Data Room for Internal Investigations in Canada (2026)

How it works in Canada

Investigations usually start with a whistleblower report, an auditor’s query or a regulator’s letter. A special committee of independent directors often retains outside counsel, who in turn retains forensic accountants. Running the work through counsel helps support solicitor-client privilege and, if litigation is reasonably anticipated, litigation privilege, which Canadian courts limit to documents made for the dominant purpose of litigation.

The evidence set mixes email exports, accounting data, chat logs and interview notes. Employees who are subjects of the investigation must not see it, and some records include personal information about uninvolved staff. A room with tight groups, no-download settings and detailed logs reduces the chance of leaks or tampering claims. Forensic teams also need to show that a hash of each collection matches the original, so chain of custody records sit next to the data they describe.

Reporting issuers face added pressure. The OSC Whistleblower Program can pay awards of up to C$5 million, and Ontario’s Securities Act protects whistleblowers from reprisal. Boards want to show they took a report seriously, which means a clear, documented process from intake to findings. Auditors may also ask about the investigation before signing off, so the committee needs a record it can show without giving up privilege over the underlying work.

Best data rooms for internal investigations

Our five criteria, re-weighted for this use case, plus a small bonus for providers built around it.

1 Ellty ~C$211/mo
9.1 Visit Ellty
2 iDeals Quote
8.8
3 Datasite Quote
8.8
4 Intralinks Quote
8.7
5 Firmex Quote
8.7
6 SmartRoom Quote
8.6
7 Ansarada Quote
8.6
8 Drooms Quote
8.5
9 Box ~C$21/user/mo
8.1
10 DealRoom Quote
8.0

Privacy 33%Workflow 16%Control 25%Usability 15%Cost 11%

What goes in the data room

Internal investigations: index

01
01 Mandate
Board or committee resolution, terms of reference and counsel’s engagement letter.
02
02 Intake (restricted)
Original whistleblower report and hotline record; access limited to lead counsel.
03
03 Preservation
Legal hold notices, acknowledgments and IT preservation confirmations.
04
04 Email and chat collections
Exports by custodian with chain of custody records.
05
05 Financial records
General ledger extracts, expense claims, vendor master data and bank statements under review.
06
06 Forensic work product
Accountants’ analyses prepared at counsel’s direction.
07
07 Interview memos
Counsel’s memos of interviews, noting the warning to each witness that counsel acts for the company.
08
08 Policies
Code of conduct, expense, procurement and anti-bribery policies in force at the time.
09
09 Committee reporting
Oral briefing notes and any written reports, prepared with privilege in mind.
10
10 Regulator correspondence
Letters to and from the OSC, police or other authorities, if any.

Canadian rules that apply

Solicitor-client and litigation privilege

Privilege attaches to communications for legal advice and, for litigation privilege, to material made for the dominant purpose of litigation (Blank v. Canada, 2006 SCC 39). Keep the investigation under counsel’s direction and label work product accordingly.

Whistleblower protection

Ontario’s Securities Act bars reprisal against employees who report to the OSC, and the Criminal Code makes retaliation against employees who report offences to authorities an offence. Restrict whistleblower intake records to the smallest possible group.

Privacy and employment law

Collecting employee data must be reasonable for the investigation purpose under PIPEDA or provincial privacy law, and unionized workplaces may have collective agreement limits on searches and interviews. Log what was collected and why.

Features to insist on

Data room	Activity log	View and download rights	Dynamic watermarks	2-step login	In-room redaction
Ellty	Yes	Yes	Yes	Yes	No
iDeals	Yes	Yes	Yes	Yes	Yes
Datasite	Yes	Yes	Yes	Yes	Yes
Intralinks	Yes	Yes	Yes	Yes	Yes
Firmex	Yes	Yes	Yes	Yes	Yes
SmartRoom	Yes	Yes	Yes	Yes	Yes
Ansarada	Yes	Yes	Yes	Yes	No
Drooms	Yes	Yes	Yes	Yes	Yes

Activity log. Per-user history of opens, prints and downloads with timestamps, which you can export for the closing binder.
View and download rights. Choose, document by document, whether a guest may only read, may print or may download, and change it later.
Dynamic watermarks. The reader's identity and the date are printed across every page, which discourages screenshots and identifies the source of a leak.
2-step login. Logins need a one-time code or authenticator approval on top of the password.
In-room redaction. Hide social insurance numbers, pay figures or client names on the platform itself, without keeping two versions of the file.

How to set it up

1
Have counsel own the room
Set the room up under outside counsel’s account or with counsel as administrator. This supports the position that material gathered is for legal advice, and it keeps management out of the access list when management may be involved.
2
Lock down intake records
Put the whistleblower report in a folder visible only to lead counsel. Redact identifying details from any copy shared with forensic accountants or the committee unless they truly need them.
3
Record chain of custody
For each email or device collection, upload the custodian, date, method and hash values. If findings are later challenged in court or arbitration, this record shows the evidence was not altered.
4
Separate privileged work product
Keep interview memos and forensic analyses in folders marked as privileged and prepared at counsel’s direction. Do not let these sit beside business records that may later be produced. Mixed folders invite arguments that privilege never attached, and separating them later is slow and costly.
5
Block downloads and watermark
Turn on view-only mode for sensitive folders and dynamic watermarks with the viewer’s name. This discourages leaks and makes any copy traceable. Review the access log weekly during the investigation, and remove anyone whose role has ended so the group stays as small as the work allows.
6
Report and freeze
When the committee receives findings, freeze the room, export it with logs and keep it under legal hold until any regulatory or litigation exposure has passed. Record the hold date and who approved its release.

Common mistakes

Letting the CFO or another possible subject keep administrator rights on the room.
Sharing the whistleblower’s name with the whole investigation team.
Writing a long, unprivileged report that becomes the first exhibit in later litigation.
Collecting far more employee personal data than the mandate needs.

FAQ

Does putting documents in a data room keep them privileged?

The room does not create privilege. Privilege depends on why the document was made and who directed the work. A room helps by limiting access to counsel and the people counsel instructs, so the confidentiality needed to keep privilege is not lost through wide circulation. Label privileged folders clearly too.

Should the board committee have direct access?

Usually committee members see only briefing material and final reports, not raw evidence. Direct access to interview memos can complicate privilege and expose members to more detail than they need. Counsel normally decides what the committee sees. That choice is recorded in the mandate.

How do we protect a whistleblower’s identity?

Keep the original report in a folder only lead counsel can open, redact identifying details in working copies and check the access log regularly. Reprisal against whistleblowers can breach securities law and the Criminal Code, so limiting who knows their identity protects the company too.

Data room for internal investigations in Canada