Template: privacy assessment for a transfer outside Quebec
Hosting in Ontario, British Columbia or Europe is already outside Quebec. The assessment is written before the communication.
Since 22 September 2023, a communication of personal information outside Quebec is preceded by a written assessment. It covers the sensitivity of the information, the purpose of the communication, the protection measures, including contractual ones, and the legal regime of the destination. The communication goes ahead if the assessment shows that the information would receive adequate protection, including in light of generally recognized principles.
Sheet to complete before the communication
Date: Author: Person in charge who reviews the sheet: Information concerned: Sensitivity (nature, context, volume): Purpose of the communication: Recipient and role: Place: [province, country, hosting region] Protection measures Technical: [encryption, access, logging] Contractual: [reference to the clause or agreement] Legal regime of the destination Applicable law: What protects the information: What exposes it: Conclusion: adequate protection, yes or no. If no: the communication does not take place, or the measures are strengthened and the sheet is redone. Written agreement: [reference, date]
Keep the sheet with the contract. The privacy policy says that a communication outside Quebec may happen. It does not replace this assessment.
One sheet per communication, or per family of identical communications. A new host or a new region starts the assessment again.
The assessment stays with the vendor
CapPRP and CapTRISK keep the sheet, the destination and the agreement in the file.