Here is a question worth putting to your own organization this week: for every place personal information goes when it leaves your systems, can you produce the signed agreement that governs it?
Not the draft. Not the email thread where both sides agreed the terms were basically settled. Not a master agreement that does not actually cover this data. The executed instrument, covering this information, for this purpose, in force today.
If you can, good. If you hesitated, you are carrying a risk that grows every day the flow runs.
What the gap looks like
In regulated organizations, personal information can end up moving between the organization and someone else with no executed agreement behind it. The flow might be a vendor receiving a file each night, a service provider with a login to a production system, or another organization receiving a regular extract.
The flow started because it was operationally useful. The paperwork was always coming. The shape varies: an agreement drafted and never signed; one signed for one set of information, with a second added later; one that expired while the data kept moving. From a distance, all three look like compliance. There is a file with the other party's name on it.
Why it happens
This is structural, not careless. The people who start data flows and the people who own agreements sit in different parts of the organization and work to different clocks.
Operations needs the service working now. Negotiating terms takes longer. So the technical connection gets built in parallel to save time, on the understanding that signature will follow, and once the data is moving nobody has a reason to chase the paper.
Nobody owns the join. Each team completes its own work, and the gap between them is nobody's deliverable. Unlike a broken system, a missing agreement produces no error message. The data arrives. The service works. The risk stays invisible until a breach, a complaint or an access request makes someone ask who was allowed to hold the information, and on what terms.
What the law actually expects
When a service provider handles personal information for you, Canada's private-sector privacy laws do not let responsibility leave with the data. Under PIPEDA, an organization remains responsible for personal information it transfers to a third party for processing, and must use "contractual or other means" to provide a comparable level of protection. British Columbia's PIPA makes an organization responsible for personal information under its control, including information that is not in its custody. Alberta's PIPA makes an organization responsible, with respect to the services it engages someone to provide, for that person's compliance with the Act.
Quebec goes further and writes the paper into the statute. Under its private-sector Act, an enterprise that communicates personal information to a service provider without consent must put the mandate in writing. Unless the provider is a public body or a member of a professional order, the mandate must also spell out the measures that keep the information confidential, limit its use to the mandate, and ensure it is not kept after the contract ends. Since Law 25, information leaving Quebec also needs a privacy impact assessment showing adequate protection first, then a written agreement that takes its results into account. We covered that transfer rule in Law 25 isn't done with you.
Quebec's public-sector Act carries parallel duties for public bodies. For certain releases made without consent, it lists what the written agreement must state: who is releasing and who is receiving, the purposes, the nature of the information, the transmission method, the security measures, the frequency and the duration.
Different statutes, different drafting. PIPEDA leaves room for "other means"; whatever the means, expect to be asked to show it. The practical bar is the same everywhere: if personal information is moving, you can point to the instrument that governs it.
The fix is an inventory, not a policy
A new policy will not close this gap on its own. You need a table with three columns: the flow, the instrument that governs it, and the date that instrument was executed.
A flow is one kind of personal information going to, or coming from, one outside party for one purpose. The instrument is the executed agreement, contract clause or other document that governs it. The execution date is the day the last party signed, not the day a draft was circulated. If a law or court order compels the flow, that authority is its instrument.
Every blank cell is a risk you are carrying today. Treat each one as a stop-work finding, not a backlog item: within a set period, either the instrument is executed or the flow is paused, and a named executive decides which, in writing. A backlog item waits for capacity. A stop-work finding forces a decision.
For every instrument you do find, test three things. Is it executed by every party? Is it in force today? Does it cover the information and purpose actually moving, not the ones described when it was signed? Then read the clauses that matter when something goes wrong: use limited to the stated purpose, security measures, notice to you if confidentiality is breached, your right to verify, and what happens to the information when the relationship ends. If that last clause is silent, the other party's retention practice is now your problem too. We wrote about why retention gaps compound in Nobody owns retention until it's too late.
What to do now
- Name an owner and book an afternoon. The privacy lead owns the table. The afternoon produces its first draft.
- Ask operations, not only legal, where personal information goes. Include vendors, service providers, cloud platforms, affiliates and other organizations, and count flows coming in as well as going out. Legal can only list the flows it has been told about.
- Write one row per flow in the three columns: flow, instrument, execution date.
- Pull each instrument and test it: executed, in force, and covering what is actually moving.
- Flag every Quebec touchpoint. Information leaving Quebec, or entrusted to a service provider by an enterprise or public body covered by Quebec law, carries specific written-agreement requirements. Check those clause by clause.
- Turn every blank cell into a stop-work finding with a named owner, a decision date and a written outcome: executed or paused.
- Add one question to procurement and change requests: does this start or change a flow of personal information, and which executed instrument governs it? That is what keeps the table true after this week.
This one compounds. Every month an ungoverned flow runs adds personal information moving on terms nobody signed. Closing the gap early costs a signature. Closing it after an incident means doing the same work under pressure, on someone else's timeline.
Mosaic Effect works with privacy offices on exactly this: finding where personal information actually goes, and testing whether the paper behind each flow would hold up, through an expert-led, standardized methodology and senior practitioner review. If a scoping conversation would help, we are happy to have one.