Privacy Commissioner of Canada releases guidance for businesses working with third-party service providers

September 10, 2026 – Gatineau, Quebec Organizations choosing to work with a third-party service provider have a lot to consider – especially if the service will involve the collection, use, or disclosure of personal information. Today, Privacy Commissioner of Canada Philippe Dufresne published new guidance to help businesses subject to the Personal Information Protection and Electronic Documents Act , or PIPEDA , assess potential third-party service provider approaches to privacy before beginning to work with them. The OPC is accepting comments on the guidance until December 4, 2026, after which the document may be updated. Comments can be sent by email to cpvp-opcconsultation1@priv.gc.ca . Organizations are responsible for the personal information – defined as information about an identifiable individual – that is under their control. This includes data that is collected by a third party on their behalf or transferred to a third party for processing. Among other things, the guidance outlines best practices to help organizations identify privacy and compliance risks; make decisions about whether to work with a particular provider; inform contractual terms with third parties; and demonstrate accountability to regulatory bodies. “It is essential for organizations to comply with privacy law – and to ensure that third-party partners are doing the same – in order to protect individuals’ privacy and personal information. Doing so can also help organizations earn Canadians’ trust, which means that investing in privacy protection can be a competitive advantage.” Philippe Dufresne Privacy Commissioner of Canada Office of the Privacy Commissioner of Canada communications@priv.gc.ca