Law 25 subcontractor clause template

An enterprise may give a mandate or a service contract to a third party. The written contract frames confidentiality. Without these commitments, the communication rests on a verbal promise you will not be able to show.

The supplier agrees to:
1. Take the following measures to protect confidentiality: [measures].
2. Use the information only to perform the contract, namely [description of the mandate].
3. Not keep the information after the contract ends. Return or destroy it by [deadline], and confirm in writing.
4. Notify without delay the person in charge of the protection of personal information of any violation, or attempted violation, of the confidentiality obligation, at [email].
5. Allow the confidentiality checks requested by the client.
6. Not entrust the mandate to another third party without written authorization. That third party is bound by the same commitments.

What the clause does not settle on its own

• If the supplier hosts outside Quebec, including in another province, the written transfer assessment is still required.
• The clause does not replace due diligence: questionnaire, security evidence, review of the critical file.
• The person named in your policy is the one who receives the incident notice.

Have the person who signs your contracts review the text. The measures in point 1 have to be the ones the supplier actually applies.