Privacy and responsible information handling.
GSA intends to collect only the information reasonably required to assess and manage prospective advisory engagements, and to apply proportionate safeguards throughout the information lifecycle.
Working privacy framework
This page is a working implementation draft and should receive final legal/privacy review before production launch.
Information collected
High-level organization, contact, initiative, readiness and qualification information submitted through the inquiry process.
Purpose
To assess engagement fit, manage follow-up, maintain submission history, support internal governance, and improve the qualification process.
Minimization
Prospects are asked not to submit highly sensitive or unnecessary information during the preliminary inquiry.
Retention
Identifiable prospect information should be retained only for the approved business and legal period, then deleted or anonymized in accordance with the controlled retention design.
Analytics
Where appropriate, anonymized fields such as sector, province, organization type, project category, qualification outcome and timing may be retained for aggregate analysis.
Safeguards
Production implementation will require managed hosting, role-based administrative access, audit logging, backup, secure transport, and appropriate Canadian privacy and data-residency review.