RCICs are regulated by the College of Immigration and Citizenship Consultants, whose Code of Professional Conduct sets duties including confidentiality, written service agreements and proper client records. Lawyers follow their provincial or territorial law society’s rules on confidentiality, files and trust money. A CRM such as ImmiPractice supports these duties with role-based access, signed agreements with audit trails and complete case files — but check your regulator’s current rules.
- RCICs follow the CICC Code of Professional Conduct; lawyers follow their law society’s rules.
- Common expectations: confidentiality, written agreements, complete client files, proper retention.
- A CRM supports these with role-based access, e-signed agreements with audit trails and complete case files.
- Retention periods differ by regulator — check your regulator’s current rules.
Privacy law is only half the picture for an immigration practice. Your professional regulator sets its own expectations about confidentiality and client files, and those often go further than privacy law. This page gives a general overview and shows where software can help. It is not a substitute for reading your regulator’s current rules.
Who regulates immigration representatives in Canada?
- Regulated Canadian Immigration Consultants (RCICs) are licensed by the College of Immigration and Citizenship Consultants (CICC). Licensees must follow the College’s Code of Professional Conduct and its regulations and guidance.
- Lawyers are regulated by their provincial or territorial law society, each with its own rules of professional conduct and by-laws. In Québec, notaries are regulated by the Chambre des notaires. The Federation of Law Societies of Canada lists the law societies.
- Outside Canada, the relevant bar or immigration-adviser regulator sets the rules.
What does confidentiality usually require?
Across these regulators, the common expectations are:
- Keep client information confidential and use it only for the client’s matter, unless the client consents or the law requires disclosure.
- The duty continues after the engagement ends.
- Staff, agents and contractors you rely on must protect the information too — you are responsible for their handling of it.
- Store files securely and limit access to people who need it.
What does file-keeping usually require?
- A written agreement before services begin. The CICC Code requires a written service agreement with the client.
- A complete client file: the agreement, communications, documents received, applications and forms submitted, decisions, invoices and receipts.
- Proper handling of client money under your regulator’s client-account or trust rules.
- Retention for the required period, and secure destruction afterwards.
- Returning or transferring the file when a client changes representative, under your regulator’s rules.
Retention periods and file-transfer rules differ by regulator and change over time, so we do not quote them here. Check your regulator’s current rules before setting your retention schedule.
How can a CRM support these obligations?
| Expectation | How ImmiPractice can support it |
|---|---|
| Written service agreement before work starts | Retainer agreements from your templates, e-signed by the client, with an audit trail of sent, viewed, reminded, signed, expired and superseded events. See agreement audit trail. |
| Complete client file | One case page with fees, payments, agreements, documents and history; WhatsApp documents saved to the case; download everything as a ZIP |
| Confidentiality inside the firm | Seven roles, branch isolation, Filing Team sees only assigned cases, Receptionists never see enrolled cases, admin-only permission changes |
| Staff who leave | Deactivation ends access on the next request; no passwords to keep |
| Communications record | Lead activity timeline and a shared WhatsApp inbox linked to leads and cases, instead of personal phones |
| Financial records | Invoices locked once issued; payments cannot be deleted once invoiced; ledger exports for your accountant |
| Secure storage | Regional hosting (Canada for Canadian firms), encryption in transit and at rest, private file storage served only after permission checks |
What can’t software do for you?
A CRM cannot decide what your regulator requires, supervise your staff or judge whether a disclosure is permitted. It gives you a reliable place to keep the file and controls over who sees it. The professional judgement — and the responsibility — stays with the licensee.
For practical set-up, see organizing immigration case files and roles and permissions.
This is general information, not legal advice.
General information about running an immigration practice — not legal advice. Rules change; confirm current requirements with official sources and your regulator.