PIPEDA and client documents: a mortgage broker's obligations.

PIPEDA requires that personal information be collected only for identified purposes, that clients consent to that collection, and that the information be safeguarded and used only for the purposes it was collected for. For a mortgage file, that means income documents, ID, and financial history collected for the purpose of a mortgage application shouldn't be used or shared beyond what the client understood and agreed to.

The Office of the Privacy Commissioner of Canada sets out the ten fair information principles PIPEDA is built on, which is the reference point for exactly what "safeguarded" and "consented to" mean in practice.

No — not automatically. Alberta, British Columbia, and Quebec each have their own private-sector privacy law that the federal Office of the Privacy Commissioner has found substantially similar to PIPEDA: Alberta's Personal Information Protection Act, BC's Personal Information Protection Act, and Quebec's Act Respecting the Protection of Personal Information in the Private Sector. For a brokerage operating entirely within one of those three provinces, the provincial law — not PIPEDA — generally applies, and it's the provincial regulator (the OIPC in Alberta or BC, or Quebec's Commission d'accès à l'information) a broker would answer to.

PIPEDA still applies in those three provinces the moment client information crosses a provincial or national border — which, for a brokerage using a cloud-based CRM, a submission platform, or a fulfillment provider based elsewhere in Canada, is common enough that most brokerages end up subject to some mix of federal and provincial rules rather than one exclusively. The safer approach is to treat the stricter of the applicable standards as the baseline, rather than assuming only one law is in play.

The broker is. PIPEDA's accountability principle means an organization remains responsible for personal information it has transferred to a third party for processing, even though the third party is the one physically handling it. That means a broker outsourcing document collection to a fulfillment provider still needs to know how that provider stores, accesses, and protects client information — the obligation doesn't disappear just because someone else is doing the work.

This is why Treadstone's fulfillment team treats client data handling as a structured, documented process rather than an informal arrangement — because the broker who engages a fulfillment provider is still the one answerable for how that data is handled.

Location is a real factor, but it's not the whole picture — what matters most is whether the broker has clear safeguards and agreements in place governing how the data is accessed and protected, regardless of where the team doing the work is based. See our companion piece on onshore versus offshore mortgage processing for how that trade-off plays out in practice.

A broker considering any outsourced processing arrangement should ask specifically how client information is stored, who can access it, and what happens to it once a file closes — regardless of the answer to where the team sits.

A written agreement with any third party handling client data, clear internal rules about who can access a file, and a documented process for what happens to client information after a file closes are the baseline. None of this needs to be complicated, but it does need to exist in writing rather than as an informal understanding.

• →A written agreement covering how a third party handles, stores, and protects client data
• →Access limited to the people who actually need it for the file in question
• →A documented retention and disposal practice once a file closes or a relationship ends

PIPEDA requires an organization to report a breach of security safeguards to the federal Privacy Commissioner, and to notify the affected individuals directly, whenever it's reasonable to believe the breach creates a real risk of significant harm — based on how sensitive the information was and how likely it is to be misused. Financial information and government-issued ID, the exact categories of documents that pass through a mortgage file, are treated as inherently sensitive under this standard.

Separately from that reporting threshold, PIPEDA requires an organization to keep a record of every breach of security safeguards — not just the ones serious enough to report — for at least two years, including enough detail for the Commissioner to verify the organization assessed the risk correctly. A brokerage that has never worked through what counts as a reportable breach, or where those records would even be kept, is better off answering that question before an incident forces it, not during one.