Grasslands Public Schools Policy Handbook Grasslands Public Schools
Sign in
Home
Administrative Procedure

AP-322 — Third-Party and Vendor Risk Management

Section Three: General School Administration
Effective Date: August 25, 2026 Last Reviewed: August 25, 2026

Background

Grasslands Public Schools relies on third-party vendors to provide technology systems, cloud services, and other products that support educational programs and Division operations. Many of these vendors store, process, or have access to personal information (including personal information of minors) protected under the Protection of Privacy Act (POPA).

This Administrative Procedure establishes the framework for assessing, managing, and monitoring the risks associated with third-party vendor relationships. It ensures that vendor engagements involving Division data meet the Division's privacy, security, and legislative compliance requirements, and that contractual protections are in place before personal information is entrusted to any external party.

The operational detail that puts this procedure into practice — the evaluation criteria for each assessment level, reassessment intervals, the vendor inventory, and the decommissioning workflow — is set out in IM-007 – Technology Vendor Management Procedures.

Scope

This procedure applies to all third-party relationships where a vendor stores, processes, transmits, or has access to Division data, including:

This procedure applies regardless of whether the vendor relationship involves a formal contract, a free service, or a trial arrangement. If a vendor will have access to Division data, the requirements of this procedure apply.

This procedure does not apply to purely internal operations or to vendors providing goods or services that do not involve access to Division data (for example, office supplies, building maintenance without system access).

Definitions

Terms not defined in this procedure have the meanings assigned in Policy 310 – Information Security Charter and Policy 311 – Privacy and Access to Information.

Control: The Division's authority to obtain, manage, direct the use of, and dispose of personal information, regardless of which party has physical custody of it.

Custody: Physical possession of personal information by a vendor on the Division's behalf, distinct from control.

Data Processing Agreement (DPA): A contractual provision or standalone agreement that specifies how a vendor will process, protect, and handle personal information on behalf of the Division.

High-Sensitivity Personal Information: Personal information deemed to be of high sensitivity under the Protection of Privacy (Ministerial) Regulation s. 1: biometric information, financial information, and personal information respecting a minor, senior, or vulnerable individual.

Service Provider: A vendor that collects, uses, stores, or has access to personal information on behalf of the Division under a contract or agency relationship. Under POPA s. 1(1)(h), a service provider is an employee of the Division for the purposes of that Act.

Sub-Processor: A third party engaged by a vendor to assist in processing Division data. Sub-processors must meet the same contractual and security requirements as the primary vendor.

Vendor: Any external organization or individual that provides products or services involving access to Division data or systems.

Vendor Risk Assessment: A structured evaluation of the risks associated with a vendor relationship, considering the type and sensitivity of data involved, the vendor's security posture, and the vendor's compliance with applicable legislation.

Responsibilities

Director of Technology

Access and Privacy Coordinator

System Owners (as defined in A.P. 312)

Senior Administration

Board of Education

Procedures

1. Vendor assessment requirements

The depth of vendor risk assessment and the contractual requirements that apply are determined by the sensitivity of the Division data the vendor will handle, not by the system's classification under A.P. 312. The system's classification governs the acquisition and approval path under A.P. 312; this procedure governs the assessment of vendor risk.

  1. Where a vendor will handle Division data but no personal information, a streamlined assessment applies.
  2. Where a vendor will handle personal information, a full vendor risk assessment applies. Whether a Privacy Impact Assessment is required for the system is determined under A.P. 312 – Technology Acquisition and Use and A.P. 323 – Privacy Management Section 9. Where a Privacy Impact Assessment is conducted, the vendor risk assessment is conducted as part of it under A.P. 323 and IM-008. Where no Privacy Impact Assessment is conducted, the vendor risk assessment is completed on its own under this procedure.
  3. Where a vendor will handle High-Sensitivity Personal Information, the assessment additionally requires independent third-party assurance under §2, and a Privacy Impact Assessment is required and submitted to the Office of the Information and Privacy Commissioner.
  4. The Director of Technology may require a deeper assessment than the data sensitivity would otherwise indicate where the vendor will process Restricted or Confidential information under A.P. 313, or where circumstances otherwise warrant.
  5. The Access and Privacy Coordinator shall review all vendor assessments involving personal information, particularly where the vendor processes High-Sensitivity Personal Information.

2. Vendor risk assessment

  1. The depth of each assessment follows the data sensitivity per §1. The evaluation criteria for each level of assessment are set out in IM-007 – Technology Vendor Management Procedures.
  2. Independent third-party assurance (a SOC 2 Type II report, ISO 27001 certificate, or equivalent) is required where a vendor will handle High-Sensitivity Personal Information and recommended for other vendors that handle personal information. Where such assurance is unavailable, the Director of Technology shall document the compensating controls or risk-acceptance rationale, and the exception shall be approved through the system's approval authority under A.P. 312.
  3. Where a system requires Board approval under A.P. 312, the vendor risk assessment shall be included in the comprehensive risk assessment presented to the Board of Education.

3. Required contract provisions

The following provisions apply to all contracts where a vendor will handle personal information on behalf of the Division. A vendor that handles Division data but no personal information requires only the streamlined assessment under §2 and review of standard terms of service.

Together, these provisions form the Division's standard for demonstrating, in a Privacy Impact Assessment, that a vendor contract addresses the Division's duties under POPA and that the Division retains control of the personal information involved.

a. Division control of personal information

  1. A vendor that handles personal information on behalf of the Division does so as a service provider. Under POPA, a service provider engaged under contract is an employee of the Division (POPA s. 1(1)(h)); providing personal information to the vendor is therefore an authorized internal use rather than a disclosure to a third party (POPA s. 13(1)(g)). Because the personal information remains under the Division's control, the Division's duty to protect it under POPA s. 10(1) continues to apply while the vendor holds it.
  2. The contract shall provide that the Division retains control of all personal information in the vendor's custody. Specifically, the contract shall establish that:
    1. the Division remains entitled to the personal information at all times;
    2. the vendor processes the personal information only on the Division's instructions and only for the contracted purposes;
    3. the vendor acquires no ownership of, or independent right to use, the personal information or any data derived from it, including analytics outputs and data used to develop or train artificial intelligence models; and
    4. the vendor complies with the Division's directions for the retention, return, and deletion of the personal information.

b. Purpose limitation

  1. The vendor shall process Division data only for the purposes specified in the agreement and shall not use Division data for the vendor's own purposes, including product development, analytics, advertising, or training of AI models, unless explicitly authorized by the Division.

c. Breach notification

  1. The vendor shall notify the Division of any security incident or privacy breach affecting Division data without unreasonable delay and in no case later than 72 hours after discovery.
  2. The vendor's breach notification shall include the nature of the incident, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the incident.

d. Sub-processor restrictions

  1. The vendor shall not engage sub-processors to process Division data without prior written notification to the Division.
  2. Where a vendor handles High-Sensitivity Personal Information, prior written approval from the Division is required before engaging new sub-processors.
  3. The vendor shall ensure that sub-processors are bound by contractual obligations equivalent to those in the vendor's agreement with the Division.

e. Data location

  1. The vendor shall identify all jurisdictions where Division data will be stored, processed, or accessible.
  2. Where Division data will be stored or processed outside Canada, the vendor shall disclose this at the time of assessment, and the Division shall ensure affected individuals are notified as required by POPA.

f. Verification of compliance

  1. The Division shall have the right to obtain evidence of the vendor's compliance with the contractual data protection obligations, including current SOC 2 Type II reports, ISO 27001 certificates, or equivalent independent third-party assurance, on request.
  2. Where a vendor handles High-Sensitivity Personal Information, or where independent third-party assurance is unavailable, the contract should provide the Division the right to audit, or have audited by an independent third party, the vendor's compliance with its data protection obligations.

g. Return and destruction of data

  1. Upon contract termination, the vendor shall return all Division data in a usable format and securely destroy all copies within a specified timeframe, providing written certification of destruction.
  2. The Division shall have the right to verify data destruction.

h. Additional provisions for high-sensitivity engagements

  1. Contracts for vendors that handle High-Sensitivity Personal Information shall also include:
    1. Data processing agreement or equivalent privacy schedule.
    2. Service level agreements for system availability.
    3. Right to terminate for material security breach.
    4. Cyber and privacy liability insurance coverage appropriate to the risk.
    5. Compliance with the Division's data classification requirements under A.P. 313.
  2. Other contracts involving personal information should include cyber and privacy liability insurance where commercially reasonable.

4. Ongoing monitoring

  1. A vendor shall be reassessed whenever a Privacy Impact Assessment is triggered for the system under A.P. 312 and IM-008, and whenever the vendor materially changes its privacy policy or terms of service. System Owners are responsible for monitoring their vendors for such changes and notifying the Director of Technology.
  2. Upon notification of a material change, the Director of Technology shall determine whether a reassessment is required and whether the vendor relationship should continue.
  3. Vendor security incidents shall be handled in accordance with A.P. 321 – Information Security Incident Response, §4 (Vendor Security Incidents).

5. Decommissioning

  1. When a vendor relationship that involved personal information is terminated, the System Owner (as defined in A.P. 312) shall ensure that all Division data is returned in a usable format or securely destroyed with written certification, that all vendor access to Division systems is revoked, and that the decommissioning is documented and retained in the vendor file. The decommissioning steps are set out in IM-007.

Review

This procedure shall be reviewed every three years by the Director of Technology, or earlier if triggered by:

Cross reference

Legal reference