All guides
Privacy

Sharing Client Files With a Service Provider: A PIPEDA Checklist for Immigration Practices

Updated October 20, 2026 3 min read

Immigration files hold some of the most sensitive personal information there is: passports, family details, finances, health and background questions. When you send that information to an outside provider, such as a data-entry team, IT support or cloud storage, Canada's federal privacy law, PIPEDA, still applies.

The Office of the Privacy Commissioner of Canada (OPC) explains how in its guidelines on processing personal data. Here are the main points and a checklist.

Sending files for processing is a "use", and you stay accountable

The OPC treats a transfer to a service provider for processing as a use of the information, not a disclosure. If the information is used for the purpose it was collected for, no extra consent is needed for the transfer.

But responsibility does not move with the file. Under PIPEDA's first principle, an organization is responsible for personal information in its possession or custody, including information it has transferred to a third party for processing.

Protect the information by contract

The OPC expects you to use contractual or other means to give the information a comparable level of protection while the provider handles it. In practice, the OPC describes:

  • a written contract as the main tool;
  • checking that the provider has privacy policies, staff training and effective security;
  • keeping the right to audit and inspect how the provider handles your information, and using it when needed.

Know where the data is processed

PIPEDA does not treat domestic and international transfers differently, but the OPC points out that no contract can override the laws of another country. If information may be processed outside Canada, clients should be told, in clear language and ideally when the information is collected, that it may be accessible to that country's courts and authorities.

The OPC also notes that some information may be too sensitive to send abroad at all. For immigration files, choosing providers that keep data in Canada avoids this question.

Keep a record of every privacy breach

PIPEDA requires organizations to keep a record of every breach of security safeguards involving personal information under their control, and to keep those records for at least 24 months. Breaches that create a real risk of significant harm must also be reported to the OPC and the affected people notified.

Your contract should require the provider to tell you quickly about any breach, so you can meet these duties.

Provincial laws

Quebec, Alberta and British Columbia have their own private-sector privacy laws, which can apply instead of, or alongside, PIPEDA. If your practice is in one of those provinces, check the provincial rules too.

Before you share client files with a provider

  • Sign a written agreement covering confidentiality, security, no other use of the data, breach notice, and return or deletion at the end.
  • Ask where the data is stored and processed. Prefer Canada for immigration files.
  • Ask who at the provider can see your files, and whether staff accounts use two-step sign-in.
  • Keep the right to audit or ask questions about how your data is handled.
  • Exchange files through a secure portal, not email attachments.
  • Update your privacy notice or service agreement if information may leave Canada.
  • Keep a breach log and hold the records for at least 24 months.

How Any Help Services fits in

Client files you share with Any Help Services are stored in Canada and encrypted in transit and at rest. Each firm sees only its own files, our staff sign in with a password and a 2-step code, and staff actions on files are recorded in an activity log.

Our Security & Privacy page explains the details, and we are happy to answer your questions for your own compliance file.

Talk to us Security & Privacy

Sources

General information only, not legal or immigration advice. Rules and IRCC instructions change; always check the current official source. Any Help Services is a non-regulated support company and does not provide immigration advice.