Identify the accountable parties
Record who approved the purpose and which party will process the information.
PIPEDA · Canadian personal information
PIPEDA and sharing personal information with Canadian partners
When a Canadian partner asks for a customer extract, establish the purpose, the approved fields and who will handle the copy. Bring the proposed arrangement to your privacy lead before release.
Trace the receiving team’s copy
Confirm where the extract goes, who can open it and what they need to do with it.
Plan the end of the assignment
Agree who deals with access changes, return or deletion and follow-up enquiries.
Check the fields before export
Use a fictional record to test whether the recipient can complete the task with fewer fields.
Define what is needed.
Identify the business task and the personal information required for it. Review unnecessary fields and attachments before preparing the exchange.
Confirm the intended use.
Ask your privacy team to confirm the purpose, consent requirements and any applicable exceptions. Give the recipient clear handling instructions.
Plan the end of the task.
Agree retention, return and removal arrangements. Decide who handles access requests, corrections and questions about the information.
Document the cross-border arrangement
Record the parties’ instructions, safeguards and review contacts. Ask the privacy lead to assess which requirements apply.
Ask the provider
- Where will processing and support take place?
- Which other providers are involved?
- What safeguards and handling commitments apply?
- How can your team review the supporting evidence?
Prepare internally
- Name the person accountable for the arrangement.
- Review the risks of the receiving jurisdiction.
- Explain relevant overseas processing in privacy information.
- Record the decision and any conditions on use.
Prepare the smallest file that serves the purpose.
Start with a synthetic customer-service export. Before choosing a delivery route, ask which information the receiving team actually needs to complete its task. This turns an abstract privacy discussion into decisions about the contents of a specific file.
Separate necessary from convenient
A recipient handling one service issue may not need the customer’s complete history. Review the fields, attachments and free-text notes individually; information can be sensitive even when it is outside the main data table.
Explain the receiving task
Write down what the recipient is being asked to do and which uses fall outside that task. Give your privacy team a concrete processing description to assess alongside the relevant arrangements.
Plan the next request
Consider how a correction, access request or change of instruction would reach everyone handling the information. Identify the contact who can coordinate the response across the relationship.
Revisit the arrangement when the work changes.
A file-sharing process can drift as teams add fields, include new recipients or use a service for another purpose. Build those changes into the review conversation rather than assuming the original decision covers every later use.
- A new recipient
- Confirm their role, location and handling arrangements before extending the existing exchange.
- A broader dataset
- Review why the additional information is needed and whether the original purpose and instructions still describe the task.
- The task is complete
- Ask what should happen to working copies and how the agreed return, retention or removal arrangements will be followed.
Prepare for the conversation
- A synthetic data sample
- Show the fields and attachments involved without real personal information.
- The processing purpose
- Explain what the recipient needs to do with the file.
- The receiving arrangement
- Bring the questions about location, other providers and end-of-task handling.
Bring the workflow. Use a sample file.
Explore a representative exchange with MX using synthetic personal information. Document the service questions your privacy team needs answered before moving real records.
Review your processing requirementsQuestions for
your review.
Does PIPEDA require every file to stay in Canada?
PIPEDA does not impose a blanket prohibition on overseas processing. Assess accountability, safeguards and transparency, alongside any applicable provincial, sector-specific or contractual requirements.
Does using a provider transfer our accountability?
No. An organisation remains responsible for personal information under its control when a third party processes it. Assess the arrangement and document appropriate protections.
Are these pages saying PIPEDA is UK or US law?
No. PIPEDA is Canadian law. These regional pages address teams working with Canadian information or organisations where the law may be relevant. Confirm applicability to your specific activities.
Is MX certified as PIPEDA compliant?
This page makes no certification or blanket compliance claim. Assess the proposed service, contracts, configuration and operating procedures against your requirements.