---
title: "Canada — Controller/Processor Duties | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/canada/controller-processor-duties/
source_html: /jurisdictions/canada/controller-processor-duties/index.html
description: "Canada — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 1 sub-module 1 claim Not assessed ▾ # No standing position recorded for this category. Sub-modules (1) Accountability And Dpia N"
generated_at: 2026-10-25T04:46:50Z
content_sha256: a6eba7d797b379bf4c578fb78924d862866c4459d9f0f9ae2f7f7d7cb1c308fe
generator: "fe-fleet/md-twin@1.0"
---
# Canada — Controller/Processor Duties | Data Protection Monitor

### D4Controller/Processor Duties1 sub-module1 claimNot assessed▾#

No standing position recorded for this category.

#### Sub-modules (1)

#### Accountability And DpiaNot assessed

No narrative recorded for this sub-module.

Claims (1):

- Office of the Privacy Commissioner of Canada released guidance: On 10 September 2026 the OPC released draft guidance to help PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement.

Category narrative 254 words

#### Controller/Processor Duties

On 10 September 2026 the Office of the Privacy Commissioner of Canada released draft guidance aimed at helping PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement. The guidance is reported as draft and non-binding, meaning it does not itself create new statutory obligations but is understood to elaborate on accountability expectations already embedded in PIPEDA's existing principles, particularly around an organisation's responsibility for personal information it transfers to third parties for processing.

This guidance is understood to respond to a practical compliance gap: organisations subject to PIPEDA's accountability principle remain responsible for personal information in the hands of third-party processors, but PIPEDA itself provides limited granular direction on how to conduct pre-procurement privacy due diligence. The OPC's draft guidance is reported as intended to fill that gap with practical assessment criteria, though its specific content, beyond the general purpose of helping organisations evaluate prospective providers, has not been independently detailed this cycle.

For organisations currently engaging or renewing third-party service-provider relationships involving personal information, the draft guidance signals that the OPC views pre-procurement privacy assessment as an increasingly important component of PIPEDA accountability compliance, even though the guidance remains non-binding and draft in status.

#### Outlook

Whether the OPC's draft guidance progresses to final, binding-in-effect status, and what specific assessment criteria it ultimately contains, remain open questions not resolved this cycle. Organisations with significant third-party data-processing arrangements are understood to be a natural audience for monitoring the guidance's finalisation, given its direct relevance to existing PIPEDA accountability obligations.

Read full narrative · 254 words no periodic updates on record for this sub-brief

Evidence 1

Sources and claims (1)
- Probableunavailable — Office of the Privacy Commissioner of Canada released guidance: On 10 September 2026 the OPC released draft guidance to help PIPEDA-regulated organisations assess the privacy practices of prospective third-party service providers before procurement.