PIPEDA and client documents: a mortgage broker's obligations.

PIPEDA requires that personal information be collected only for identified purposes, that clients consent to that collection, and that the information be safeguarded and used only for the purposes it was collected for. For a mortgage file, that means income documents, ID, and financial history collected for the purpose of a mortgage application shouldn't be used or shared beyond what the client understood and agreed to.

The Office of the Privacy Commissioner of Canada sets out the ten fair information principles PIPEDA is built on, which is the reference point for exactly what "safeguarded" and "consented to" mean in practice.

The broker is. PIPEDA's accountability principle means an organization remains responsible for personal information it has transferred to a third party for processing, even though the third party is the one physically handling it. That means a broker outsourcing document collection to a fulfillment provider still needs to know how that provider stores, accesses, and protects client information — the obligation doesn't disappear just because someone else is doing the work.

This is why Treadstone's fulfillment team treats client data handling as a structured, documented process rather than an informal arrangement — because the broker who engages a fulfillment provider is still the one answerable for how that data is handled.

Location is a real factor, but it's not the whole picture — what matters most is whether the broker has clear safeguards and agreements in place governing how the data is accessed and protected, regardless of where the team doing the work is based. See our companion piece on onshore versus offshore mortgage processing for how that trade-off plays out in practice.

A broker considering any outsourced processing arrangement should ask specifically how client information is stored, who can access it, and what happens to it once a file closes — regardless of the answer to where the team sits.

A written agreement with any third party handling client data, clear internal rules about who can access a file, and a documented process for what happens to client information after a file closes are the baseline. None of this needs to be complicated, but it does need to exist in writing rather than as an informal understanding.

• →A written agreement covering how a third party handles, stores, and protects client data
• →Access limited to the people who actually need it for the file in question
• →A documented retention and disposal practice once a file closes or a relationship ends