Due diligence checklist, Canada
PIPEDA and Quebec Law 25: what to ask a vendor
Personal Information Protection and Electronic Documents Act, and Quebec's Law 25. OPC and the CAI. Personal information goes only to providers with comparable protection, with transfers outside Canada and Quebec assessed.
What it is
Personal information goes only to providers with comparable protection, with transfers outside Canada and Quebec assessed.
Who it applies to
Applies to every financial institution in Canada.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Contractual safeguards for personal information, with breach records and notice | Conformance test results or a written statement of conformance against the standard, with the version supported. |
| 2 | Where data is hosted and processed, and any transfer outside Canada or outside Quebec | The hosting regions and a data flow description naming every country data is stored in or processed from, and the transfer mechanism for anything leaving the country. |
| 3 | Support for a privacy impact assessment where Law 25 requires one | The privacy and data protection policy, the breach register process, and any privacy impact assessment the vendor has supported. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have