Your customer communications are critical touchpoints that must meet compliance standards. Every message to customers reflects that regulatory responsibility.
That's why working with a vendor who is governed by the same regulations is crucial. When partnering with a third party, you need a vendor who understands the complexity of your compliance requirements and the importance of handling your data securely.
There are several crucial compliance frameworks your communications vendor must follow. We'll talk about two of them: the Office of the Superintendent of Financial Institutions (OSFI) Act and Canadian and foreign privacy regulations.
OSFI
As the main regulator in Canada supervising financial institutions and pension plans, OSFI sets expectations for operating within the Canadian financial system.
Regulated organizations benefit significantly from using regulated vendors because they help ensure mutual compliance, reduce risk, build trust and strengthen reputation.
What Computershare does
At Computershare, compliance is the foundation of everything we do. Our enterprise-wide regulatory compliance framework aligned with OSFI standards enables us to combine deep market knowledge with expertise in regulatory communications. Our approach provides:
Corporate governance, with OSFI guidelines embedded into our policies, underpinned by an organizational structure including independent oversight.
Operational risk and resilience processes are in place to assess critical operations, implement effective controls, define impact tolerances, test, and monitor to ensure we're providing a stable environment to support our clients and their customers.
Third-party risk is managed by dedicated resources to ensure appropriate levels of due diligence, contractual controls, and monitoring are applied consistently across the global organization.
Integrity and security policies and controls promote an ethical culture, manage conflicts of interest, and enable proactive threat detection, monitoring, and reporting.
Privacy
Canadian Privacy Legislation
PIPEDA and similar private sector privacy legislation currently in force in the provinces of Quebec, Alberta, and British Columbia (the “Acts”) require organizations to protect individuals' personal information and establish ground rules for how private sector organizations collect, use, and disclose personal information as they carry out for-profit, commercial activities across Canada. Additionally, PIPEDA applies to the personal information of employees who work for federally regulated businesses.
Privacy regulations outside of Canada
Privacy laws and regulations from other jurisdictions, including California Consumer Privacy Act (CCPA) and the European Union's General Data Protection Regulation (GDPR), may also apply in certain circumstances, where the privacy law has extra-territorial scope. The GDPR affects companies located in the European Union (EU) or European Economic Area (EEA) that process personal information and any non-EU/EEA companies that process personal information about individuals who normally reside in the EU/EEA in connection with the goods or services offered or monitoring individuals' behaviour in the EU/EEA.
When it comes to your customer communications, you should expect your vendor to be aware of these laws, understand and comply with them, which in turn helps your organization maintain compliance. If you do business outside of Canada, and or have customers who reside outside Canadian boarders you could be bound by these rules.
The fines for non-compliance could be up to €20 million, although that doesn't measure the cost of the damage to your reputation.
What Computershare does
At Computershare we understand that data doesn't stop at borders—and neither do privacy laws. That's why we have dedicated teams and partner with vendors to actively monitor and comply with relevant privacy regulations in Canada and abroad, including GDPR in Europe, CCPA in the U.S., and other emerging frameworks.
Protecting your privacy and the confidentiality of your personal information is important to us and is a fundamental part of our day-to-day business operations. We've implemented controls that include:
Canadian data centres to maintain data sovereignty
Data encryption
Role-based access controls
Policies and training
Incident response plans
Independent audits
Crucial compliance frameworks your communications vendor must follow: Information security and quality management standards
Computershare: the experienced vendor companies trust
Our deep knowledge of the Canadian regulatory landscape as well as our reputation for regulatory compliance makes us a top choice for customer communications outsourcing. We treat your data like it's our own to give you confidence in every communication. To learn how our data security practices protect your customers, contact us today.