Sending client photos to an editor outside Canada: PIPEDA and Law 25

A couple emails to ask where their photos are being edited. Or you are reading your own contract and realise it says nothing about who else sees the images. Or you work with clients in Quebec and someone mentioned Law 25. Underneath all of it is one question: am I allowed to send my couples’ photos to an editor outside Canada?

This post sets out what the rules ask of you, in plain English, and what we do on our side. It is not legal advice. Privacy law depends on your province, your clients and how your studio works, so treat this as a starting point for a conversation with your lawyer.

What the federal guidance says, in plain English

For most private-sector businesses outside Quebec, the federal law is PIPEDA. The Office of the Privacy Commissioner of Canada (OPC) published Guidelines for Processing Personal Data Across Borders in 2009, and they still stand. In 2019 the OPC proposed requiring consent for cross-border transfers, then dropped that proposal and reaffirmed the 2009 approach, as reported by Slaw at the time.

The 2009 guidelines come down to three ideas:

1. You stay accountable. When you send personal information to a third party to process for you, including one outside Canada, your organisation is still responsible for it (Principle 4.1.3).
2. Protect it by contract or other means. You should use a contract, or other means, to give the information a comparable level of protection while the third party has it.
3. Tell your clients. You should be open with clients that their information may be processed in another country and may be accessible to that country’s courts and authorities.

Wedding photos count. They show identifiable people: your couple, their families and their guests.

Quebec’s extra step: Law 25

If you have clients in Quebec, the rules are stricter. Quebec’s private-sector privacy act, as amended by Law 25, includes a section (s.17) on communicating personal information outside Quebec. As explained by law firms including BLG and McCarthy Tétrault, and by the CFIB for small businesses:

• A privacy impact assessment first. Before personal information is communicated outside Quebec, the business must carry out a privacy impact assessment.
• Only if protection is adequate. The transfer may go ahead only if the assessment shows the information would receive adequate protection.
• A written agreement. The transfer must be covered by a written agreement that takes the assessment into account.

These obligations have been in force since 22 September 2023. Quebec’s privacy regulator, the CAI, has published a guide to carrying out these assessments. If Quebec couples are a meaningful part of your work, this is the area to take to a lawyer first.

A line for your client contract and privacy notice

The simplest way to meet the “tell your clients” part is to say it plainly before the wedding, not after. Here is a starting point you can adapt with your lawyer:

We work with trusted editing partners, who may be located outside Canada, to help edit your photos and films. They work only on our instructions, keep your images confidential and don’t use them for any other purpose. Your images may be subject to the laws of the country where they are edited.

Put it in your contract and in your privacy notice, so it is there whichever one a couple reads. If a couple asks for their images to stay in Canada, you then know before the wedding and can plan for it.

How we work with your files

Here is what we can tell you about our side. It is the factual part you can point to in your own assessment.

• Your raws stay in your storage. You send a Dropbox, Google Drive, WeTransfer, pCloud or Box link. The originals stay there, under your account.
• Where the work happens. Our editing team is in Pakistan, so the files are accessed there. Project records and briefs are held with Supabase in the AWS us-east-1 region in the USA. Our data processing terms list every provider.
• Working copies are deleted. We download files to edit them, and delete our working copies once the project and its revisions are finished, unless you ask us to keep them.
• Only for your project. We don’t use your couples’ images for our portfolio or marketing without your written permission, and we don’t contact your clients.
• Couple requests go to you. If one of your couples contacts us about their images, we pass it to you and don’t reply to them ourselves.
• A signed agreement on request. If you need a signed data processing agreement, email us and we send one.

We don’t describe any of this as meeting the law on your behalf. Those obligations sit with your studio and depend on what you do as a whole. Our job is to give you accurate information about our part, in writing, so you can use it.

Questions to ask any editor

Whoever you outsource to, these questions are worth asking before you send a wedding:

1. Where is the team that will open the files, and where are the files stored?
2. Do you download the files, and when are your copies deleted?
3. Who on your team can see my projects?
4. Do you use client images in your own portfolio or marketing?
5. Will you sign a data processing agreement?
6. What happens if one of my clients contacts you directly?
7. Which other providers handle the files?

An editor who can answer all seven in writing makes your own assessment much easier.

It also helps to keep a short record on your side: which editor you used for which wedding, when you sent the link, and when the project was delivered. If a couple ever asks who saw their photos, or asks for something to be deleted, you can answer quickly and accurately instead of digging through old emails.

Practical habits that reduce what you send

The less personal information leaves your studio, the less there is to protect. A few habits make a difference without changing how you shoot:

• Send only what the edit needs. The raws and a brief. Contracts, invoices, home addresses and phone numbers don’t need to travel with the footage.
• Use first names in the brief, or “the bride’s grandmother”, rather than full names and contact details.
• Share a folder, not your whole drive. Make a project folder for each wedding and share that link only.
• Switch the link off after delivery. Once the gallery is back and approved, revoke the shared link or let the transfer expire.
• Flag anything sensitive. A guest who must not appear, a child whose parents asked for no photos online. Put it in the brief so it is handled on purpose, not by chance.

Not legal advice

Everything above is a plain-English summary of public guidance from the OPC and of how law firms and the CFIB describe Law 25. It is not legal advice and it may not cover your situation, for example if you are in a province with its own private-sector privacy law, or if you shoot for clients in health or other regulated settings. Talk to a lawyer about your contract wording and, for Quebec clients, about the privacy impact assessment.

Your next step

• Read our data processing terms, our confidentiality page and our privacy policy.
• When you are ready, send one wedding as your free trial. Your first Gallery project or Highlight film is free, with no card.
• Other questions are answered in the FAQ.

For how the hand-off works day to day, read how handoff works with an editing team in Pakistan.