Third Parties Should Be First Priority: OPC Guidance On Assessing Third-Party Service Providers Under PIPEDA

On September 10, 2026, the Office of the Privacy Commissioner of Canada (the “OPC”) published guidance to help organizations assess a third-party service provider’s approach to data privacy. The guidance focuses on best practices that can help organizations meet their accountability obligations under Principle 4.1.3 of Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), which requires organizations to ensure a comparable level of protection for personal information that is transferred to or handled by third parties, with a focus on due diligence considerations to ensure compliance. If your organization collects any personal information that is processed by a third party, read ahead.