Canada — PIPEDA (federal fair-information principles)
What it asks of employers
- Tell candidates what you collect and get valid consent. When you collect a candidate's data (or before), tell them why you're collecting it and their rights to see it, correct it, and withdraw consent — and get consent that is clear, freely given, and informed for each purpose.
- Name someone accountable for protecting personal information. Designate an individual who is accountable for your organization's compliance with the fair-information principles, and make that person's contact available to candidates who have questions or complaints about how their data is handled.
- Report data breaches to regulators and candidates. If candidate information is lost, or someone accesses, uses, or shares it without permission, and there's a risk of serious harm, promptly notify the regulator and the affected candidates, and keep a log of these incidents.
- Stay accountable when candidate data is processed outside Canada. Using cloud software means candidate data may be processed outside Canada. You remain accountable for it — ensure a comparable level of protection through your contract with the processor, and tell candidates their data may be processed in another country. Amp processes data on your behalf under those terms.
What Amp does
- Amp keeps candidate records only as long as your policy allows. Amp holds each candidate's information only for the time limit your organization sets, then deletes it, so nothing is kept past the purpose it was collected for.
- Amp answers candidate requests to see their data. When a candidate asks to see the personal information Amp holds about them, Amp produces it through the Privacy Console, including the details the candidate first provided, in a structured, widely used format.
- Amp deletes candidate information when required. When a candidate's information must be destroyed — because they asked or because it's no longer needed — Amp removes it through its deletion process.