Confirm the relationship
Identify the customer’s privacy contact and the person responsible for the provider’s handling of the file.
PIPEDA · Canadian personal information
PIPEDA and US–Canada file sharing
A US service provider receiving personal information from a Canadian customer needs clear processing instructions. Use a sample file to establish the purpose, permitted recipients and handling of retained copies.
Follow the information
Map each receiving system, service provider and authorized user involved in the task.
Agree on follow-up
Document who answers a privacy inquiry and who confirms the disposition of working copies.
Review the proposed disclosure
Check which fields the receiving team needs before approving a sample export.
Define what is needed.
Identify the business task and the personal information required for it. Review unnecessary fields and attachments before preparing the exchange.
Confirm the intended use.
Ask your privacy team to confirm the purpose, consent requirements and any applicable exceptions. Give the recipient clear handling instructions.
Plan the end of the task.
Agree retention, return and removal arrangements. Decide who handles access requests, corrections and questions about the information.
Check the provider arrangement
Ask both parties to confirm the purpose, access conditions and procedure for changes in processing.
Ask the provider
- Where will processing and support take place?
- Which other providers are involved?
- What safeguards and handling commitments apply?
- How can your team review the supporting evidence?
Prepare internally
- Name the person accountable for the arrangement.
- Review the risks of the receiving jurisdiction.
- Explain relevant overseas processing in privacy information.
- Record the decision and any conditions on use.
Prepare the smallest file that serves the purpose.
Start with a synthetic customer-service export. Before choosing a delivery route, ask which information the receiving team actually needs to complete its task. This turns an abstract privacy discussion into decisions about the contents of a specific file.
Separate necessary from convenient
A recipient handling one service issue may not need the customer’s complete history. Review the fields, attachments and free-text notes individually; information can be sensitive even when it is outside the main data table.
Explain the receiving task
Write down what the recipient is being asked to do and which uses fall outside that task. Give your privacy team a concrete processing description to assess alongside the relevant arrangements.
Plan the next request
Consider how a correction, access request or change of instruction would reach everyone handling the information. Identify the contact who can coordinate the response across the relationship.
Revisit the arrangement when the work changes.
A file-sharing process can drift as teams add fields, include new recipients or use a service for another purpose. Build those changes into the review conversation rather than assuming the original decision covers every later use.
- A new recipient
- Confirm their role, location and handling arrangements before extending the existing exchange.
- A broader dataset
- Review why the additional information is needed and whether the original purpose and instructions still describe the task.
- The task is complete
- Ask what should happen to working copies and how the agreed return, retention or removal arrangements will be followed.
Prepare for the conversation
- A synthetic data sample
- Show the fields and attachments involved without real personal information.
- The processing purpose
- Explain what the recipient needs to do with the file.
- The receiving arrangement
- Bring the questions about location, other providers and end-of-task handling.
Bring the workflow. Use a sample file.
Explore a representative exchange with MX using synthetic personal information. Document the service questions your privacy team needs answered before moving real records.
Review your processing requirementsQuestions for
your review.
Does PIPEDA require every file to stay in Canada?
PIPEDA does not impose a blanket prohibition on overseas processing. Assess accountability, safeguards and transparency, alongside any applicable provincial, sector-specific or contractual requirements.
Does using a provider transfer our accountability?
No. An organization remains responsible for personal information under its control when a third party processes it. Assess the arrangement and document appropriate protections.
Are these pages saying PIPEDA is UK or US law?
No. PIPEDA is Canadian law. These regional pages address teams working with Canadian information or organizations where the law may be relevant. Confirm applicability to your specific activities.
Is MX certified as PIPEDA compliant?
This page makes no certification or blanket compliance claim. Assess the proposed service, contracts, configuration and operating procedures against your requirements.