Vendor privacy and security reviews
Your vendors hold your data, connect to your systems and can be the way an attacker gets in. Canadian privacy law also keeps you accountable for what they do with personal information. We review SaaS and service providers before you sign and on a schedule afterwards.
Reviewed by the ITRS security team · Last updated
This page is general information, not legal advice. For advice on your obligations, speak with your lawyer.
Which vendors need review
Not every supplier deserves the same scrutiny. Under PIPEDA's accountability principle, you remain responsible for personal information transferred to a third party for processing and must use contractual or other means to provide a comparable level of protection. And the Canadian Centre for Cyber Security warns that managed service providers and other suppliers with access to your network can become a route into it. We start by tiering your vendors:
| Tier | Examples | Review depth |
|---|---|---|
Critical | Hosts or processes sensitive personal information; has privileged or remote access to your systems (IT providers, payroll, EMR, practice management, cloud backup) | Full questionnaire, evidence review and contract review; annual re-review |
High | Holds personal or confidential data with limited access (CRM, marketing platforms, e-signature, AI tools) | Questionnaire and key evidence; review every one to two years |
Standard | No sensitive data or system access | Basic due diligence at onboarding |
Questionnaire and evidence
Questionnaires are only as good as the evidence behind them. We send a focused questionnaire sized to the tier, covering governance, access control, MFA, encryption, logging, vulnerability management, backup and recovery, incident response, staff screening and training, and secure development. Then we ask for evidence: independent audit reports such as SOC 2 Type II, ISO/IEC 27001 certificates and their scope, penetration test summaries, and policies. We read the reports properly: an ISO/IEC 27001 certificate that covers only one office, or a SOC 2 report with exceptions in access control, tells a different story from the sales deck.
ISO/IEC 27001:2022 Annex A is a useful reference for what good controls look like, and we map vendor answers against it where helpful.
Data location and transfers
We document where the vendor stores and processes your data, where its support staff access it from, and which subprocessors it uses. Under PIPEDA, transferring data abroad for processing is generally permitted, but the Office of the Privacy Commissioner of Canada expects you to protect it through contract and to tell individuals their information may be processed in another country and be accessible to that country's authorities. Quebec requires a privacy impact assessment before personal information is communicated outside the province, and public-sector clients may impose their own residency terms. We flag any of these that apply.
Breach notification and audit clauses
We review the contract, data processing addendum and service terms for the clauses that matter when something goes wrong:
Your counsel negotiates the contract; we identify the technical gaps and suggest wording that addresses them.
- Breach notification: how quickly the vendor must tell you, what information it must provide, and its duty to cooperate. You need enough time to meet your own legal deadlines.
- Use limits: your data used only to provide the service, not for the vendor's own purposes or model training without consent.
- Subprocessors: notice of changes and the same obligations flowed down.
- Security commitments: specific controls, not 'industry standard'.
- Audit and assurance: right to receive audit reports annually or to assess on request.
- Logs: access to relevant logs for investigations.
- Return and deletion: at contract end, with certification.
- Liability and insurance: whether caps and coverage are realistic for a data breach.
Risk rating and decision
Each review ends with a risk rating and a recommendation: approve; approve with conditions (for example, enforce SSO and MFA, disable an integration, add a breach-notice clause); or don't proceed. Conditions are tracked with owners and dates. We also note how to reduce your exposure regardless of the vendor's answers, such as limiting the data you share, restricting its access to specific systems, and monitoring its activity in your environment.
Re-review cadence
On a schedule
Annually for critical vendors, every one to two years for high, at renewal for standard.
On change
New services, new data types, a change in hosting location, an acquisition of the vendor, or new AI features in the product.
After an incident
If the vendor reports a breach, review what happened, what data was involved and whether conditions should change.
Keep the file
Store questionnaires, evidence, reviews and decisions in one register so you can show your diligence to clients, auditors or regulators.
Frequently asked questions
Large cloud providers usually won't, but they publish trust centres with audit reports, data processing terms and subprocessor lists. We review that material instead. For smaller vendors, a refusal to answer basic security questions is itself useful information for the risk rating.
Yes. A managed service provider typically has privileged access to everything you run, which makes it one of your most critical vendors. That applies to any IT provider, including us.
Fewer than people fear. Tiering usually shows that a small number of critical and high vendors hold most of the risk. Start with those and handle the long tail with basic onboarding checks.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Related.
- PracticePrivacy, Data Governance & AIPIPEDA and Quebec Law 25 readiness, data mapping, breach notification and AI governance.
- ServiceAI tool risk assessmentsBefore a new AI tool touches client, patient or employee data, someone should check where that data goes, whether it trains the vendor's models, how long it is kept and…
- GuideA vendor security questionnaire for small organizationsTwenty questions that tell you whether a vendor can be trusted with your data, how to read evasive answers, and how to turn the answers into contract terms.
- GuideWhat to do when a vendor tells you they were breachedA breach notice from a supplier, software provider or service firm can land your organization with its own obligations. Here is how to work out what it means for you.
Not sure what your obligations require of your systems?
Speak with our privacy practice. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.