out in the Guidance reinforces that privacy due diligence should begin long before a third-party relationship is established and continue throughout the relationship. A vendor questionnaire alone may not be sufficient where the information or technology presents meaningful privacy impacts. Organizations should consider third-party privacy assessments as part of their broader PIPEDA accountability program, rather than as a standalone vendor-management exercise. Organizations should tailor their assessment to the circumstances, the nature and sensitivity of the information at issue, and the context of the processing. They should also ensure that those conducting the assessment have the necessary expertise and that the results inform both the commercial decision and the contractual framework.

While the Guidance is restating many positions previously held by the OPC, it serves as a particularly timely reminder for organizations adopting AI and other data-intensive technologies.

The Privacy & Data Security Group at Aird & Berlis LLP advises organizations on privacy and data security matters arising from commercial relationships, technology procurement, transactions, regulatory requirements and emerging technologies. If you have questions about the OPC’s Guidance, would like assistance assessing a third-party service provider or are considering submitting comments to the OPC, please contact the authors or a member of the group. The OPC is accepting comments on the Guidance until December 4, 2026.