Part XIII Non-Resident Withholding Program v3.0
Individual Compliance Directorate
Collections and Verification Branch
On this page
- Overview & Privacy Impact Assessment Initiation (PIA)
- Summary of the project, initiative or change
- Risk identification and categorization
Overview & Privacy Impact Assessment Initiation (PIA)
Government institution
Canada Revenue Agency
Government official responsible for the Privacy Impact Assessment
Marco Cadorette
Director General
Individual Compliance Directorate
Collections and Verification Branch
Head of the government institution or Delegate for section 10 of the Privacy Act
Lia Jackson
Director
Access to Information and Privacy Directorate
Name of program or activity of the government institution
Returns Compliance
Standard or institution specific class of record:
Part XIII Non-Resident Withholding Program
CRA CVB 189
Standard or institution specific personal information bank:
Part XIII Non-Resident Withholding Program
CRA PPU 094
TBS Registration Number: 004464
Legal authority for program or activity
Part XIII (sections 212 through 218.1) of the Income Tax Act (ITA) provides for the administration of the Part XIII program.
Subsection 212(1) of the Act: “Every non-resident person shall pay an income tax of 25% on every amount that a person resident in Canada pays or credits, or is deemed by Part I to pay or credit, to the non-resident person as, on account or in lieu of payment of, or in satisfaction of...”
Subsection 212(1) lists all types of income that are taxable under Part XIII as well as the exceptions to the 25% tax rate.
The Canada Revenue Agency (CRA) may collect a person’s social insurance number in keeping with section 237 of the Act and use it for identification purposes.
Further to the legal authority listed above, Regulations 202(1) to 202(6), 202(7), 202(8), 206(1), and 205 of the Income Tax Regulations list the obligations for paying and filing NR4 returns.
Summary of the project, initiative or change
Overview of the Program or Activity
The Part XIII Non-Resident Withholding Program is responsible for making sure Part XIII tax is correctly withheld, remitted, and reported on eligible Canadian income paid to non‑resident recipients.
The Program runs various year-to-year activities that include:
- reporting and filing NR4 returns
- assessments and reassessments
- receiving correspondence
- doing account updates, such as address changes and changes to authorized representatives
- processing refunds from Form NR7-R, Application for Refund of Part XIII Tax Withheld
- processing Form NR5, Application by a Non-Resident of Canada for a Reduction in the Amount of Non-Resident Tax Required to be Withheld
- processing Form NR6, Undertaking to File an Income Tax Return by a Non-Resident Receiving Rent from Real or Immovable Property or Receiving a Timber Royalty
- verifying that proper withholding, remitting, and reporting of Part XIII tax were applied on the NR4 returns, and that proper procedures were followed for the NR6
What’s New
Document management portal
The Non-Resident Withholding Section started using the document management portal on March 20, 2023. This portal serves as the repository and record storage system for all incoming taxpayer correspondence and faxes.
Submit documents
Certain forms processed by the Part XIII Non-Resident Withholding Program can now be submitted through the Submit Documents service in My Account. These forms include the following:
- NR5, Application by a Non-Resident of Canada for a Reduction in the Amount of Non-Resident Tax Required to be Withheld
- NR6, Undertaking to File an Income Tax Return by a Non-Resident Receiving Rent from Real or Immovable Property or Receiving a Timber Royalty
- NR7-R, Application for Refund of Part XIII Tax Withheld
Secure drop zone
Secure Drop Zone is a secure, two-way channel that lets clients and third parties digitally send and receive files to/from the CRA. They can access the drop zone through a link the CRA emails them.
Memorandum of understanding
In 2023, the Competent Authority Services Division and the Matching and Non-Resident Withholding Division created a memorandum of understanding. The purpose of the memorandum is to provide a delegation of the competent authority to review and approve certain NR7‑R refund applications received beyond the Domestic Time Limit from qualifying U.S. residents.
Willow
Willow is a web-based ticketing system for enquiries from field and headquarters areas.
My NR Account and Non-Resident Tax Account Online project
The goal of the Non-Resident Tax Account Online (NRTAO) project is to provide a suite of secure online services to non-resident (NR) tax account holders and their authorized representatives to allow them to manage their accounts through the CRA’s secure portal. The NRTAO project will add a My NR Accounts sector into the existing CRA portal. Currently, clients with Part XIII tax responsibilities under the Income Tax Act must manage their accounts by phone, fax, or mail, resulting in limited client service and cumbersome, manual, and paper-based processes for the CRA. My NR Account portal sector will provide digital seamless service that puts the needs of clients first.
It is anticipated the NRTAO will start implementation as of October 2025 with the following services:
- Two foundational portal pages (Overview and Profile)
- Ten initial NR services:
- View and pay account balance
- Make a remittance
- View account transactions
- Manage contact information
- Manage authorized representatives
- File an NR4 information return
- Manage notification preferences
- View remittance schedule
- Provide a nil remittance
And be completed in May 2026 by adding the ‘Submit documents’ function.
Scope of the Privacy Impact Assessment
This privacy impact assessment covers the workload within the Part XIII Non-Resident Withholding Program that involves personal information. Within the scope of this PIA are the withholding, remitting, and reporting obligations under Part XIII of the Income Tax Act.
Outside the scope of this PIA are collections, audit, appeals, business intelligence, and other functions separate from the Part XIII Non-Resident Withholding Program. These areas do have non-resident sections but any related activities done there fall under the corresponding collections, appeals, and audit programs and are assessed under those programs’ PIAs. Business intelligence performed for the Part XIII Non-Resident Withholding Program within the Individual Compliance Directorate of the Collections and Verification Branch is described in the Business Intelligence Research & Development Environment PIA (Service, Innovation and Integration Branch) however any resulting administrative decisions by the Part XIII Non-Resident Withholding Program are within scope of this PIA.
Risk identification and categorization
A) Type of program or activity
Compliance / Regulatory investigations and enforcement
Level of risk to privacy: 3
Details: The Non-Resident Withholding Program uses personal information only to administer programs and services and to provide assistance with the withholding, remitting, and reporting of Part XIII tax to Canadian payers and to non-residents of Canada receiving income from Canadian sources.
The activities this program administers that requires the use of personal information include:
- creating non-resident accounts
- updating non-resident accounts (for example, address changes, authorized representative updates, and legal name changes)
- revising account transactions (for example, proper allocation of remittances and transfers of payments between accounts)
- assessing or reassessing amounts owing (for example, taxes, penalties, and interest),
- issuing refunds through non-resident accounts or through processing of Form NR7-R, and
- processing NR5 and NR6 applications
B) Type of personal information involved and context
Social insurance number, medical, financial or other sensitive personal information and/or the context surrounding the personal information is sensitive. Personal information of minors or incompetent individuals or involving a representative acting on behalf of the individual.
Level of risk to privacy: 3
Details:
The types of personal information the Program requires to administer these activities and services can include the Canadian payer’s, agent’s, or representative’s phone number and home/mailing address. It can also include the following information about the non-resident:
- country of residence and home/mailing address
- account number
- social insurance number
- individual tax number
- business number
- trust/subsidiary ledger number
- authorized signature, and
- details of their income (for example, gross income, net income, expenses, and property addresses for rental income)
Some activities (for example, processing NR5 elections and taxpayer relief requests) require additional personal information, such as medical information about the taxpayer or their dependents, or incompetent individuals.
C) Program or activity partners and private sector involvement
With provincial and/or territorial and/or indigenous and/or municipal government(s)
Level of risk to privacy: 3
Details:
Other areas within the CRA share personal information to ensure the proper administration of activities and services. These other areas may include audit, collections, and appeals. They have access to information that is unavailable to the Non-Resident Withholding Section and that help administer the section’s activities and services.
For some activities (for example, NR5 administration), the Program shares personal information with other federal and provincial government agencies, such as Service Canada for the Canada Pension Plan, Quebec Pension Plan, and Old Age Security. The personal information shared with these government agencies from these areas is regarding incomes and approved tax rates on those incomes.
D) Duration of the program or activity
Long-term program
Level of risk to privacy: 3
Details:
The Part XIII Non-Resident Withholding Program is a permanent activity and is based on necessity and legislative provisions in the Income Tax Act.
E) Program population
The Program affects certain individuals for external administrative purposes.
Level of risk to privacy: 3
Details:
The affected program population is:
- non-residents of Canada who are receiving or expect to receive income from Canadian sources, and
- Canadian payers who are sending or expect to send payments to non-residents
The affected program population is also classified as individuals, businesses, or third parties who withhold and remit income tax payable under Part XIII of the Income Tax Act.
F) Technology & privacy
- Does the new or modified program or activity involve the implementation of a new electronic system, software or application program including collaborative software (or groupware) that is implemented to support the program or activity in terms of the creation, collection, or handling of personal information?
Risk to privacy: Yes
- Does the new or modified program or activity require any modifications to IT legacy systems and/or services?
Risk to privacy: Yes
- Does the new or modified program or activity involve the implementation of one or more of the following technologies?
Enhanced identification methods - this includes biometric technology (i.e. facial recognition, gait analysis, iris scan, fingerprint analysis, voice print, radio frequency identification (RFID), etc.) as well as easy pass technology, new identification cards including magnetic stripe cards, "smart cards" (i.e. identification cards that are embedded with either an antenna or a contact pad that is connected to a microprocessor and a memory chip or only a memory chip with non-programmable logic).
Risk to privacy: No
Use of Surveillance - this includes surveillance technologies such as audio/video recording devices, thermal imaging, recognition devices, RFID, surreptitious surveillance/interception, computer aided monitoring including audit trails, satellite surveillance etc.
Risk to privacy: No
Use of automated personal information analysis, personal information matching and knowledge discovery techniques - for the purposes of the Directive on PIA, government institutions are to identify those activities that involve the use of automated technology to analyze, create, compare, identify, or extract personal information elements. Such activities would include personal information matching, record linkage, personal information mining, personal information comparison, knowledge discovery, information filtering or analysis. Such activities involve some form of artificial intelligence and/or machine learning to uncover knowledge (intelligence), trends/patterns or to predict behavior.
Risk to privacy: Yes
G) Personal information transmission
The Program transmits personal information using wireless technologies.
Level of risk to privacy: 4
Details:
The personal information is stored in various CRA systems and databases that have access to other systems. In limited circumstances, the information can be transferred to an agency‑approved and secure portable device, such as a secure USB key with a higher level of encryption.
All employees may work on CRA-issued laptops and use agency-issued cell phones. Laptops and cell phones comply to the Government of Canada’s encryption and security standards.
Any telework done is through secure remote access (SRA).
H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee
Details:
If a privacy breach occurs, the individual may experience:
- financial loss (for example, identity theft or fraud, inconvenience due to changing financial arrangements, potential loss of business opportunities, potential increase in the cost of insurance, or potential loss of insurance)
- impacts on health (for example, psychological impact such as stress. and physiological impact such as loss of sleep) and,
- embarrassment