Cybersecurity Policy Report, Third-Party Service Provider Assessment Guidance Released in Canada, (Sep 11, 2026)
By Tony Foley
Canada’s Office of the Privacy Commissioner has published new guidance to assist businesses subject to the country’s Personal Information Protection and Electronic Documents Act (PIPEDA) to assess potential third-party service provider approaches to privacy before beginning to work with them.
At a high level, the guidance outlines best practices to help organizations identify privacy and compliance risks associated with third-party service providers, make decisions about whether to work with a particular provider, inform third-party contractual terms, and demonstrate accountability to regulatory bodies, according to an OPC news release.
The guidance provides a set of best practices for assessing third-party service providers, emphasizing the following key points:
Organizations are responsible for personal information under their control, including information collected by a third party on their behalf or transferred to a third party for processing;
Organizations must ensure comparable protection for personal information that is collected, used, or disclosed on their behalf by a third party;
Organizations should assess a third party’s privacy practices before obtaining products, services, or technology that involves the collection, use, or disclosure of personal information; and
Conducting a rigorous assessment based on best practices can help organizations to meet their accountability obligations under PIPEDA.
“It is essential for organizations to comply with privacy law—and to ensure that third-party partners are doing the same—in order to protect individuals’ privacy and personal information,” Privacy Commissioner Philippe Dufresne said. “Doing so can also help organizations earn Canadians’ trust, which means that investing in privacy protection can be a competitive advantage.”
Comments on the guidance may be submitted to the OPC through Dec. 4 via e-mail to cpvp-opcconsultation1@priv.gc.ca.
News: InternationalLegislation DataPrivacy