Cloud platforms, payroll providers, CRM systems, software vendors and AI tools have become part of how organizations operate.
But handing personal information to a third party does not transfer the responsibility for protecting it. Under PIPEDA, a transfer for processing does not transfer accountability. The organization that collects the information remains responsible for how it is handled.
On September 10, 2026, the Office of the Privacy Commissioner of Canada (OPC) released new guidance on assessing third-party service providers. For organizations subject to PIPEDA, the guidance reinforces a practical point: privacy risks should be considered before personal information is placed in a vendor’s hands.
A Contract Is Only the Starting Point
Standard terms may address confidentiality and security at a high level. They often leave unanswered the questions that determine actual risk:
Where will the information be stored or processed? Who will have access? Will subcontractors be involved? Can the information be used for another purpose? What happens if something goes wrong?
The OPC’s guidance encourages organizations to assess these issues before entering into an agreement, rather than discovering them after implementation.
And Then There Is AI…
AI-enabled services make these questions even more important.
If your organization provides personal information to an AI tool, is that information used only to deliver the service or can it also be used to train algorithms, improve the provider’s products or for other purposes?
The answer may not always be obvious from a product demonstration or standard agreement. Your organization should understand the purposes for which its information will be collected, used and disclosed, and assess whether those uses are appropriate under its privacy obligations.
The Level of Review Should Reflect the Risk
Due diligence is not one-size-fits-all. A payroll provider handling employee information presents a different risk profile than an AI platform processing sensitive client records. The assessment should be proportionate to the nature of the information, the sensitivity of the context, and the role of the provider.
The Best Time to Ask Is Before You Sign
Privacy concerns are much easier to address when there is still room to negotiate. Once a platform has been implemented, information transferred and a long-term agreement signed, your options may be more limited.
That is why vendor privacy review should happen as part of the procurement and contracting process, not as an afterthought.
Do You Know What Your Vendors Are Doing With Your Data?
You may know which vendor has your organizational information.
But do you know who else can access it, where it goes, what it can be used for and what happens when the relationship ends?
Those are questions worth answering before the data leaves your hands.
At Ewan Legal Solutions, we help organizations assess third-party privacy and contractual risks before problems arise. This includes reviewing vendor arrangements, identifying privacy concerns and assessing whether contractual protections appropriately address how personal information will be handled.
If your organization is bringing on a new service provider or has existing vendor arrangements that have never been reviewed from a privacy perspective, we can help you identify the risks and determine practical next steps.
Contact us to discuss your organization’s vendor arrangements.
Source: Office of the Privacy Commissioner of Canada, Guidance on assessing third-party service providers (September 10, 2026; open for public comment until December 4, 2026).
This article provides general information only and does not constitute legal advice.