Security and Canadian privacy review
Review access, data handling, hosting and your business's privacy responsibilities.
Last updated September 12, 2026
- Use individual logins, appropriate roles, two-factor authentication and prompt access removal when staff leave. Share only the records needed for the task.
- Review the privacy notice, processing agreement, retention and sub-processor list before storing personal information. Canada support does not promise Canadian data residency.
- Assess PIPEDA and applicable provincial private-sector privacy laws, including Québec, British Columbia and Alberta. Québec can require a privacy impact assessment before communicating personal information outside Québec.
- Limit sensitive staff or health information to what is necessary. Keep your privacy contact, purposes, access process and incident response arrangements documented.