Resources hubGuide
What to ask, what a good answer looks like and when to walk away, before client data reaches a vendor in the UK or Canada.
- Type
- Guide
- Deal stage
- Whole firm
- Use it
- Before any AI tool touches client material, and again when a vendor changes its terms.
- Who
- The partner responsible for the firm's data, with outside counsel.
This guide is not legal advice. It summarises what we checked against the linked sources on 1 November 2026, and these rules change. Take your own advice on your firm, your NDAs and your engagement letters.
Send the questions in writing, and keep the answers
A deal team is bound twice. Privacy law covers the personal data in the file: directors, shareholders, employees. NDAs and engagement letters cover everything else, including the fact that a company is for sale at all. A vendor can satisfy the first and still put you in breach of the second.
So the useful question is not whether a product is compliant. It is whether you could tell a client exactly where their information went, who could see it and when it was deleted.
1Before any trial
Partner
Decides which classes of material the tool may touch, and sends the questions in writing.
2During evaluation
Vendor
Answers in writing, from someone who can bind the company.
3Before signing
Partner and counsel
Score the answers, put the green ones into the contract and decide on any amber.
4At signing
Partner
Records the decision, the data classes approved and who approved them.
5When anything changes
Partner
Looks again if the vendor changes its terms, its owner or its sub-processors.
Follow one page out of your firm before you assess anything
Most vendors are a chain of companies, not one. Draw the chain for the tool in front of you before reading a single answer. Canada's privacy regulator now recommends exactly this: map how personal information flows, including through subcontractors.
Exhibit 1
One uploaded page can reach four other companies, and your duties follow it to each one
Sample chain for a typical AI tool. Your vendor's chain may be shorter or longer, so ask it to draw its own.
Starts here
Your firm
The document, under your NDA
Is this material allowed to leave at all?
Company 1
AI vendor
The upload, and what comes back
Used for training? Who can read it?
Company 2
Cloud host
Storage, backups and logs
Which countries? For how long?
Company 3
AI provider
The text sent for processing
Under whose contract? Kept at all?
Company 4
Support firm
Access when a ticket is raised
Logged, and limited in time?
NDA and engagement letter: follow the information to every company in the chain
Privacy law (1): your firm stays accountable for personal data at every link
(1) Personal data only. The rules on third parties and transfers differ by country, as set out below.
Source: Verdalyze sample. Mapping flows follows the OPC's guidance on assessing third-party providers.
Five questions decide whether material can go in at all
Run this before comparing vendors. The answer depends on the material as much as on the tool, so the same vendor can be fine for one job and closed for another.
Exhibit 2
Client material goes in only after five answers, and two of them stop the process outright
Decision flow for one tool and one class of material. Run it again if either changes.
- 1
Is it only public information or the firm's own material?
Yes
Go. Use it under your normal policy. The rest of this flow is for client material.
No
- 2
Do the NDA and the engagement letter allow this service provider?
No
Stop. Keep it out, or get the client's written consent first.
Yes
- 3
Is a signed contract in place that rules out training and sets retention and deletion?
No
Stop. Nothing goes in until it is signed.
Yes
- 4
If personal data leaves the UK, Canada or Quebec, is the transfer covered and assessed?
No
Hold. Finish the assessment and put the mechanism in place, then come back.
Yes
- 5
Do permissions follow your deal teams, with logs you can read?
No
Hold. Limit it to one deal team, or wait until it can wall them off.
Yes
Go. Approved for the classes of material you named. Record who decided, and what would reopen the decision.
Note: Green, amber and red mark go, hold and stop. These are working gates, not a legal test.
Source: Verdalyze.
Read your own paper before you send anything
Your own documents decide most of this, so read them first.
- Your NDA. Check who counts as a permitted recipient. If disclosure is limited to named advisers and representatives, a software vendor may fall outside the wording.
- Your engagement letter. Check what it says about subcontractors and service providers, and whether the client must be told or must agree.
- What will go in. Public information, the firm's own material, client confidential documents and data room content carry different risks. Decide which of them the tool may touch before you compare answers.
Twelve questions, with good and bad answers side by side
The wording below is sample wording written for this guide, not taken from any vendor. Green goes into the contract. Amber is a conversation: push until it turns green, or accept it knowingly. Red ends the review if it sits on one of your red lines.
Where the data goes
1In which countries is our data stored and processed, including backups and support access?
You cannot tell a client where their data went, or assess a transfer, without this.
Good
Stored and processed in the UK, with backups in the UK. Support comes from Canada and every access is logged. The region is fixed in your order form.
Push back
Stored in the UK. Processing may use other regions at peak. We can tell you which on request.
Walk away
We run on global infrastructure to give you the best performance.
2Which other companies handle our data, and how will we hear about changes?
Each one extends the chain you answer for.
Good
Here is the list, with each company's role and location. We give notice before any change, and you can object.
Push back
The list is on our website, and we update it when things change.
Walk away
We work with trusted partners, and we do not disclose them.
What the vendor does with it
3Is anything we type, upload or generate used to train or improve any product, yours or anyone else's?
Content used this way cannot be recalled, and it may breach your NDA whatever the privacy position.
Good
No. The contract for your plan says we do not use your content to train or improve any product, ours or a provider's.
Push back
Not by default. There is a setting for it and our policy says so, but it is not in the contract.
Walk away
We may use aggregated, de-identified data to improve our services.
4Who at the vendor or its providers can read our content, and when?
A vendor's staff sit outside your NDA unless the contract brings them in.
Good
Nobody by default. Access needs your approval, is limited in time and appears in your log.
Push back
Support staff can open content to fix a ticket. It is logged on our side.
Walk away
Our team may review content to keep quality and safety high.
5How long is each kind of data kept, including logs and backups?
Data you have deleted can live on in logs and backups, and a client may ask.
Good
Each data type has a stated period in the contract, and you control the setting for your content.
Push back
A standard period applies. Tell us if you need something different.
Walk away
We keep data for as long as necessary to provide the service.
Who can see it inside your firm
Walls between deal teams matter as much as walls between you and the vendor. In a survey of 400 deal professionals run for Intralinks, which sells data rooms, M&A advisers and investment banks reported the most access-control lapses: 60%, against 48% overall, on a sample of 80. See our deal technology benchmark.
6Can one deal team's material be walled off from another's?
A conflict wall that stops at the tool is not a wall.
Good
Permissions follow your deal teams. Someone outside a project cannot reach its documents through search or the assistant.
Push back
Workspaces separate content, but administrators and shared indexes can see across them.
Walk away
It works best when it can see everything. Finer permissions are on our roadmap.
7Can you show us who saw what, and when?
After a leak, the log is the only way to show what happened.
Good
Yes, by user, document and time. You can export it and keep it for as long as you need.
Push back
Logs exist, and we can supply an extract on request.
Walk away
We do not expose usage logs to customers.
When something goes wrong
8How quickly will you tell us about a breach, and what will you tell us?
Your own duties to clients and regulators start from the vendor's notice.
Good
We notify you in writing without undue delay, with what happened, which data and what we are doing.
Push back
We notify you promptly once our investigation has finished.
Walk away
We will tell you if the law requires us to.
9What liability do you accept for a breach of confidentiality?
The cap decides who carries the loss if a client's sale leaks.
Good
Data and confidentiality claims have their own higher cap, backed by insurance. The certificate is attached.
Push back
The general cap applies, and we can discuss an uplift.
Walk away
Data claims are excluded from our liability.
10Which independent reports can we read?
A badge says nothing about the product you are buying, and scope differs by plan.
Good
Here is our current SOC 2 Type II report and ISO 27001 certificate. Both cover this product and your plan.
Push back
We are certified at company level. Scope for this product is in progress.
Walk away
We follow industry best practice. See the badge on our website.
When you leave
Deal software changes hands often. Datasite alone made five acquisitions in about 21 months, per our deal technology benchmark, so ask about the exit before you need one.
11When we leave, what happens to our data, and how will we know?
The end of the contract is when deletion promises get tested.
Good
Export in a standard format, deletion by a stated date including backups and sub-processors, and written confirmation.
Push back
We delete on request under our standard process, and backups expire in time.
Walk away
Data goes on our normal schedule. Anything derived from it stays with us.
12What happens if you are sold, or stop trading?
A new owner can bring new terms, and a failed vendor can strand your data.
Good
You get notice of a change of control, a right to leave and a way to recover your data if the service ends.
Push back
The contract carries over to any new owner, and we would let you know.
Walk away
We may assign the contract to any party without notice.
Score vendors on red lines, not on averages
An average hides the answer that matters. Pick your red lines before the answers arrive, and let any red on one of those rows end the review, however well the vendor scores elsewhere.
Exhibit 3
Vendor B scores highest at 21 of 24 and still fails, because one red sits on a red line
Sample scorecard across the twelve questions above. Green scores 2, amber 1 and red 0.
| Question | AVendor A | BVendor B | CVendor C |
|---|---|---|---|
| 1. In which countries is our data stored and processed, including backups and support access? (1) | G Green | G Green | A Amber |
| 2. Which other companies handle our data, and how will we hear about changes? | A Amber | G Green | R Red |
| 3. Is anything we type, upload or generate used to train or improve any product, yours or anyone else's? (1) | G Green | R Red | A Amber |
| 4. Who at the vendor or its providers can read our content, and when? (1) | G Green | G Green | R Red |
| 5. How long is each kind of data kept, including logs and backups? | A Amber | G Green | A Amber |
| 6. Can one deal team's material be walled off from another's? | G Green | G Green | A Amber |
| 7. Can you show us who saw what, and when? | A Amber | G Green | R Red |
| 8. How quickly will you tell us about a breach, and what will you tell us? | G Green | G Green | A Amber |
| 9. What liability do you accept for a breach of confidentiality? | A Amber | G Green | R Red |
| 10. Which independent reports can we read? | G Green | G Green | A Amber |
| 11. When we leave, what happens to our data, and how will we know? (1) | G Green | A Amber | R Red |
| 12. What happens if you are sold, or stop trading? | A Amber | G Green | R Red |
| Score, of 24 | 19 | 21 | 6 |
| Green, amber, red | 7, 5, 0 | 10, 1, 1 | 0, 6, 6 |
| Result | PassProceed, close the ambers | FailFails on a red line | FailFails on a red line |
(1) Red lines in this sample: data location, training, staff access and deletion. Set your own before the answers arrive.
Source: Sample data. Project Harbour and every company, customer and vendor shown are invented. Scores are computed from the grid.
What the UK rules ask for
- A written contract. When your firm uses a processor, there must be a written contract. It covers acting only on your documented instructions, confidentiality, security, sub-processors, help with individuals' rights and breaches, deletion or return at the end, and audits. ICO on contracts.
- Sub-processors. The vendor needs your prior authorisation. Under a general authorisation it must tell you of intended changes and give you the chance to object. ICO on required terms.
- Transfers abroad. Sending personal data to a separate organisation outside the UK, or making it accessible there, can be a restricted transfer. It needs UK adequacy regulations, a safeguard such as the ICO's IDTA or Addendum with a transfer risk assessment, or an exception. ICO on transfers.
- An impact assessment. The ICO says that in the vast majority of cases the use of AI will involve processing likely to result in a high risk, which triggers a data protection impact assessment. If you decide yours does not, you still document how you decided. ICO on AI.
What the Canadian rules ask for
- Accountability stays with you. Under PIPEDA Principle 4.1.3, your firm remains responsible for personal information transferred to a third party for processing, and must use contractual or other means to provide comparable protection. OPC on third parties.
- Transfers abroad. PIPEDA does not prohibit them, but the regulator says to assess the risks when a provider operates outside Canada. OPC on cross-border processing.
- Assess before you sign. Guidance the OPC issued in September 2026 says to assess a provider before using it, map the data flows and name subcontractors in writing. If a provider wants personal information for its own purposes, such as training an algorithm, you assess whether consent is required. The OPC is taking comments until 4 December 2026, so this may change. OPC guidance.
- Provinces. Alberta, British Columbia and Quebec have their own private-sector privacy laws. PIPEDA still applies to personal information transferred across borders. OPC on provincial laws.
- Quebec. Before personal information is communicated outside Quebec, a privacy impact assessment is required, and the communication needs a written agreement that reflects it. A service provider contract must cover confidentiality, use only for the mandate, no retention afterwards, notice of breaches to your privacy officer without delay, and your right to verify. Quebec's private sector act, BLG's summary.
- Not yet law. Bill C-36, tabled on 15 June 2026, would replace the privacy provisions of PIPEDA with a new Act and require a privacy impact assessment before personal information goes outside Canada. It was at second reading when we checked, so confirm its status. LEGISinfo, Blakes' summary.
What to keep on file
- The vendor's written answers, dated, from someone who can bind it.
- The signed contract, the data terms and the sub-processor list as at signing.
- Your impact assessment and, for any transfer abroad, the mechanism you rely on.
- One line recording which classes of data the tool may touch, and who approved it.
- A trigger to look again when the vendor changes its terms, its owner or its sub-processors.
How good firms still get this wrong
| The mistake | What it costs | Do this instead |
|---|---|---|
| Accepting a security page instead of answers. | A marketing page binds nobody, and it does not cover your plan. | Get written answers, then put the ones that matter into the contract. |
| Testing with live client material. | The data has gone before the review has started. | Trial on public or firm-owned material until the contract is signed. |
| Reading the privacy policy, not the contract. | A policy can change without your agreement. | Move every commitment you rely on into the signed terms. |
| Assessing the vendor but not the plan. | Terms often differ by plan, so the promise you read may not be the one you bought. | Ask each question about the exact plan on your order form. |
| Treating approval as permanent. | New sub-processors or a new owner change the answers you relied on. | Set a trigger to review when terms, owner or sub-processors change. |