Privacy & Compliance Blog

Canadian Privacy Insights

Practical, plain-language guides on PIPEDA, Law 25, CASL, and AI privacy — written for Canadian business owners, not lawyers.

Featured

Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

Privacy

PIPEDA is not the whole map. Three provinces run their own private-sector privacy laws, and the moment you hire or sell across a border, the rules you answer to can change overnight.

July 13, 2026·7 min read

Read article

Privacy Rights

Handling a DSAR Data Access Request in Canada Without Panic

Most access requests don't go wrong through malice. They go wrong because an ordinary-looking email turns out to be a 30-day legal clock nobody noticed. Here's the process that keeps a DSAR from becoming a regulator complaint.

July 9, 2026Read

Compliance

The Keep-Forever Trap: Building a Defensible Data Retention Schedule in Canada

The cheapest data to breach is the data you never needed to keep. A defensible retention schedule is the one privacy control that pays for itself the day you delete.

July 6, 2026Read

Trust

How to Prove Privacy Compliance to Customers and Win the Deal

Most Canadian businesses treat privacy compliance as a cost. The sharp ones turn it into the thing that closes deals. Here's how to flip your program from a deal-killer into a sales asset.

July 2, 2026Read

Compliance

Bill C-27 CPPA: What Changes for Canadian Business, and How to Win Day Zero

Bill C-27 would hand the Privacy Commissioner real teeth and put penalties of up to 5% of global revenue on the table. The companies that prepare now inherit a head start the day a successor passes.

June 29, 2026Read

Privacy

Consent Management Canada: Why Buried-Policy Consent Fails Under PIPEDA and Law 25

A pre-checked box and a 4,000-word privacy policy are not consent in Canada. Here's what PIPEDA and Law 25 actually require, and how to prove it later.

June 25, 2026Read

Breach

How to Write a PIPEDA Breach Notification Letter That Holds Up

The letter you send after a breach is a legal document, a trust repair, and a public record all at once. Here's exactly what it must say and how it should sound.

June 22, 2026Read

Breach

PIPEDA Breach Reporting: The 72-Hour Myth and What Actually Triggers a Report

Not every breach has to be reported — and the test that decides isn't a clock. It's a phrase: 'real risk of significant harm.' Here's how to apply it before the panic sets in.

June 16, 2026Read

Law 25

Quebec Law 25 Compliance Checklist: What Your Business Actually Has to Do in 2026

Three years after Law 25 started rolling out, most Quebec businesses still aren't sure whether they're actually compliant. Here's the checklist that cuts through it.

June 11, 2026Read

Compliance

Third-Party Risk: Why Your Privacy Compliance Is Only as Strong as Your Vendors'

When you hand customer data to a vendor, you don't hand off the responsibility. Under PIPEDA, their breach becomes your problem — which is why vendor risk is privacy work, not procurement paperwork.

June 6, 2026Read

Compliance

Your Data Is Probably Already Leaving Canada — What PIPEDA Expects You to Do About It

If you use Google Workspace, Microsoft 365, a US CRM, or basically any mainstream SaaS, your customers' personal data crosses the border every day. Here's what the law actually asks of you.

June 3, 2026Read

Compliance

What Is a ROPA, and Why It's the Foundation of Every Privacy Program

Almost every privacy obligation you have assumes you know what data you hold and why. A ROPA is that knowledge, written down. It's unglamorous, and it's the most important document you'll build.

May 30, 2026Read

Healthcare

PHIPA Compliance for Ontario Clinics: A Practical Guide for Health Custodians

Every Ontario clinic is a health information custodian under PHIPA — whether or not anyone there has read the act. Here's what compliance actually requires, in clinic terms.

May 27, 2026Read

CASL

CASL Express vs Implied Consent: The Difference That Decides Whether You Can Send That Email

CASL doesn't just require consent to send marketing email — it requires the right kind, and implied consent quietly expires. Get this distinction wrong and a routine newsletter becomes a regulatory problem.

May 23, 2026Read

PIPEDA

Do I Need a Privacy Policy for My Canadian Website? (Short Answer: Yes)

If your website has a contact form, an email signup, or even Google Analytics, you're collecting personal information — and under PIPEDA, that means you need a privacy policy. Here's what it has to say.

May 20, 2026Read

Law 25

What Is a Privacy Impact Assessment (PIA) — and When Does Your Business Actually Need One?

A PIA sounds like paperwork. It's actually the single document that proves you considered privacy risk before you took it — and under Quebec's Law 25, it's now mandatory in cases you'll hit routinely.

May 16, 2026Read

PIPEDA

The PIPEDA Compliance Checklist Every Canadian Small Business Needs

PIPEDA has no small-business exemption — if you handle customer data, it applies. Here's the checklist that turns a 30-page law into a Saturday afternoon of work.

May 12, 2026Read

Stay Current

Privacy law changes fast. We track it.

New articles every week on PIPEDA, Law 25, CASL, and Canadian AI compliance. No spam — ever.

Unsubscribe anytime. We respect CASL.