Canadian Privacy Insights

October 26, 2026·8 min read

Your prompt logs contain whatever your staff pasted in, which is everything. Almost nobody has set a retention period on them, and they are growing daily.

Read article

Incident, Breach, or Neither? The Triage Call That Decides Your Reporting Duty

The most consequential decision in privacy incident response happens in the first hour, usually by whoever answered the phone, and usually with no framework at all.

October 22, 2026Read

What to Put in a Board Report About AI Risk

A board does not need to understand your models. It needs to know what could go wrong, who owns it, and whether the number is moving in the right direction.

October 19, 2026Read

From Ad Hoc to Audited: A Maturity Model for Canadian Privacy Programs

Having a privacy policy is stage one. Most companies stop there and believe they are finished, which is why the first access request or breach is such a shock.

October 15, 2026Read

Data Flow Mapping: Drawing the Picture Your Privacy Program Depends On

You cannot answer an access request, assess a transfer, or scope a breach without knowing where the data actually is. Most companies find that out during the incident.

October 12, 2026Read

Death by Security Questionnaire: How to Answer 200 Questions in an Afternoon

The questionnaire is not really a security test. It is a test of whether you have your act together, and it is scored on how fast and how consistently you answer.

October 8, 2026Read

Testing an AI System for Bias: What 'Reasonable Measures' Looks Like in Practice

Canadian human rights law does not care whether you intended to discriminate. It cares about the effect. That makes untested AI in hiring or service decisions a genuine liability.

October 5, 2026Read

Algorithmic Impact Assessment: The Federal Tool Private Companies Should Steal

An algorithmic impact assessment asks what a system does to people, not what it does for you. That is a different question from a privacy assessment, and most companies never ask it.

October 1, 2026Read

Your AI Subprocessors Are Your Customers' Problem Too

You shipped an AI feature last quarter. Somewhere in that feature, customer data now reaches a company your customers have never heard of and never agreed to.

September 28, 2026Read

Writing an AI Procurement Policy That Doesn't Block the Business

A policy that takes three weeks to approve a forty-dollar tool will be ignored, and should be. Tier the review by what the tool actually touches.

September 24, 2026Read

Who Owns AI Governance? Building the Committee Before the Regulator Asks

Most AI governance programmes die of diffusion. Legal thinks IT owns it, IT thinks the business owns it, and the business assumes someone approved the tool already.

September 21, 2026Read

The NIST AI Risk Management Framework: A Canadian Company's Field Guide

It is voluntary, it is American, and it has no certificate at the end. It is also the vocabulary your enterprise customers are starting to use, which makes it worth understanding.

September 17, 2026Read

Map Once, Comply Many: Cross-Mapping Controls Across SOC 2, ISO 27001, and ISO 42001

Roughly two thirds of the work behind SOC 2, ISO 27001, and ISO 42001 is the same work. The trick is knowing which third is not, because that is where programmes fail.

September 14, 2026Read

What Auditors Actually Ask For: Building an Evidence Trail Before the Audit

Auditors do not want your policies. They want proof the policy was followed on a specific day, by a specific person, in a way you did not construct last week.

September 10, 2026Read

Point-in-Time Compliance Is Dead: Why Your Evidence Has to Be Continuous

A certificate proves your controls worked on the days someone looked. Buyers and regulators are starting to ask a harder question: are they working right now?

September 7, 2026Read

Building an AI System Inventory: The Register Every Governance Program Starts With

Every AI governance framework assumes you already know what you are running. Most Canadian companies do not. Here is how to build the register that everything else depends on.

September 3, 2026Read

Quebec Law 25 for Small Business: What You Actually Have to Do

Quebec's Law 25 reads like it was written for a bank. Most of it wasn't meant for your five-person shop. Here's the short list of what a small business genuinely has to do.

August 27, 2026Read

CASL

Using Customer Data for Marketing Legally in Canada: The CASL and PIPEDA Line

CASL and PIPEDA don't ban marketing to your customers — they ban guessing about consent. Here's exactly where personalization is legal in Canada, and where it quietly turns into a six- or seven-figure violation.

August 24, 2026Read

Training

Why Most Breaches Start With a Person: Privacy Training for Employees in Canada

Most data breaches don't start with a hacker. They start with a trusted employee making one wrong call under pressure. Here's how to build privacy training that actually changes that.

August 20, 2026Read

Data Minimization Privacy: The Cheapest Control Nobody Uses Under PIPEDA and Law 25

The most expensive data you own is the data you never needed. Collecting less is the privacy control that saves you money and keeps the OPC and CAI off your back.

August 17, 2026Read

AI Governance

AIDA: What the AI Law Canada Business Owners Ignore Means for You

Canada is writing its first real AI law, and most businesses have no idea what "high-impact AI system" will mean for them. Here's the plain-English version and what to do before the rules land.

August 13, 2026Read

Privacy

How Far Can a Canadian Employer Go? Employee Privacy and Workplace Monitoring in Canada

Canadian employers can monitor staff, but not without limits. Here's where the line actually sits across PIPEDA, Quebec's Law 25, and Ontario's monitoring rule, and how to stay on the right side of it.

August 10, 2026Read

Privacy by Design: What It Actually Means for a Canadian Business

Most Canadian businesses treat privacy as a launch-week checkbox. The ones who treat it as a design constraint spend less, ship cleaner, and never have to explain themselves to the OPC.

August 6, 2026Read

PIPEDA

PIPEDA for Your E-commerce Online Store: What Canadian Sellers Actually Owe Their Customers

Your Shopify store collects more personal data than most law firms. Here is what PIPEDA, Law 25, and CASL actually expect from a Canadian online seller, and where the real risk hides.

August 3, 2026Read

Cookie Consent Quebec Law 25: The Death of Silent Tracking

Most Canadian websites fire analytics and ad pixels before anyone clicks "accept" — already a documented liability under Quebec Law 25. Here's what a genuinely compliant cookie banner needs, and why silent tracking is finished.

July 30, 2026Read

Security

ISO 27001 Certification Canada: How It Differs From SOC 2 and PIPEDA

Enterprise buyers gate deals on the certificate before they read your pitch. Here's why Canadian SaaS pursues ISO 27001, how it differs from SOC 2 and PIPEDA, and what certification actually costs.

July 27, 2026Read

Security

SOC 2 for Canadian Companies: Why Buyers Demand It and How to Get Ready

A Halifax SaaS founder loses a $90K deal because a procurement form asks for a SOC 2 report he's never heard of. Here's what SOC 2 actually is, why Canadian buyers want it, and how it lines up with the privacy laws you already have to follow.

July 23, 2026Read

When Is a Privacy Impact Assessment Required Under Quebec's Law 25?

Most Quebec businesses think a privacy impact assessment is something only banks and hospitals do. Then they sign a US cloud vendor and trip the wire without realizing it. Here's the actual threshold.

July 20, 2026Read

The Breach Register PIPEDA Demands: Every Incident You Have to Keep

PIPEDA makes you keep a record of every breach you suffer, even the harmless ones. Most Canadian businesses never learn this rule exists until the OPC asks to see the log.

July 16, 2026Read

ISO 42001 vs SOC 2: Which Does Your Company Actually Need?

SOC 2 and ISO 42001 get lumped together as 'that compliance thing,' but they answer different questions. One proves you protect data; the other proves you manage AI responsibly. Here's how to tell which your company actually needs.

July 16, 2026Read

Privacy

Alberta PIPA and BC PIPA: Which Privacy Law Actually Applies to You

PIPEDA is not the whole map. Three provinces run their own private-sector privacy laws, and the moment you hire or sell across a border, the rules you answer to can change overnight.

July 13, 2026Read

Privacy Rights

Handling a DSAR Data Access Request in Canada Without Panic

Most access requests don't go wrong through malice. They go wrong because an ordinary-looking email turns out to be a 30-day legal clock nobody noticed. Here's the process that keeps a DSAR from becoming a regulator complaint.

July 9, 2026Read

The Keep-Forever Trap: Building a Defensible Data Retention Schedule in Canada

The cheapest data to breach is the data you never needed to keep. A defensible retention schedule is the one privacy control that pays for itself the day you delete.

July 6, 2026Read

Trust

How to Prove Privacy Compliance to Customers and Win the Deal

Most Canadian businesses treat privacy compliance as a cost. The sharp ones turn it into the thing that closes deals. Here's how to flip your program from a deal-killer into a sales asset.

July 2, 2026Read

Bill C-27 CPPA: What Changes for Canadian Business, and How to Win Day Zero

Bill C-27 would hand the Privacy Commissioner real teeth and put penalties of up to 5% of global revenue on the table. The companies that prepare now inherit a head start the day a successor passes.

June 29, 2026Read

Privacy

Consent Management Canada: Why Buried-Policy Consent Fails Under PIPEDA and Law 25

A pre-checked box and a 4,000-word privacy policy are not consent in Canada. Here's what PIPEDA and Law 25 actually require, and how to prove it later.

June 25, 2026Read

How to Write a PIPEDA Breach Notification Letter That Holds Up

The letter you send after a breach is a legal document, a trust repair, and a public record all at once. Here's exactly what it must say and how it should sound.

June 22, 2026Read

PIPEDA Breach Reporting: The 72-Hour Myth and What Actually Triggers a Report

Not every breach has to be reported — and the test that decides isn't a clock. It's a phrase: 'real risk of significant harm.' Here's how to apply it before the panic sets in.

June 16, 2026Read

Quebec Law 25 Compliance Checklist: What Your Business Actually Has to Do in 2026

Three years after Law 25 started rolling out, most Quebec businesses still aren't sure whether they're actually compliant. Here's the checklist that cuts through it.

June 11, 2026Read

Third-Party Risk: Why Your Privacy Compliance Is Only as Strong as Your Vendors'

When you hand customer data to a vendor, you don't hand off the responsibility. Under PIPEDA, their breach becomes your problem — which is why vendor risk is privacy work, not procurement paperwork.

June 6, 2026Read

Your Data Is Probably Already Leaving Canada — What PIPEDA Expects You to Do About It

If you use Google Workspace, Microsoft 365, a US CRM, or basically any mainstream SaaS, your customers' personal data crosses the border every day. Here's what the law actually asks of you.

June 3, 2026Read

What Is a ROPA, and Why It's the Foundation of Every Privacy Program

Almost every privacy obligation you have assumes you know what data you hold and why. A ROPA is that knowledge, written down. It's unglamorous, and it's the most important document you'll build.

May 30, 2026Read

Healthcare

PHIPA Compliance for Ontario Clinics: A Practical Guide for Health Custodians

Every Ontario clinic is a health information custodian under PHIPA — whether or not anyone there has read the act. Here's what compliance actually requires, in clinic terms.

May 27, 2026Read

CASL

CASL Express vs Implied Consent: The Difference That Decides Whether You Can Send That Email

CASL doesn't just require consent to send marketing email — it requires the right kind, and implied consent quietly expires. Get this distinction wrong and a routine newsletter becomes a regulatory problem.

May 23, 2026Read

PIPEDA

Do I Need a Privacy Policy for My Canadian Website? (Short Answer: Yes)

If your website has a contact form, an email signup, or even Google Analytics, you're collecting personal information — and under PIPEDA, that means you need a privacy policy. Here's what it has to say.

May 20, 2026Read