Purpose
CGI Federal protects the personal data that we handle and works closely with our clients and third-party suppliers to address the challenges of the evolving data protection regulatory landscape.
CGI Federal maintains this Data Privacy Policy1 detailing our privacy principles, standards, requirements, and how we protect all personal data as part of our operations, whether we process personal data for our own purposes or for the needs of our clients. Key terms for this policy are defined in Appendix 1.
Principles
As a global IT and business consulting services organization, CGI Federal is committed to maintaining levels of protection of personal data aligned to best practices, the applicable data protection legislation, and CGI Federal’s contractual obligations. CGI Federal and its wholly owned subsidiaries have adopted and follow the principles and practices included in this policy.
CGI Federal collects and/or uses personal data for its own needs. CGI Federal may also handle personal data on behalf of and upon instructions of a client, including the technical and organizational measures required to prevent accidental or unlawful destruction, loss, alteration, disclosure, or access to the personal data. any commitment regarding these responsibilities and measures must be expressly reflected in any agreements entered between CGI Federal and our clients.
CGI Federal’s value proposition includes data protection and data risk exposure prevention. CGI Federal guides and assists its clients on how to manage and protect their personal data to meet compliance requirements. Upon a client’s instructions, CGI Federal will implement effective security measures to safeguard the personal data and avert data breaches.
Scope and Compliance
This Data Privacy Policy is an integral part of CGI Federal’s commitment to protect CGI Federal and client data and is based on CGI’s foundational principles. This policy applies to all CGI Federal legal entities and employees (i.e., Federal CGI Partners 2) regardless of their location, as well as third-party suppliers engaged by CGI Federal. To the extent permitted by law, any violation of this Data Privacy Policy may result in administrative and/or disciplinary action by CGI Federal (including monetary penalties, suspension, or termination).
- CGI Federal is a wholly owned subsidiary of CGI, but for operational reasons maintains a separate data privacy policy. CGI Federal adheres to other CGI policies unless specifically disclaimed.
- For the purposes of this document, the term Federal CGI Partner includes both Federal CGI Partners and CGI Federal subcontractors with access to CGI Federal assets, resources, and data or access to client-managed assets, resources, and data unless otherwise specified.
Federal CGI Partners acknowledge these requirements and annually confirm acceptance of this Data Privacy Policy consistent with the data privacy and confidentiality requirements in the CGI Federal Standards of Ethics and Business Conduct. In addition to this Data Privacy Policy, Federal CGI Partners must also comply with other applicable confidentiality and privacy obligations, including those set out in applicable data protection legislation, their employment agreements, and/or client instructions.
Any third-party supplier that processes personal data on CGI Federal’s behalf is required to implement appropriate technical and organizational measures to ensure compliance with the principles and requirements of this Data Privacy Policy. When CGI Federal processes personal data on behalf of a client, any contractual commitments, or other obligations of CGI Federal towards its client need to be passed down to all engaged third-party suppliers. Any commitment or obligation must be expressly reflected in agreements entered between CGI Federal and third-party suppliers.
Which Personal Data Categories Does CGI Federal Process as Part of Its Operations?
Subject to applicable data protection legislation, CGI Federal and any third-party supplier may process the following non-exhaustive list of personal data categories.
- Demographics & Private Life Information
- (e.g., age, gender, physical traits, date of birth, home address, marital status, memberships, preferences, interests)
- Location, Login, Traffic, & Tracking
- (e.g., IP address, browser fingerprint, logs)
- Economic & Financial
- (e.g., account number, financial health, shares, tax status, salary, financial transactions)
- Sensitive Personal Data
- (e.g., Social Security Number, biometrics, health information, driver’s license number, passport number)
- Professional Life & Business Information
- (e.g., employer, department, job title, employment history, performances, interviews, degrees and certifications, billing, delivery address)
- Identity & Contact Information
- (e.g., name, email address, telephone number, mobile device IDs, photo, national ID)
These categories of personal data relate to the following non-exhaustive list of individuals:
- Employment candidates, trainees, and students
- Federal CGI Partners and former employees and their relatives
- Clients’ employees and former employees and their relatives
- Clients’ patients, customers, or citizens
- Prospective clients’ employees and customers
- Visitors of CGI Federal websites
- Shareholders
- Third-party suppliers’ employees and freelancers
More detailed information will be available in the relevant privacy information notices.
With Whom Does CGI Federal Share Your Personal Data?
As part of its operations, CGI Federal may disclose personal data to CGI legal entities, clients and prospects, third-party suppliers, and/or other third parties (including banks and financial advisors, external advisors, and auditors), as well as administrative, judicial, or governmental authorities, state agencies, or public bodies in accordance with applicable data protection legislation. CGI Federal never sells Federal CGI Partners’ personal data. CGI Federal shares Federal CGI Partners’ personal data with other CGI legal entities, staff representatives, CGI Federal clients/prospects, CGI Federal’s third-party suppliers, and/or public authorities where legally required and in compliance with applicable laws.
How Does CGI Federal Protect Personal Data Processed for Its Own Needs?
CGI Federal is responsible for protecting any persona; data handled as part of its operations.
As a result, Federal CGI Partners comply with the following core principles:
On Which Legal Basis Does CGI Federal Process Personal Data for Its Own Needs?
Most commonly, CGI Federal may process personal data in the following circumstances:
- When CGI Federal needs to comply with a legal obligation.
- When it is necessary for the execution of a contract with an individual.
- When CGI Federal has a legitimate interest in doing so as part of its operations.
*There can be some occasions where it becomes necessary for CGI Federal to process personal data to protect individuals' interests or with the prior consent of the individuals.*
Sensitive Personal Data Processed for CGI’s Own Needs
CGI Federal will not Process Sensitive personal data unless one of the following conditions is met:
- The individual has given their prior consent, or
- The processing is required for the purposes of carrying out the obligations and exercising specific rights of CGI Federal or of the individual in the field of employment, social security and social protection law, or
- If the individual is not able to give their consent (e.g., for medical reasons), the processing is necessary to protect the vital interests of the individual or another person, or
- The processing is required in the context of preventive medicine or medical diagnosis by a health professional under local legislation, or
- The individual has already manifestly placed the relevant sensitive personal data in the public domain, or
- The processing is essential for the purpose of establishing, exercising, or defending legal claims, unless the individual has an overriding legitimate interest in ensuring that such sensitive personal data is not processed, or
- The processing is explicitly permitted by local legislation, or
How Does CGI Federal Protect Clients’ Personal Data?
When CGI Federal posses clients' personal data, CGI Federal ensures that personal data is processed for the client's sole expressed purposes, and according to the client's written instructions, including in respect of duration, set out in the terms and conditions agreed between CGI Federal and the client.
The client remains solely responsible for ensuring that there is a valid legal basis for the processing performed by CGI Federal and that the instructions given to CGI Federal in respect of the processing comply with applicable data protection legislation, including the retention period to be applied. Nonetheless, CGI Federal will promptly inform the client if, in its opinion, any such instructions conflict with applicable data protection legislation.
Unless otherwise instructed by the client, CGI Federal will apply (at a minimum) CGI’s security baseline as prescribed in CGI’s Enterprise Security Management Framework (ESMF). Any deviation to this baseline requires relevant risk reviews and the approval of CGI Federal’s Privacy and Security teams.
CGI Federal will, subject to financial, technical, and organizational conditions agreed in writing, provide reasonable assistance to the client to support it in undertaking its obligations under applicable data protection legislation.
Privacy by Design and Privacy by Default
To ensure that the principles defined in this Data Privacy Policy are effectively considered when CGI Federal processes personal data, CGI Federal will identify and address data protection constraints at the beginning of any new internal project or client opportunity so that the principles contained herein are reflected in the design of the project and appropriately implemented. CGI Federal has therefore implemented data privacy and security review processes and several frameworks (e.g., Responsible Use of Data, Responsible Use of Artificial Intelligence and Responsible Use of Cloud Technology) applicable to all CGI Federal internal projects and client opportunities involving the processing of personal data and assisting each relevant Federal CGI Partner in analyzing and addressing data privacy risks.
The CGI Federal Privacy organization reviews and approves the privacy aspects of proposals and/or services developed for clients, as well as of any CGI Federal Intellectual Property or new internal project. The Federal CGI Partner responsible for the solution, service, and/or project retains evidence of compliance with CGI Federal Privacy organization approval requirements.
What Are the Rights of Individuals and How Can They Be Exercised?
Rights of individuals over their personal data differ among states and other countries. CGI Federal acts in accordance with applicable data protection legislation.
Depending on jurisdictions, applicable data protection legislation may provide individuals with the following rights:
- Have access to their personal data and the information on how it is processed,
- Request the rectification or deletion of any inaccurate or incomplete personal data relating to them,
- Revoke consent or object on legitimate grounds to the processing of their personal data, unless such processing is imposed by law,
- Request restrictions to the processing where the personal data is no longer accurate or necessary, or the processing is unlawful,
- Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects the individuals,
- Receive their personal data in a structured, commonly used, and machine-readable format, and
- Appoint an individual to exercise their rights upon their death or incapacity.
Individuals who wish to exercise these rights and/or obtain information on the processing of their personal data may send a request as set out in the Questions, Requests, and Recourses section below.
When CGI Federal processes personal data for its own needs: CGI Federal communicates any rectification or deletion of personal data or restriction of processing carried out in accordance with applicable data protection legislation to each recipient to whom the personal data has been disclosed unless this proves impossible or involves disproportionate effort. CGI Federal ensures that it handles requests without undue delay in accordance with CGI Federal’s individual rights request process.
When CGI Federal processes clients’ personal data: If CGI Federal receives a complaint or request from individuals wishing to exercise their rights, CGI Federal will promptly communicate all relevant information to the client and will expressly indicate to the individual that it is the client’s responsibility to handle such complaint or request. CGI Federal is only responsible for handling complaints or requests in accordance with the client’s instructions.
How Does CGI Federal Manage Personal Data Breaches?
CGI Federal has a mature, standards-based security incident response and management process designed to handle all phases of a security incident, including incidents with privacy impacts. Federal CGI Partners' responsibilities are clearly defined at all levels. Incident assessment and prioritization standards are followed to ensure appropriate engagement levels and timely resolution.
Incident records are maintained and reported to CGI Federal’s senior management as required. All incidents are managed through CGI Federal’s 24x7 Security Operations Center (SOC), where highly trained, full-time incident response professionals coordinate response efforts. CGI Federal’s Privacy organization is immediately engaged in the incident management process whenever personal data is suspected or known to be involved.
If CGI Federal reasonably believes that a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed has occurred, CGI Federal notifies the data controller (e.g., the client) and takes the appropriate remedial measures.
Similarly, in the event a personal data breach is identified by a third-party supplier engaged by CGI Federal, the third-party supplier must inform CGI Federal as agreed upon in the relevant agreement and in accordance with applicable data protection legislation.
Communication and Training
CGI Federal continually promotes a data protection culture within its organization. CGI Federal provides an annual data privacy learning program, regularly updated to reflect technological and legislative changes. All CGI Federal leaders must ensure that the Federal CGI Partners reporting to them are aware of and adhere to this Data Privacy Policy.
Additional information may also be provided to Federal CGI Partners through several channels, including targeted Privacy briefings, webinars, and individual meetings.
*Trainings and communications provide Federal CGI Partners' awareness of the core principles in this Data Privacy Policy and associated best practices to help protect CGI Federal and its stakeholders against unauthorized access and improper handling of personal data.*
Audit
CGI Federal integrates into its business-wide internal audit program a review of its compliance with this Data Privacy Policy. The internal audit program defines:
- A schedule under which audits will be carried out,
- The expected scope of the audit, and
- The team responsible for the audit.
The business-wide internal audit program includes verification at delivery, functional, and corporate levels. The audit programs may be revised on a regular basis. However, CGI Federal will perform internal audits on a regular basis through qualified audit teams. Such programs will be initiated by the relevant CGI Federal audit departments for each level.
The results of the audit will be communicated to the CGI Federal Privacy organization and resulting actions will be defined and prioritized, enabling the CGI Federal Privacy organization to determine a schedule for the implementation of corrective and preventive measures.
Clients may request access to the audit results subject to contractual obligations. Such communication is subject to a confidentiality agreement and audit results do not include any confidential information of other CGI Federal clients or CGI Federal internal business areas. Release of such results are subject to the approval of the CGI Federal Privacy organization and the CGI Federal Legal organization.
CGI and CGI Federal Privacy Organization
CGI has designated a Chief Privacy Officer (CPO) and a network of privacy business partners and records management specialists. The CGI Federal privacy business partner and records management specialists are members of the CGI Privacy organization, but for operational reasons, CGI Federal maintains separate data privacy and records management teams and adheres to the limited sharing and access requirements.
Updates to the CGI Federal Data Privacy Policy
This Data Privacy Policy is reviewed annually and may be amended, as necessary, and CGI Federal will issue relevant communications relating to such changes in due time.
Questions, Requests, and Recourses
Questions and Requests
In case of questions related to the interpretation or operation of this policy or requests related to your personal data processed by CGI, please send an email to privacy@cgifederal.com.
Independent Recourse Mechanism
If you are aware of any violation of this policy or misconduct related to Data Privacy, you should report your concerns to the CGI Federal’s Ethics Office or its Hotline. You can reach the CGI Federal Ethics Office at 703-227-4555 or by email at ethicsofficer@cgifederal.com.
You can reach the CGI Federal Ethics Hotline at 1-866-594-7369 or by visiting www.cgifederal.ethicspoint.com.
CGI Federal seeks to maintain strong relationships with data protection authorities and cooperate with them in any relevant matter, including any audit requests. CGI Federal will also carefully consider recommendations issued by competent data protection authorities in relation to personal data processing carried out by CGI Federal as part of its operations.
Policy Owner
CGI Federal Privacy Business Partner
Approving Authority
CGI Federal Legal
Policy Revisions
Policy Version: 1.0
Policy’s original effective date: February 1, 2025
Last revision effective date: February 1, 2025
Appendix 1. Privacy Glossary
For the purposes of this Data Privacy Policy, the following terms with associated definitions are used.
Appendix 2. Transfer of Personal Data
Any Transfer of personal data must take place in accordance with applicable data protection legislation and the provisions of this Appendix 2.
Transfer Within CGI
A CGI Federal legal entity involved in a transfer must ensure that appropriate technical and organizational measures commensurate with any processing risks are implemented in accordance with this Data Privacy Policy and CGI Federal’s security policies, processes, and standards. These appropriate technical and organizational measures must be agreed and set out in a data processing agreement or any equivalent.
Transfer to Third Parties
On a regular basis, CGI Federal conducts due diligence and third-party privacy and security risks assessments with third-party suppliers engaged by CGI Federal, to establish their corporate capabilities and maturity with respect to security and data protection.
Whenever CGI Federal relies on third-party suppliers to process personal data, CGI Federal ensures that such third-party suppliers provide an adequate level of protection to the personal data they process as per applicable data protection legislation.