Security Insights
New PIPEDA Vendor Guidance: What Holds Up in Due Diligence
By John Svazic 
If you sell software to Canadian enterprises or regulated buyers, your next security review has already been drafted. On September 10, 2026 the Office of the Privacy Commissioner of Canada published new PIPEDA guidance on assessing third-party service providers, with public comments open until December 4, 2026 and amendments possible after that.
The guidance is written for the organizations doing the assessing. Its questions are the ones procurement and privacy teams will start putting to their SaaS and FinTech suppliers, and most vendors will encounter them for the first time inside a questionnaire attached to a deal they are trying to close.
There is a window before those questionnaires start arriving. Use it to assemble the evidence rather than to write new policy documents.
What the guidance asks assessors to check
The OPC frames the document around due diligence before an organization hands personal information to a service provider. The news release describes it as best practices for that pre-engagement assessment.
Read as a vendor, a few themes stand out.
Assessors are directed to identify whether any of the personal information involved is sensitive, such as health or financial data. Expect sensitivity to set how hard the review looks, so FinTech and health-adjacent SaaS vendors should expect the longest questionnaires.
Assessors are told to scrutinize anonymization and de-identification claims rather than accept them at face value.
And the guidance addresses the competence of whoever performs the assessment. The reviewer’s own qualifications are in scope, which tends to make reviewers more interested in the qualifications behind the evidence you hand them.
One boundary before going further. We test systems and write reports. We do not interpret privacy law, and nothing here is legal advice. Take the guidance to your counsel or privacy lead for interpretation. What follows is our reading of the security evidence side of the file, which is the part we do all day.
Self-attestation is the weakest evidence in the file
A completed questionnaire tells a reviewer what you believe about your own environment. Experienced reviewers treat it as the least durable proof in the folder.
More than a few of our clients have told us they have customers waiting on a penetration test because there is no SOC 2 audit available for review.
Those deals are waiting on independent evidence. More and more buyers want a trusted security review of a product they plan to use in their own businesses, and a penetration test from a trusted vendor is becoming table stakes for many of these security-conscious buyers.
Third-party evidence changes the conversation because it shifts the burden. A penetration test report from an accredited firm, with a stated scope and coverage tied to published testing standards, says what someone independent verified on a specific date.
This is also where compliance theatre gets exposed. A SOC 2 report or an ISO certificate proves a program exists. Neither proves an attacker could not reach customer data last Tuesday. We have written before about why compliance does not guarantee safety, and vendor due diligence is where that gap shows up in front of a buyer.
The artifacts we would put behind those answers
To be clear, the OPC does not ask for any of the following. This is our view of what a vendor can reasonably hand a reviewer when the questions land.
A current third-party penetration test report. Ours carry CREST accreditation, which is a firm-level accreditation covering how the testing organization operates. EliteSec is one of very few CREST-accredited firms headquartered in Canada. When a reviewer asks who did the work and how you know they were competent, the accreditation answers it without a phone call. We cover how that plays out in procurement in how a CREST pentest report closes the enterprise security review.
Firm-level certification. EliteSec is ISO 27001:2022 certified as a company. That matters in this context because the reviewer is assessing your company as a whole.
Coverage tied to published standards. Our testing follows published, industry-recognized standards for network and web application work, and the report says so. A reviewer can check that coverage against something public. An in-house checklist gives them nothing to verify.
Re-test records showing findings closed. More on that below.
Clear answers on de-identification claims, prepared with your privacy lead rather than improvised in a questionnaire field.
Headquartered in Canada. Independent. Certified. Trusted. For buyers with data-residency priorities, the first word tends to come up early.
Scope is where vendor answers fall apart
A report with scope that is not stated plainly is the easiest one for a reviewer to set aside.
A report needs to say what was in scope, what was excluded and why, what testing was performed, and the dates it ran. When any of that is missing, a careful reviewer assumes the gap covers the exact thing they care about. Sometimes they are right.
If you already hold a SOC 2 report, we recommend matching your pentest scope to it. That makes the two pieces of evidence easier for a reviewer to read together.
A web application test from fourteen months ago, covering a product surface you have since rebuilt, answers a question nobody asked. A reviewer who spots the mismatch will ask for a current test, and that request arrives at the worst possible moment in a sales cycle.
Timing testing to releases rather than to the calendar solves most of this. We have laid out how we think about testing cadence for teams shipping continuously.
Remediation proof closes reviews faster than clean reports
Experienced reviewers expect findings, and a report with none makes them wonder how hard anyone looked. What they want is evidence that findings were fixed and independently re-verified by someone other than the team that opened the ticket. The difference between closed and fixed is exactly what a due diligence file should resolve.
That is why every EliteSec engagement includes five free re-tests within 12 months. The industry norm is one. One re-test forces you to batch remediation and hope everything lands in a single window. Five lets you fix, verify, ship, and verify again, and it produces a trail of independent confirmations you can put in front of a reviewer or a board.
The kind of finding that trail captures is often unglamorous and material. In two internal network engagements documented in our case studies, testing surfaced a leased Xerox multifunction printer running factory default credentials, which allowed silent interception of documents sent to it, and a networked APC UPS on factory defaults that would let an attacker disrupt service in a data centre. Both were remediated. Neither would appear in a self-assessment questionnaire, because nobody thinks to mention the printer. Details are in The Threat Is Inside the Network.
Anonymization claims now sit in the same review
If your product claims data is anonymized, expect a reviewer to ask what technique you use and whether re-identification is plausible given the other fields you retain. That is an answerable question, and it is better answered now than in a procurement thread.
Assemble the file before the questionnaire arrives
Four things, and none of them require a new policy document.
- A current third-party test report with documented scope, exclusions, methodology, and dates.
- Firm-level credentials for whoever performed it, verifiable without a reference call.
- Re-test records showing findings were fixed and independently confirmed.
- Prepared answers on de-identification claims, reviewed with your privacy lead or counsel.
If you want a read on where you stand before you commit to anything, our free Pentest Readiness Assessment is seven questions and returns a scorecard with a tier rating and recommendations ordered by priority. You can save it as a PDF and bring it to your next internal planning conversation.
If you would rather see what an assessor-ready deliverable looks like first, request a sample report. Web Application, Internal Network, and Gamified Tabletop Exercise samples go out within one business hour.
When you are ready to talk scope, book a 30-minute consultation. Every EliteSec engagement since 2019 has been founder-led, so the person on that call walks you through a relevant sample report, gives you a clear scope with timelines, and leads the test itself.
