For new customers, additional consent specifically for the use of cloud services providers is likely not required. It would be sufficient in most cases to provide the necessary disclosures within an applicable privacy policy relating to the use of third-party service providers located outside Canada (if applicable).

For existing customers, if the information is being used for the purpose it was originally collected, consent is not required. However, before transferring personal information to cloud service providers overseas, organizations need to inform the data subject that their personal information may be processed in a country outside of Canada.