Canada's privacy commissioner has published draft guidance on how organizations covered by PIPEDA should assess a prospective service provider's privacy practices, and the operative word is prospective. The point is to do the work before you sign, not after something goes wrong. The guidance came out on September 10 and the OPC is taking comments on it until December 4, 2026, so this is a live consultation rather than a settled rulebook. The expectations are on the record either way, which is what makes it worth reading now.
The principle underneath it
PIPEDA Principle 4.1.3 says an organization stays responsible for personal information in its possession or custody, including information transferred to a third party for processing, and has to use contractual or other means to provide a comparable level of protection. That sentence has been in the law for years. What the OPC has done is spell out what honouring it actually looks like in a procurement decision.
The guidance applies whenever an outside product, service or technology will involve collecting, using or disclosing personal information. That covers a provider processing your data directly, a vendor supplying technology that handles it, and parties further down the chain that you may never deal with yourself.
What it says to check
The core of it is familiar due diligence done properly: evaluate the provider's privacy practices and the risks before engaging them, understand the data flows, look at the security measures, and know whether information crosses borders. Then use the contract and ongoing monitoring rather than treating the assessment as a one-time gate.
Two expectations are worth calling out because they are newer. First, the guidance directs you to look at where a provider's AI training data came from and whether that collection complied with PIPEDA or the law of wherever it was sourced. If a tool was trained on scraped personal information, that is now your question to ask. Second, it says the people carrying out your assessment should have appropriate training and expertise to do it effectively. Handing a security questionnaire to whoever has a free afternoon does not meet the bar.
What this means for a small business
The obvious reaction is that this is written for organizations with procurement departments. The more useful reading is that it tells you what a regulator will expect to see if a vendor you chose loses your customers' data, and the answer is evidence that you looked. That does not require a department. It requires a short, repeatable file: what the vendor holds, where it lives, what the contract says about breach notice and deletion, and what you checked before you signed. We cover the practical version of this in assessing a vendor's security and reading the data terms.
What to actually do
- Start with the list. Write down every provider that touches personal information you hold. Most small businesses have between ten and forty, and most have never written them down.
- Grade by sensitivity, not by invoice size. The cheap tool holding client records deserves more scrutiny than the expensive one that holds nothing personal.
- Ask the AI question now. Does this product train on our data, and what was the underlying model trained on. Get it in writing.
- Put the basics in the contract: breach notification timelines, where data is stored, subprocessors, and what happens to your data when you leave.
- Keep the file. A one-page record per significant vendor is the difference between showing a regulator your process and describing it from memory.
- Re-check on renewal. Monitoring does not mean a dashboard. It means the assessment gets a second look when the contract comes up.
The takeaway
Nothing in this guidance is a surprise if you have been treating vendor data handling as your problem rather than theirs. For everyone else it is a fair warning, published with a comment period, about the standard that is coming. Doing the work now is considerably cheaper than explaining later why nobody looked.