Third-Party Privacy Assessments for a Federal Crown Corporation
Multi-year (ongoing)Privacy Act, PIPEDA, Treasury Board DirectivesThird-Party Privacy Assessments
Delivered 25+ third-party privacy assessments of vendor service providers — including cloud infrastructure, HR systems and data analytics platforms — for a federal Crown corporation, working inside the client's own PIA procedure and risk-tiered templates.
Scope of Work
- Third-party privacy assessments (TPPAs) of vendor service providers for a federal Crown corporation, delivered within the client privacy office's procedure and templates
- Covered 25+ vendor service providers spanning cloud infrastructure, HR systems, financial platforms, and data analytics tools
- Assessment depth set by each vendor's rating at the client's vendor risk assessment intake
Methodology
- Several vendor assessments run in parallel rather than one at a time
- Each assessment follows the client's privacy office procedure, with residual risk rated principle by principle and rolled up to an overall rating
Deliverables
- 25+ Third-Party Privacy Assessments (TPPAs) delivered since 2024, with further assessments in progress
- Vendor questionnaires and evidence review aligned to the Privacy Act, the Treasury Board Directive on Privacy Practices, and PIPEDA where it governs the vendor
- Cloud and SaaS analysis covering sub-processors and data residency
- Interviews with the client's business owners and subject-matter experts
- Per-vendor report — risk rating, key findings and remediation recommendations
Outcome
- 25+ TPPAs delivered since 2024
- Multi-year engagement, ongoing in 2026
Related briefs
All case briefs →Privacy Impact Assessment for a Federal Enforcement Program
Prepared a privacy impact assessment of a federal department's enforcement intelligence activities, including the cross-agency information-sharing agreements behind them — signed off by the department and ready for submission to the Treasury Board Secretariat and the Office of the Privacy Commissioner.
Read brief →Privacy Assessments for a Provincial Digital Service Transformation
Delivered 15+ privacy impact assessments under FIPPA for a provincial ministry modernizing citizen-facing services across digital channels, integrated data-sharing platforms, and third-party cloud services.
Read brief →