If the person guarding your data gets it wrong, Alberta's law makes their compliance your responsibility. That matters more than it might seem, because a great deal of Canadian security work is done by someone outside the business. Statistics Canada reported that only half of Canadian businesses had cyber security employees in 2023. Among those without them, the most common reason was that they used consultants or contractors to monitor cyber security instead.
The accountability stays with you
Section 5, subsection 2, of Alberta's Personal Information Protection Act is direct about it: "For the purposes of this Act, where an organization engages the services of a person, whether as an agent, by contract or otherwise, the organization is, with respect to those services, responsible for that person's compliance with this Act." You can outsource the work. You cannot outsource the accountability.
That leaves an owner who is not a security specialist with a practical problem. How do you tell whether the person guarding your data knows what they are doing? Not with a technical question whose answer you would struggle to judge. With five things that either exist or don't.
Five documents that either exist or don't
The first is a written scope: what they protect, what they don't, and who owns hardening, detection and incident response. Joint guidance from Canada's Cyber Centre and its counterparts in the UK, the US, Australia and New Zealand says contracts between managed service providers and their customers should transparently identify who owns which security roles and responsibilities, and that providers should explain the services a customer is not buying as well as the ones it is.
The second is a set of rules of engagement for any security test they have run. NIST's guide to security testing treats them as part of planning, and its template calls for the test team leader and the organization's senior management to sign them, stating that they understand the test's scope and boundaries. If nothing was agreed and signed first, it wasn't a test in that sense.
The third is a report written for you. The same NIST guide notes that a report may have more than one audience and may need more than one format to serve them. Yours should name each finding, what fixes it and who owns the fix. The same finding appearing quarter after quarter is a signal in itself.
The fourth is an incident plan with your name in it. The Cyber Centre's guidance for consumers of managed services tells buyers to request a walkthrough of the provider's incident response process and to ask how the provider will notify them when an incident affects their data. The joint guidance adds that contracts should say how and when that notification happens. The Cyber Centre also warns that a request for an immediate response may sit in the provider's queue while they support many other organizations with critical issues of their own.
The fifth is evidence of a restore. Not a backup policy, but the date of the last restore test, how long it took and who ran it. The Cyber Centre's guidance asks whether the provider is willing to actively participate in your disaster recovery testing. A yes that nobody has exercised is a promise, not a plan.
What an amateur sounds like
The sign of an amateur isn't a missing certification. It's an answer that is an adjective instead of a document: "we've got it covered." A competent provider is relieved to be asked, and nobody is humiliated.
The practical step is small. Send the five requests in one email. Each answer is either a dated document or it is a no. File the answers where your insurer and your lawyer will look for them later.
This is not legal advice. Breach obligations depend on your jurisdiction, sector and facts, so get counsel. Alberta's PIPA is under review: a legislative committee completed its review with 12 recommendations in February 2025, and the province has since consulted publicly on potential updates.