Get virtual assistant leads in Canada

The Personal Information Protection and Electronic Documents Act applies to private-sector organisations that collect, use or disclose personal information in the course of commercial activity, and it is built on ten fair information principles. The first is accountability, and it settles the question directly: an organisation is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. Engaging a virtual assistant does not move that responsibility to them.

The Office of the Privacy Commissioner's guidance is that organisations must use contractual or other means to ensure a comparable level of protection while a third party processes the information, limit the third party's use of it to the purposes of the contract, ensure subcontractors are held to the same standards, and be transparent with customers, including telling them when information may be sent to another jurisdiction for processing where it could be accessed by courts, law enforcement or national security authorities. That last point matters whenever your assistant works outside Canada.

The safeguards principle asks for protection appropriate to the sensitivity of the information, through physical, technological and organisational measures, and it names staff training, limiting access and security agreements among the organisational ones. Breach obligations also stay with you: a breach that creates a real risk of significant harm must be reported to the Privacy Commissioner and the affected individuals notified as soon as feasible, and you must keep a record of every breach of security safeguards, whether or not it was reportable.

Sources: Office of the Privacy Commissioner of Canada: PIPEDA in brief · Office of the Privacy Commissioner of Canada: PIPEDA fair information principle 1, accountability · Office of the Privacy Commissioner of Canada: Guidance on assessing third-party service providers · Office of the Privacy Commissioner of Canada: Mandatory reporting of breaches of security safeguards · Canada Revenue Agency: Employee or self-employed