Your legal team needs a consistent process for evaluating cloud vendors and international service providers under PIPEDA. This template offers a structured checklist to document your accountability, safeguards, and transparency obligations when personal information leaves Canada.
Purpose of the Template
Use this checklist whenever you onboard a vendor that will process Canadian personal information outside the country. It helps you assess transfer risks, secure comparable protection, and disclose arrangements to affected individuals. The completed checklist serves as evidence of your due diligence if a complaint reaches the Office of the Privacy Commissioner.
PIPEDA doesn't mandate storing personal information in Canada. It requires you to remain accountable for the data wherever it goes, provide safeguards matching its sensitivity, and inform people clearly that their information may be processed abroad (Schedule 1, 4.1.3). This template addresses these duties.
Prerequisites
Before using this checklist, confirm three things:
Your role in the transfer. If you're sending data to a processor who works on your instructions, the transfer counts as a use under PIPEDA and doesn't need separate consent. If the recipient uses the information for its own purposes, that's a disclosure and requires the individual's knowledge and consent.
Provincial rules that supplement PIPEDA. Quebec's Law 25 requires a privacy impact assessment before personal information leaves the province. Alberta's PIPA requires you to notify individuals when a service provider is outside Canada and list destination countries in your privacy policy. Nova Scotia's public-sector law requires data to stay in Canada until 2027. If any apply, add those steps to your process.
Your existing consent covers the purpose. The OPC confirmed in 2019 that a transfer to a processor abroad is a use, not a disclosure, so your existing consent for the original purpose covers it. An individual's option is withdrawing consent to the purpose, not vetoing which processor you use.
The Template
Copy this checklist into your vendor-review workflow. Complete it before you sign the contract.
PIPEDA Cross-Border Transfer Checklist
Vendor name:
Service description:
Data categories transferred:
Destination country/countries:
Review date:
Reviewer:
1. Risk Assessment
☐ Identified the legal regime in the destination country, including government access powers that differ from Canada's
☐ Assessed whether the sensitivity of the data matches the safeguards the vendor offers
☐ Documented any heightened risk (e.g., data subject to foreign intelligence laws, vendor's history of breaches)
☐ Determined whether the transfer is a use (processor working on your instructions) or a disclosure (recipient using data for its own purposes)
2. Comparable Protection by Contract
☐ Contract restricts the vendor to use data only for the purposes you specify, not its own
☐ Vendor's safeguards scale with the sensitivity of the data (encryption, access controls, monitoring)
☐ You can verify the vendor's practices through audit rights or compliance reports
☐ Any onward transfer to sub-processors carries the same protection terms
☐ Vendor notifies you of a breach fast enough for you to meet your own reporting deadline
☐ Vendor notifies you, where local law allows, when a foreign authority compels disclosure
3. Transparency
☐ Privacy policy discloses that personal information may be processed in [country], where it's subject to that country's laws
☐ Disclosure is plain and specific (not buried in boilerplate)
☐ If Alberta PIPA applies: individuals have been notified, and destination countries are listed in the privacy policy
☐ If Quebec Law 25 applies: privacy impact assessment completed and filed before the transfer
4. Accountability
☐ You remain the accountable organization; the transfer doesn't shift that responsibility
☐ Internal documentation records who approved the transfer and on what basis
☐ Renewal date set to re-assess the vendor annually or when the contract renews
Approval:
Name:
Title:
Date:
Customization Options
Add data-sensitivity tiers. If your organization handles health records, financial data, or children's information, add a sensitivity column and require heightened safeguards (SOC 2 Type II, ISO 27001, or specific encryption standards) for higher-risk categories.
Integrate provincial requirements. If you operate in Quebec, expand section 3 to include the privacy impact assessment template required by Law 25 (section 17). If you're in Alberta, add a notification step and a policy-update checklist under PIPA section 6(2).
Track sub-processors. Add a field under section 2 that lists any sub-processors the vendor uses abroad. Require the vendor to notify you before it adds a new sub-processor, and document that you reviewed the addition.
Set review triggers. Add a section that flags when to re-run the checklist: contract renewal, a data breach at the vendor, a change in the destination country's laws, or a regulatory update from the OPC.
Validation Steps
After completing the checklist, ensure your documentation is thorough:
Privacy policy matches the checklist. Confirm your privacy policy names the destination country and states the data may be subject to that country's laws. A line like "We use service providers in the United States to process your data, where it may be subject to US law" meets the openness duty for most transfers.
Contract terms match section 2. Review the signed vendor agreement to confirm every box checked in section 2 has a corresponding clause. If the contract is silent on breach notification timing or onward transfers, you haven't secured comparable protection yet.
Consent still covers the purpose. Review the consent you collected for the original purpose. If the transfer is to a processor, your existing consent covers it. If the recipient uses the data for its own purposes, confirm you have separate consent for that disclosure.
Retention aligns with your policy. File the completed checklist with the vendor contract. Keep it for as long as the vendor relationship lasts, plus the retention period your policy sets for vendor records. If a complaint arises, the OPC will ask how you met your accountability duty, and this checklist is your answer.
The fastest way to identify transfer risks is to run this checklist against every provider that handles Canadian personal information. A gap in the contract terms or the privacy-policy disclosure is where a complaint would land. Fix the gap before the transfer starts, not after the OPC asks.
