Privacy & Compliance Blog

Canadian Privacy Insights

Practical, plain-language guides on PIPEDA, Law 25, CASL, and AI privacy — written for Canadian business owners, not lawyers.

Featured

ISO 27001 Certification Canada: How It Differs From SOC 2 and PIPEDA

Security

Enterprise buyers gate deals on the certificate before they read your pitch. Here's why Canadian SaaS pursues ISO 27001, how it differs from SOC 2 and PIPEDA, and what certification actually costs.

July 27, 2026·7 min read

Read article

Security

SOC 2 for Canadian Companies: Why Buyers Demand It and How to Get Ready

A Halifax SaaS founder loses a $90K deal because a procurement form asks for a SOC 2 report he's never heard of. Here's what SOC 2 actually is, why Canadian buyers want it, and how it lines up with the privacy laws you already have to follow.

July 23, 2026Read

Law 25

When Is a Privacy Impact Assessment Required Under Quebec's Law 25?

Most Quebec businesses think a privacy impact assessment is something only banks and hospitals do. Then they sign a US cloud vendor and trip the wire without realizing it. Here's the actual threshold.

July 20, 2026Read

Breach

The Breach Register PIPEDA Demands: Every Incident You Have to Keep

PIPEDA makes you keep a record of every breach you suffer, even the harmless ones. Most Canadian businesses never learn this rule exists until the OPC asks to see the log.

July 16, 2026Read

Compliance

ISO 42001 vs SOC 2: Which Does Your Company Actually Need?

SOC 2 and ISO 42001 get lumped together as 'that compliance thing,' but they answer different questions. One proves you protect data; the other proves you manage AI responsibly. Here's how to tell which your company actually needs.

July 16, 2026Read

Privacy

Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

PIPEDA is not the whole map. Three provinces run their own private-sector privacy laws, and the moment you hire or sell across a border, the rules you answer to can change overnight.

July 13, 2026Read

Privacy Rights

Handling a DSAR Data Access Request in Canada Without Panic

Most access requests don't go wrong through malice. They go wrong because an ordinary-looking email turns out to be a 30-day legal clock nobody noticed. Here's the process that keeps a DSAR from becoming a regulator complaint.

July 9, 2026Read

Compliance

The Keep-Forever Trap: Building a Defensible Data Retention Schedule in Canada

The cheapest data to breach is the data you never needed to keep. A defensible retention schedule is the one privacy control that pays for itself the day you delete.

July 6, 2026Read

Trust

How to Prove Privacy Compliance to Customers and Win the Deal

Most Canadian businesses treat privacy compliance as a cost. The sharp ones turn it into the thing that closes deals. Here's how to flip your program from a deal-killer into a sales asset.

July 2, 2026Read

Compliance

Bill C-27 CPPA: What Changes for Canadian Business, and How to Win Day Zero

Bill C-27 would hand the Privacy Commissioner real teeth and put penalties of up to 5% of global revenue on the table. The companies that prepare now inherit a head start the day a successor passes.

June 29, 2026Read

Privacy

Consent Management Canada: Why Buried-Policy Consent Fails Under PIPEDA and Law 25

A pre-checked box and a 4,000-word privacy policy are not consent in Canada. Here's what PIPEDA and Law 25 actually require, and how to prove it later.

June 25, 2026Read

Breach

How to Write a PIPEDA Breach Notification Letter That Holds Up

The letter you send after a breach is a legal document, a trust repair, and a public record all at once. Here's exactly what it must say and how it should sound.

June 22, 2026Read

Breach

PIPEDA Breach Reporting: The 72-Hour Myth and What Actually Triggers a Report

Not every breach has to be reported — and the test that decides isn't a clock. It's a phrase: 'real risk of significant harm.' Here's how to apply it before the panic sets in.

June 16, 2026Read

Law 25

Quebec Law 25 Compliance Checklist: What Your Business Actually Has to Do in 2026

Three years after Law 25 started rolling out, most Quebec businesses still aren't sure whether they're actually compliant. Here's the checklist that cuts through it.

June 11, 2026Read

Compliance

Third-Party Risk: Why Your Privacy Compliance Is Only as Strong as Your Vendors'

When you hand customer data to a vendor, you don't hand off the responsibility. Under PIPEDA, their breach becomes your problem — which is why vendor risk is privacy work, not procurement paperwork.

June 6, 2026Read

Compliance

Your Data Is Probably Already Leaving Canada — What PIPEDA Expects You to Do About It

If you use Google Workspace, Microsoft 365, a US CRM, or basically any mainstream SaaS, your customers' personal data crosses the border every day. Here's what the law actually asks of you.

June 3, 2026Read

Compliance

What Is a ROPA, and Why It's the Foundation of Every Privacy Program

Almost every privacy obligation you have assumes you know what data you hold and why. A ROPA is that knowledge, written down. It's unglamorous, and it's the most important document you'll build.

May 30, 2026Read

Healthcare

PHIPA Compliance for Ontario Clinics: A Practical Guide for Health Custodians

Every Ontario clinic is a health information custodian under PHIPA — whether or not anyone there has read the act. Here's what compliance actually requires, in clinic terms.

May 27, 2026Read

CASL

CASL Express vs Implied Consent: The Difference That Decides Whether You Can Send That Email

CASL doesn't just require consent to send marketing email — it requires the right kind, and implied consent quietly expires. Get this distinction wrong and a routine newsletter becomes a regulatory problem.

May 23, 2026Read

PIPEDA

Do I Need a Privacy Policy for My Canadian Website? (Short Answer: Yes)

If your website has a contact form, an email signup, or even Google Analytics, you're collecting personal information — and under PIPEDA, that means you need a privacy policy. Here's what it has to say.

May 20, 2026Read

Law 25

What Is a Privacy Impact Assessment (PIA) — and When Does Your Business Actually Need One?

A PIA sounds like paperwork. It's actually the single document that proves you considered privacy risk before you took it — and under Quebec's Law 25, it's now mandatory in cases you'll hit routinely.

May 16, 2026Read

PIPEDA

The PIPEDA Compliance Checklist Every Canadian Small Business Needs

PIPEDA has no small-business exemption — if you handle customer data, it applies. Here's the checklist that turns a 30-page law into a Saturday afternoon of work.

May 12, 2026Read

Stay Current

Privacy law changes fast. We track it.

New articles every week on PIPEDA, Law 25, CASL, and Canadian AI compliance. No spam — ever.

Canadian Privacy Insights

SOC 2 for Canadian Companies: Why Buyers Demand It and How to Get Ready

When Is a Privacy Impact Assessment Required Under Quebec's Law 25?

The Breach Register PIPEDA Demands: Every Incident You Have to Keep

ISO 42001 vs SOC 2: Which Does Your Company Actually Need?

Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

Handling a DSAR Data Access Request in Canada Without Panic

The Keep-Forever Trap: Building a Defensible Data Retention Schedule in Canada

How to Prove Privacy Compliance to Customers and Win the Deal

Bill C-27 CPPA: What Changes for Canadian Business, and How to Win Day Zero

Consent Management Canada: Why Buried-Policy Consent Fails Under PIPEDA and Law 25

How to Write a PIPEDA Breach Notification Letter That Holds Up

PIPEDA Breach Reporting: The 72-Hour Myth and What Actually Triggers a Report

Quebec Law 25 Compliance Checklist: What Your Business Actually Has to Do in 2026

Third-Party Risk: Why Your Privacy Compliance Is Only as Strong as Your Vendors'

Your Data Is Probably Already Leaving Canada — What PIPEDA Expects You to Do About It

What Is a ROPA, and Why It's the Foundation of Every Privacy Program

PHIPA Compliance for Ontario Clinics: A Practical Guide for Health Custodians

CASL Express vs Implied Consent: The Difference That Decides Whether You Can Send That Email

Do I Need a Privacy Policy for My Canadian Website? (Short Answer: Yes)

What Is a Privacy Impact Assessment (PIA) — and When Does Your Business Actually Need One?

The PIPEDA Compliance Checklist Every Canadian Small Business Needs

Privacy law changes fast. We track it.

Our own compliance