DataGovernance.ca editorial · 13 October 2026 · Implementation guidance
Write down the proposed relationship
Start with a single sentence describing the intended use, then identify the categories of information involved, the internal owner and the systems that will send or receive data. An unused optional feature should not quietly become a second use case. Record whether the review covers a trial, a production deployment or a renewal; these may need different decisions.
Ask for evidence, not just reassurance
Our suggested worksheet separates the vendor’s answer from supporting documents, the date of review and your open questions. Use it to record how information flows, who can access it, what other parties are involved and what happens when the relationship ends. Assign each unresolved question to a person who can assess it. A sales presentation, an expired assurance report and a tested product setting are not interchangeable evidence.
Know what the current guidance says
The OPC’s September 10, 2026 guidance recommends assessing providers before using their products or services with personal information. It highlights that outsourcing does not remove an organisation’s responsibility under PIPEDA. The document is open for comments until December 4, 2026 and may change. It does not cover every applicable obligation and is not a substitute for a situation-specific review.
Make an explicit decision, then revisit it
Give the actual approval authority a short statement of known facts, limitations, proposed mitigations and unresolved issues. Counsel should assess contractual and legal questions; appropriately qualified specialists should assess security questions. Record what would trigger another review, such as a changed purpose or a significant new dependency. Our template supports the process; it does not approve or certify the vendor.
Separate an answer from the decision it supports.
Pick one proposed supplier feature without sending data to it. Describe the use, record the evidence you would need and assign each unresolved question to the relevant internal reviewer. Write down the conditions of any later approval, the intended exit steps and the changes that trigger another review.
The record should identify the scope, owner, evidence, unresolved questions and next review. It is a draft exercise—not evidence that your organisation has implemented or passed the control.