Comments on Privacy Commissioner of Canada's guidance for businesses working with third party service providers, responses are due 4 December 2026
4 December 2026
The Privacy Commissioner of Canada Philippe Dufresne published new guidance on 10 September 2026 to help businesses assess third party service provider approaches to privacy. Organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) can submit comments on this draft guidance until 4 December 2026. This guidance assists in making informed decisions about provider selection and demonstrating accountability.
The draft guidance from the Privacy Commissioner of Canada outlines best practices for identifying privacy and compliance risks when engaging third party service providers. Organisations are responsible for personal information under their control, even when collected or processed by a third party on their behalf. This includes data transferred to a third party for processing, as stated in the guidance. The document also informs contractual terms with third parties and helps demonstrate accountability to regulatory bodies. Submitting comments allows organisations to influence the final version, ensuring it addresses practical challenges and operational realities. Practitioners should analyse the draft guidance to understand its implications for their organisation's vendor management and data processing agreements. Particular attention should be paid to sections detailing due diligence, contractual obligations under Article 28 type provisions, and mechanisms for demonstrating ongoing oversight. Evidence an authority would expect to see includes documented due diligence processes for vendor selection, robust data processing agreements with third parties, and internal policies reflecting the principles of accountability and control over personal information shared with external providers.
Guidance for businesses working with third party service providers sets 4 December 2026 as the day responses are due, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.
Guidance on assessing third party service providers
- Who this binds
- This guidance is advisory for organisations subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.
- What changed
- The Privacy Commissioner of Canada published new draft guidance on 10 September 2026 for businesses working with third party service providers, with a public comment period closing on 4 December 2026.
- What to check
- Organisations should review the draft guidance and consider submitting comments to the Office of the Privacy Commissioner of Canada by 4 December 2026.
- What this does not mean
- This guidance does not introduce new legal obligations but rather clarifies the Office of the Privacy Commissioner of Canada's expectations for compliance with existing PIPEDA requirements.
Not settled: The guidance is currently in draft form and may be updated after the public comment period closes on 4 December 2026.
Send this to your team
The Privacy Commissioner of Canada published new draft guidance on 10 September 2026 for businesses working with third party service providers, with a public comment period closing on 4 December 2026, which organisations subject to PIPEDA should review.