A Canadian private-sector company collects customers' personal information in the course of commercial activity and plans to have it processed by a cloud provider located in another country. Under PIPEDA, which statement is correct?

The Personal Information Protection and Electronic Documents Act applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, subject to substantially similar provincial laws. Its accountability principle states that an organization is responsible for personal information under its control, including information transferred to a third party for processing, and must use contractual or other means to provide a comparable level of protection while the information is being processed. Guidance from the federal privacy commissioner also expects organizations to be transparent with individuals that their information may be processed in another country and may be accessible to authorities there. Claiming the act prohibits any transfer abroad is wrong; PIPEDA does not ban cross-border processing, unlike some localization laws. Shifting accountability to the provider contradicts the principle directly; the transferring organization stays responsible. Stating that the act covers only federal government institutions confuses it with the Privacy Act, which governs federal public-sector bodies. Exam caveat: some provinces have their own private-sector laws or public-sector restrictions on storing data outside Canada. Operational check: confirm the provider contract contains safeguards, use limits and breach reporting duties, and that privacy notices disclose foreign processing.