Privacy & Compliance Blog

Canadian Privacy Insights

Practical, plain-language guides on PIPEDA, Law 25, CASL, and AI privacy — written for Canadian business owners, not lawyers.

Featured

What Auditors Actually Ask For: Building an Evidence Trail Before the Audit

Compliance

Auditors do not want your policies. They want proof the policy was followed on a specific day, by a specific person, in a way you did not construct last week.

September 10, 2026·9 min read

Read article

Compliance

Point-in-Time Compliance Is Dead: Why Your Evidence Has to Be Continuous

A certificate proves your controls worked on the days someone looked. Buyers and regulators are starting to ask a harder question: are they working right now?

September 7, 2026Read

AI for Business

Building an AI System Inventory: The Register Every Governance Program Starts With

Every AI governance framework assumes you already know what you are running. Most Canadian companies do not. Here is how to build the register that everything else depends on.

September 3, 2026Read

Law 25

Quebec Law 25 for Small Business: What You Actually Have to Do

Quebec's Law 25 reads like it was written for a bank. Most of it wasn't meant for your five-person shop. Here's the short list of what a small business genuinely has to do.

August 27, 2026Read

CASL

Using Customer Data for Marketing Legally in Canada: The CASL and PIPEDA Line

CASL and PIPEDA don't ban marketing to your customers — they ban guessing about consent. Here's exactly where personalization is legal in Canada, and where it quietly turns into a six- or seven-figure violation.

August 24, 2026Read

Training

Why Most Breaches Start With a Person: Privacy Training for Employees in Canada

Most data breaches don't start with a hacker. They start with a trusted employee making one wrong call under pressure. Here's how to build privacy training that actually changes that.

August 20, 2026Read

Compliance

Data Minimization Privacy: The Cheapest Control Nobody Uses Under PIPEDA and Law 25

The most expensive data you own is the data you never needed. Collecting less is the privacy control that saves you money and keeps the OPC and CAI off your back.

August 17, 2026Read

AI Governance

AIDA: What the AI Law Canada Business Owners Ignore Means for You

Canada is writing its first real AI law, and most businesses have no idea what "high-impact AI system" will mean for them. Here's the plain-English version and what to do before the rules land.

August 13, 2026Read

Privacy

How Far Can a Canadian Employer Go? Employee Privacy and Workplace Monitoring in Canada

Canadian employers can monitor staff, but not without limits. Here's where the line actually sits across PIPEDA, Quebec's Law 25, and Ontario's monitoring rule, and how to stay on the right side of it.

August 10, 2026Read

Compliance

Privacy by Design: What It Actually Means for a Canadian Business

Most Canadian businesses treat privacy as a launch-week checkbox. The ones who treat it as a design constraint spend less, ship cleaner, and never have to explain themselves to the OPC.

August 6, 2026Read

PIPEDA

PIPEDA for Your E-commerce Online Store: What Canadian Sellers Actually Owe Their Customers

Your Shopify store collects more personal data than most law firms. Here is what PIPEDA, Law 25, and CASL actually expect from a Canadian online seller, and where the real risk hides.

August 3, 2026Read

Compliance

Cookie Consent Quebec Law 25: The Death of Silent Tracking

Most Canadian websites fire analytics and ad pixels before anyone clicks "accept" — already a documented liability under Quebec Law 25. Here's what a genuinely compliant cookie banner needs, and why silent tracking is finished.

July 30, 2026Read

Security

ISO 27001 Certification Canada: How It Differs From SOC 2 and PIPEDA

Enterprise buyers gate deals on the certificate before they read your pitch. Here's why Canadian SaaS pursues ISO 27001, how it differs from SOC 2 and PIPEDA, and what certification actually costs.

July 27, 2026Read

Security

SOC 2 for Canadian Companies: Why Buyers Demand It and How to Get Ready

A Halifax SaaS founder loses a $90K deal because a procurement form asks for a SOC 2 report he's never heard of. Here's what SOC 2 actually is, why Canadian buyers want it, and how it lines up with the privacy laws you already have to follow.

July 23, 2026Read

Law 25

When Is a Privacy Impact Assessment Required Under Quebec's Law 25?

Most Quebec businesses think a privacy impact assessment is something only banks and hospitals do. Then they sign a US cloud vendor and trip the wire without realizing it. Here's the actual threshold.

July 20, 2026Read

Breach

The Breach Register PIPEDA Demands: Every Incident You Have to Keep

PIPEDA makes you keep a record of every breach you suffer, even the harmless ones. Most Canadian businesses never learn this rule exists until the OPC asks to see the log.

July 16, 2026Read

Compliance

ISO 42001 vs SOC 2: Which Does Your Company Actually Need?

SOC 2 and ISO 42001 get lumped together as 'that compliance thing,' but they answer different questions. One proves you protect data; the other proves you manage AI responsibly. Here's how to tell which your company actually needs.

July 16, 2026Read

Privacy

Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

PIPEDA is not the whole map. Three provinces run their own private-sector privacy laws, and the moment you hire or sell across a border, the rules you answer to can change overnight.

July 13, 2026Read

Privacy Rights

Handling a DSAR Data Access Request in Canada Without Panic

Most access requests don't go wrong through malice. They go wrong because an ordinary-looking email turns out to be a 30-day legal clock nobody noticed. Here's the process that keeps a DSAR from becoming a regulator complaint.

July 9, 2026Read

Compliance

The Keep-Forever Trap: Building a Defensible Data Retention Schedule in Canada

The cheapest data to breach is the data you never needed to keep. A defensible retention schedule is the one privacy control that pays for itself the day you delete.

July 6, 2026Read

Trust

How to Prove Privacy Compliance to Customers and Win the Deal

Most Canadian businesses treat privacy compliance as a cost. The sharp ones turn it into the thing that closes deals. Here's how to flip your program from a deal-killer into a sales asset.

July 2, 2026Read

Compliance

Bill C-27 CPPA: What Changes for Canadian Business, and How to Win Day Zero

Bill C-27 would hand the Privacy Commissioner real teeth and put penalties of up to 5% of global revenue on the table. The companies that prepare now inherit a head start the day a successor passes.

June 29, 2026Read

Privacy

Consent Management Canada: Why Buried-Policy Consent Fails Under PIPEDA and Law 25

A pre-checked box and a 4,000-word privacy policy are not consent in Canada. Here's what PIPEDA and Law 25 actually require, and how to prove it later.

June 25, 2026Read

Breach

How to Write a PIPEDA Breach Notification Letter That Holds Up

The letter you send after a breach is a legal document, a trust repair, and a public record all at once. Here's exactly what it must say and how it should sound.

June 22, 2026Read

Breach

PIPEDA Breach Reporting: The 72-Hour Myth and What Actually Triggers a Report

Not every breach has to be reported — and the test that decides isn't a clock. It's a phrase: 'real risk of significant harm.' Here's how to apply it before the panic sets in.

June 16, 2026Read

Law 25

Quebec Law 25 Compliance Checklist: What Your Business Actually Has to Do in 2026

Three years after Law 25 started rolling out, most Quebec businesses still aren't sure whether they're actually compliant. Here's the checklist that cuts through it.

June 11, 2026Read

Compliance

Third-Party Risk: Why Your Privacy Compliance Is Only as Strong as Your Vendors'

When you hand customer data to a vendor, you don't hand off the responsibility. Under PIPEDA, their breach becomes your problem — which is why vendor risk is privacy work, not procurement paperwork.

June 6, 2026Read

Compliance

Your Data Is Probably Already Leaving Canada — What PIPEDA Expects You to Do About It

If you use Google Workspace, Microsoft 365, a US CRM, or basically any mainstream SaaS, your customers' personal data crosses the border every day. Here's what the law actually asks of you.

June 3, 2026Read

Compliance

What Is a ROPA, and Why It's the Foundation of Every Privacy Program

Almost every privacy obligation you have assumes you know what data you hold and why. A ROPA is that knowledge, written down. It's unglamorous, and it's the most important document you'll build.

May 30, 2026Read

Healthcare

PHIPA Compliance for Ontario Clinics: A Practical Guide for Health Custodians

Every Ontario clinic is a health information custodian under PHIPA — whether or not anyone there has read the act. Here's what compliance actually requires, in clinic terms.

May 27, 2026Read

CASL

CASL Express vs Implied Consent: The Difference That Decides Whether You Can Send That Email

CASL doesn't just require consent to send marketing email — it requires the right kind, and implied consent quietly expires. Get this distinction wrong and a routine newsletter becomes a regulatory problem.

May 23, 2026Read

PIPEDA

Do I Need a Privacy Policy for My Canadian Website? (Short Answer: Yes)

If your website has a contact form, an email signup, or even Google Analytics, you're collecting personal information — and under PIPEDA, that means you need a privacy policy. Here's what it has to say.

May 20, 2026Read

Law 25

What Is a Privacy Impact Assessment (PIA) — and When Does Your Business Actually Need One?

A PIA sounds like paperwork. It's actually the single document that proves you considered privacy risk before you took it — and under Quebec's Law 25, it's now mandatory in cases you'll hit routinely.

May 16, 2026Read

PIPEDA

The PIPEDA Compliance Checklist Every Canadian Small Business Needs

PIPEDA has no small-business exemption — if you handle customer data, it applies. Here's the checklist that turns a 30-page law into a Saturday afternoon of work.

May 12, 2026Read

Stay Current

Privacy law changes fast. We track it.

New articles every week on PIPEDA, Law 25, CASL, and Canadian AI compliance. No spam — ever.

Canadian Privacy Insights

Point-in-Time Compliance Is Dead: Why Your Evidence Has to Be Continuous

Building an AI System Inventory: The Register Every Governance Program Starts With

Quebec Law 25 for Small Business: What You Actually Have to Do

Using Customer Data for Marketing Legally in Canada: The CASL and PIPEDA Line

Why Most Breaches Start With a Person: Privacy Training for Employees in Canada

Data Minimization Privacy: The Cheapest Control Nobody Uses Under PIPEDA and Law 25

AIDA: What the AI Law Canada Business Owners Ignore Means for You

How Far Can a Canadian Employer Go? Employee Privacy and Workplace Monitoring in Canada

Privacy by Design: What It Actually Means for a Canadian Business

PIPEDA for Your E-commerce Online Store: What Canadian Sellers Actually Owe Their Customers

Cookie Consent Quebec Law 25: The Death of Silent Tracking

ISO 27001 Certification Canada: How It Differs From SOC 2 and PIPEDA

SOC 2 for Canadian Companies: Why Buyers Demand It and How to Get Ready

When Is a Privacy Impact Assessment Required Under Quebec's Law 25?

The Breach Register PIPEDA Demands: Every Incident You Have to Keep

ISO 42001 vs SOC 2: Which Does Your Company Actually Need?

Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

Handling a DSAR Data Access Request in Canada Without Panic

The Keep-Forever Trap: Building a Defensible Data Retention Schedule in Canada

How to Prove Privacy Compliance to Customers and Win the Deal

Bill C-27 CPPA: What Changes for Canadian Business, and How to Win Day Zero

Consent Management Canada: Why Buried-Policy Consent Fails Under PIPEDA and Law 25

How to Write a PIPEDA Breach Notification Letter That Holds Up

PIPEDA Breach Reporting: The 72-Hour Myth and What Actually Triggers a Report

Quebec Law 25 Compliance Checklist: What Your Business Actually Has to Do in 2026

Third-Party Risk: Why Your Privacy Compliance Is Only as Strong as Your Vendors'

Your Data Is Probably Already Leaving Canada — What PIPEDA Expects You to Do About It

What Is a ROPA, and Why It's the Foundation of Every Privacy Program

PHIPA Compliance for Ontario Clinics: A Practical Guide for Health Custodians

CASL Express vs Implied Consent: The Difference That Decides Whether You Can Send That Email

Do I Need a Privacy Policy for My Canadian Website? (Short Answer: Yes)

What Is a Privacy Impact Assessment (PIA) — and When Does Your Business Actually Need One?

The PIPEDA Compliance Checklist Every Canadian Small Business Needs

Privacy law changes fast. We track it.

Our own compliance