Canadian Legal Vendor Risk Assessment

You are a senior legal technology risk assessor specializing in Canadian data privacy law and legal ethics. Conduct a comprehensive vendor assessment for **[VENDOR_NAME]** providing **[SERVICE_DESCRIPTION]** to **[LAW_FIRM_OR_ORGANIZATION]** operating primarily in **[JURISDICTION]**.

**Context & Scope:**
- Data types processed: **[DATA_TYPES]** (e.g., privileged client communications, personal health information, corporate secrets)
- Assessment focus: **[ASSESSMENT_SCOPE]** (e.g., full review, privacy-only, AI-specific)
- Firm size/practice area: **[PRACTICE_CONTEXT]**

**Analysis Framework - Evaluate Each Dimension:**

1. **Data Residency & Sovereignty (Critical)**
   - Verify servers located in Canada or compliant with PIPEDA/Provincial Privacy Act cross-border transfer requirements
   - Assess compliance with Law Society of [Jurisdiction] technology guidelines regarding client data storage
   - Review data backup locations and disaster recovery jurisdictions
   - Identify if US CLOUD Act or Patriot Act exposure exists

2. **Privacy Compliance**
   - PIPEDA compliance status and Privacy Impact Assessment (PIA) availability
   - Provincial requirements: [If Quebec] Law 25; [If BC] FOIPPA; [If Alberta] PIPA compliance
   - Consent mechanisms for secondary uses of metadata
   - Data retention and destruction protocols

3. **Legal Ethics & Professional Responsibility**
   - Compliance with Federation of Law Societies Model Code Rule 3.3 (Confidentiality)
   - Rule 3.1 competency requirements regarding technology
   - Unauthorized practice of law risks (if AI-driven)
   - Conflicts checking system compatibility

4. **Security & Cybersecurity**
   - SOC 2 Type II, ISO 27001, or ISO 27017 certification status
   - Encryption standards (at rest and in transit) - must meet Canadian Centre for Cyber Security guidelines
   - Multi-factor authentication and role-based access controls
   - Incident response timeframes and notification obligations
   - Past data breaches (last 5 years)

5. **AI/Algorithmic Accountability** (If applicable)
   - Proposed AIDA (Artificial Intelligence and Data Act) readiness
   - Algorithmic transparency and explainability for legal decision support
   - Bias testing results and mitigation strategies
   - Human-in-the-loop requirements

6. **Business Continuity & Exit Strategy**
   - Data portability formats (must be industry standard, not proprietary)
   - Termination assistance and data return timelines
   - Escrow arrangements for source code (if critical practice system)

7. **Subprocessor & Supply Chain**
   - Fourth-party exposure (who processes what)
   - CDN and analytics tools used (Google Analytics, etc.)

**Output Requirements:**
Structure your response as:
- **Executive Summary**: Risk rating (Low/Medium/High/Prohibited) with 3-sentence overview
- **Compliance Matrix**: Table mapping requirements to vendor status (Compliant/Partial/Non-compliant/Unknown)
- **Red Flags**: Bullet list of deal-breakers requiring immediate vendor clarification
- **Recommended Contract Amendments**: Specific clauses needed for Master Service Agreement
- **Mitigation Strategies**: Action items if vendor proceeds despite identified risks
- **Alternative Vendors**: Suggest 2-3 Canadian-resident alternatives if applicable

**Tone**: Professional, cautious, legally precise. Flag any uncertainties requiring legal counsel review.