PIPEDA
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law. It is relevant when an organization collects, uses, or discloses personal information in commercial activities, including applicable processing across provincial or national borders.
Provincial privacy laws can also govern an organization's activities. Where a substantially similar provincial law applies, PIPEDA generally does not govern the same handling occurring entirely within that province, while commercial cross-border handling can bring PIPEDA into consideration. The Office of the Privacy Commissioner of Canada's applicability guidance explains these relationships.
Accountability When Using a Service Provider
An organization remains accountable for personal information under its control when another provider processes it. Evaluate the provider's safeguards, the purposes and instructions for processing, the applicable agreement, and the ability to support your obligations to individuals. This review applies to the service arrangement as a whole.
Files.com provides configurable access controls, encryption, activity records, retention controls, and storage-region options supporting customer privacy programs. Our Data Processing Agreement addresses personal-data processing responsibilities, subprocessors, safeguards, and related obligations. Contact your account team to review the agreement relevant to your arrangement.
Your organization establishes the purposes for collecting and using personal information, the applicable consent and notice requirements, who may receive it, and the appropriate retention schedule. The Shared Responsibility Model describes the division between operating the service and managing your own use of it.
Storage and Cross-Border Processing
PIPEDA permits processing through providers outside Canada subject to the applicable accountability and protection requirements. The Privacy Commissioner's cross-border processing guidance explains the use of contractual safeguards, transparency, and the limits of contracts in a foreign jurisdiction. Separate provincial, sector-specific, or contractual requirements may impose additional conditions.
A requirement for Canadian storage needs a complete data-flow review. Files.com offers Canadian storage for retained file contents, but a selected folder region does not determine every related processing or record location. Logs are stored in the United States; online document editing uses temporary United States processing; enabled AI features can involve provider-operated environments. Remote storage and receiving systems introduce their own locations and responsibilities.
Data Location & Processing explains these distinctions. Use that information to evaluate your permitted processing arrangement and any separate location requirement, including features your team enables and systems it connects.
Access, Retention, and Individual Requests
Your organization manages access to the information it stores, removes access when relationships end, and sets the retention and deletion rules for its business process. Include direct and inherited permissions, external recipients, copies downloaded or delivered elsewhere, and records retained for recovery or audit purposes.
Customer Control Over Data explains the controls and export capabilities available for that work. Data Retention & Deletion distinguishes working files, recoverable copies, logs, and account closure. Use those capabilities within your process for responding to access, correction, or other applicable privacy requests.
Files.com's privacy oversight and contact information are described in How Files.com Handles Customer Data. Requests about the personal information your organization controls remain part of your own privacy-response process.