Third Parties Should be First Priority: OPC Guidance on Assessing Third-Party Service Providers Under PIPEDA

On September 10, 2026, the Office of the Privacy Commissioner of Canada (the "OPC") published guidance to help organizations assess a third-party service provider's approach to data privacy. The guidance focuses on best practices that can help organizations meet their accountability obligations under Principle 4.1.3 of Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), which requires organizations to ensure a comparable level of protection for personal information that is transferred to or handled by third parties, with a focus on due diligence considerations to ensure compliance. If your organization collects any personal information that is processed by a third party, read ahead.

What does the guidance say?

In the September 10, 2026, guidance, the OPC highlights that every organization is responsible for personal information in its possession or custody. This includes personal information that has been transferred to a third party for processing. It is crucial that organizations assess third-party service providers for their compliance with applicable Canadian privacy law, including PIPEDA.

A good approach to third-party privacy compliance follows certain best practices. As a starting point, an organization should know exactly what personal information is involved and at stake. Understanding the nature and sensitivity of the personal information at the outset helps frame the rest of the assessment.

Organizations should also be deeply familiar with each contractual relationship they have with third parties. Organizations should understand each third party's service offering and its functionality and performance, including what each third party actually does with the personal information and both its cybersecurity framework and technical capabilities. Parties should be clear about their respective roles and responsibilities when entering into third-party service agreements, including what happens at the end of the third party's lifecycle or upon termination of the relationship. Proactive planning for termination or expiry at the outset of a third-party engagement can prevent difficult situations down the road.

It is also integral that organizations understand the purpose for which personal information is being collected by a third party and confirm that proposed uses are appropriate under PIPEDA. It is worth noting that anonymized information may still attract PIPEDA obligations.

Third-party arrangements often involve subcontractors, and organizations should identify what subcontractors are being used by the third party and what role they play in handling personal information. Where information may be transferred outside Canada, organizations need to understand the implications, including any additional risks that cross-border transfers of personal information may present.

Finally, organizations should verify each third-party provider's security practices and assess the risks of vendor lock-in (the risk of becoming overly dependent on a single provider) and vendor lock-out (losing access to vital data if the relationship ends). The OPC's guidance also emphasizes the importance of establishing ongoing monitoring mechanisms to ensure the service provider's continued compliance with PIPEDA.

Why is this important?

The OPC's guidance on assessing third-party service providers underscores the importance of proactive due diligence in maintaining compliance with PIPEDA and emphasizes that privacy compliance is not a one-time exercise. This guidance matters because outsourcing the handling of personal information to a third party does not outsource accountability. Organizations remain responsible under PIPEDA for a third-party service provider's handling of personal information.

As more organizations adopt AI-powered tools and services, the OPC emphasizes understanding training data sources, assessing algorithmic risks, and confirming data use purposes. Failure to appropriately assess a third-party service provider's compliance with PIPEDA can create both a compliance and reputational risk.

Torkin Manes can assist with assessing third-party arrangements and strengthening privacy protections. For more information about third-party compliance with Canada's privacy laws, please contact Roland Hung or Laura Crimi of Torkin Manes' Privacy, Data & Cybersecurity, AI & Innovation, and Technology Groups.

The authors would like to acknowledge Torkin Manes' Summer Student Raza Akbari for his invaluable contribution in drafting this bulletin.