Sirix operates from Quebec, serves customers across Canada and the United States, and uses teams in multiple locations. That means our work can be affected by privacy laws, contractual obligations, customer security requirements, and cross-border data handling rules.

This lesson is not legal advice. It is a practical overview of what employees need to understand in day-to-day work.

• Privacy: personal information must be handled appropriately and only for authorized purposes.
• Security safeguards: companies must protect systems and data with reasonable controls.
• Access control: only authorized people should access customer environments or sensitive information.
• Breach and incident handling: some incidents may need to be escalated, documented, or reported externally.
• Cross-border processing: using teams or service providers in other countries does not remove responsibility for protecting data.
• Contracts and audits: customer agreements may impose security, confidentiality, logging, and reporting obligations beyond baseline law.

1. Use data only for approved work purposes.
2. Access only what your role requires.
3. Use approved systems, storage, and communication channels.
4. Verify before sharing customer or employee information.
5. Escalate privacy or security incidents immediately.
6. Do not make legal judgments yourself. Report facts and let Security, Privacy, Legal, or leadership assess the obligations.

Just because work is done in another region does not mean responsibility moves there. If Sirix or its teams handle personal information across borders, the company still needs appropriate controls, approved processes, and oversight.

• Do not move data to unapproved tools or personal accounts.
• Do not assume a shortcut is acceptable because a team is remote.
• Follow the company’s approved process for access, sharing, escalation, and vendor/tool use.

Some privacy and security incidents may trigger formal response requirements, including investigation, documentation, customer notification, or regulatory reporting.

That is why employees should report quickly, preserve evidence, and avoid trying to decide alone whether an issue is “serious enough.”

• Do not promise customers that “no legal issue exists.”
• Do not send sensitive information through personal or unapproved channels.
• Do not delay reporting because you are still gathering details.
• Do not discuss incidents broadly beyond need-to-know.
• Do not assume another team already reported the issue.

Legal and regulatory requirements turn security into a formal obligation. Follow approved processes, protect personal information, escalate incidents quickly, and never assume cross-border work removes accountability.