Protecting Concordia data starts with the right tools

Cybersecurity incidents at Canadian universities and colleges, including the 2026 Canvas breach, are a reminder of how quickly personal information can be exposed when safeguards fail. At Concordia, protecting that information starts with a simple habit: using the right tools.

Everyday choices can create real risk

Protecting our data and personal information is both a legal obligation and a shared responsibility. It involves more than just multi-factor authentication, passwords, firewalls, and other security systems. It also involves risky day-to-day interactions and accidental human errors, which cause more than 60% of data breaches. Sending an email with personal information in it to the wrong recipient is a good example of a privacy incident, and using a shadow AI tool creates similar risk.

Shadow tech and shadow AI are terms to describe tools that employees use on their own, without review by IITS or the privacy protections the university requires. An example of using shadow AI would be to use free AI transcription tool to summarize a meeting that includes student information.

Why approved tools matter

As a public body, we are required to enter into specific contractual agreements whenever our tools use, store, communicate or otherwise involve the personal information of our community, specifically any tool where such data is stored on a third party’s cloud infrastructure. Entering into proper contractual agreements helps to ensure that when a breach occurs with the third party, they are legally obligated to report it to us and involve us in the reporting process.

Tools that have been vetted have also gone through a privacy impact assessment (PIA), as well as security risk assessments and other checks to ensure that the tool and its security protocols meet our legal and institutional standards. When employees forgo this process and use tools that have not gone through formal IT and legal review, the data stored on these platforms is subject to whatever vulnerabilities exist in them. This opens the university and its employees up to legal and reputational risks, as well as fines and other liabilities.

Before you use a new tool

While tech tools provided by IITS or purchased through a purchase order (PO) are captured for PIAs, free software is often not captured, and that’s where we require employee awareness and action. The best way to protect ourselves and the university is to take the following steps:

First, check the IT Service catalogue. If the tool is already approved, you can use it.

If it isn’t listed, ask yourself what data you’ll use with the tool:

• Will you use personal information or confidential university data? Submit a PIA request before you use the tool. A PIA is a review of how a tool collects, stores and shares personal information. It is paired with security and legal checks.
• Will it only be with public information? You can go ahead without a formal assessment, as long as you follow Concordia’s policies on institutional data.

Not sure which category your data falls into? Review Concordia’s data categories: public, internal, confidential and restricted. Anything beyond public data requires the appropriate IT and legal assessments.

Protecting Concordia’s data is a shared responsibility, and it often comes down to small choices. When in doubt, check first.

Learn more about Privacy and protection of personal information for employees on Carrefour.

Reach out to your Privacy Ambassador for any questions, or feel free to contact the Privacy Office directly at privacy.office@concordia.ca