Sample privacy impact assessment: an accounting firm moves to Microsoft 365

Example Accounting, a firm of 12 people, is moving its email, calendars and client files from a server located in its office to Microsoft 365, specifically Exchange Online, SharePoint and Teams. The project involves acquiring an information system. It is being undertaken because the existing file server is reaching the end of its life, because the firm wants to allow its staff to work remotely, and because it wants to be able to share documents with its clients. The information concerned will not be used for any new purpose. It will continue to serve the same purposes for which it is already held.

This assessment covers the personal information involved in the migration and in the ongoing use of Microsoft 365. That information comprises clients' tax returns and supporting documents, their social insurance numbers and banking details, email exchanged with clients, and employees' email and calendars. It also covers the two parties that take part in the project: Microsoft, as the hosting provider, and an IT consultant, who is carrying out the migration and will manage the account. The number of persons concerned is between 100 and 10,000. The assessment is limited to the project described here and does not extend to other systems or activities of Example Accounting.

The personal information in this project is already held by Example Accounting. Clients provided it for the preparation of their tax returns, and the rest was generated through the firm's correspondence and daily operations. The information about clients includes tax returns and supporting documents, social insurance numbers, banking details and email exchanged with the firm. The information about staff consists of their email and calendars. According to the information available, the persons concerned have not been informed of the move to Microsoft 365.

During the migration, the IT consultant, based in Laval, Québec, transfers the email, calendars and client files from the office server to Microsoft 365. The consultant will then continue to manage the account, which gives the consultant access to the environment where the information is stored. There is no written contract with the consultant. Once migrated, the information is hosted in the cloud by Microsoft in Exchange Online, SharePoint and Teams, under a written agreement. The Microsoft 365 account was opened in Canada. However, the province in which the data is stored has not been verified, and it remains to be confirmed whether Microsoft technical support can access the information from outside Canada. The processing location therefore remains to be confirmed.

Within Example Accounting, access to the information is limited to the staff members who need it for their work. No decision about any person is made exclusively through automated processing. No retention period has been defined for the migrated information, so how long it will be kept in Microsoft 365 remains to be determined. The main output of the system is the sharing of documents with clients through the platform, which is one of the stated purposes of the project.

This assessment brought to light four findings. The location where Microsoft processes the information is not known. No retention period has been defined. There is no written contract with the IT consultant who performs the migration and manages the account. The persons concerned have not been informed of the change. Three risks were identified, each of medium severity. The first is that the information could be processed outside Québec without adequate protection, which is considered unlikely. The second is unauthorised access to the information, also considered unlikely. The third is that the information could be retained longer than necessary, which is considered highly likely given that no retention period is in place. These risks carry particular weight because the files include clients' social insurance numbers, banking details and tax returns.

Some points remain to be confirmed: the province in which Microsoft stores the data, and whether Microsoft technical support can access it from outside Canada. Example Accounting adopts the three measures set out in this document to address the findings and risks identified. Sophie Example can be contacted about any question concerning this assessment.