Check Which Privacy Law Applies
A Canadian MSP needs to identify the applicable law for each information flow. Substantially similar provincial laws can govern activity within a province, while PIPEDA applies to personal information crossing provincial or national borders in commercial activities. Your own customer records and the information processed for clients both need attention.
Agree the Responsibilities Before Handling Data
| MSP Decision | What to Put in Place |
|---|---|
| Purpose and access | Document why information is needed, who may access it and which tools hold it. |
| Client processing | Specify security safeguards, permitted uses, subcontractors and incident cooperation in the agreement. |
| Breach response | Agree who provides evidence and who handles reporting, notification and records. |
The organization controlling the information must keep records of every breach of security safeguards and report and notify where there is a real risk of significant harm. An MSP processing for a client should supply the information that client needs promptly; signing a service agreement does not settle every question of control.
Start by mapping the data, the client, the locations and the parties involved. Use the OPC guidance and jurisdiction-specific advice to decide which rules govern that arrangement.
Common Questions
Is PIPEDA the only privacy law a Canadian MSP needs?
No. Provincial private-sector and health privacy laws can also apply. Check the organization, activity and information flow rather than assuming one federal rule covers everything.