From Ad Hoc to Audited: A Maturity Model for Canadian Privacy Programs

A privacy programme matures in five stages: nothing written, documents without practice, practice without evidence, evidence without independence, and independently verified. Almost every Canadian small and mid-sized business I have worked with sits at stage two or three and describes itself as being at four.

The gap matters because the stages fail differently, and knowing which one you are at tells you what to do next far better than a generic checklist does.

The five stages

Read that table and be honest about which row describes your last twelve months, not your intentions.

How do you tell stage two from stage three?

Ask this: in the last quarter, what happened without anyone deciding to make it happen?

Stage two programmes are entirely human-triggered. The vendor review occurs because someone remembered. The access review occurs because an audit is coming. The retention rule exists in a document and has never deleted anything. There is nothing wrong with the documents; there is no machinery behind them.

Stage three is where the triggers move into systems. A renewal date opens a review. A new high-risk system opens an assessment. A retention rule actually deletes. The volume of privacy work goes up at this stage, which surprises people, but it goes up because work that was previously being skipped is now being done.

The single cheapest move from two to three: pick your three most consequential controls and give each one a system trigger. Not all of them. Three.

How do you tell stage three from stage four?

Ask what you could produce for a specific date six months ago.

Stage three does the work and loses the record. The access review happened in June, and the evidence is a memory and possibly a Slack message. Stage four does the same work and leaves an artefact with a date on it, without anyone deliberately archiving anything.

This is the stage most companies underestimate, because the work feels identical while you are doing it. The difference only appears when a buyer, an auditor, or a regulator asks, and by then it cannot be manufactured honestly. What auditors actually ask for goes deeper on what makes an artefact acceptable.

What does stage five require that four does not?

Independence and review. Someone who did not run the control tests whether it worked, and management formally reviews the results and decides something.

For a small company, independence does not mean hiring an audit firm. It can mean the finance lead testing the access review, or an external test once a year on the two controls that matter most. What it cannot mean is the person who runs the control also being the person who confirms it works.

Management review is the piece that ISO frameworks require and everyone else skips. It is a meeting where the programme's results are looked at and decisions are recorded. Twice a year is enough for most companies. Its real function is to keep the programme alive when the person who built it moves on, which is the most common way privacy programmes die.

Where should you actually aim?

Stage three for most Canadian SMBs, stage four if you sell to enterprises or handle health or financial data, stage five only if a certification or a regulator requires it.

I want to be blunt here because the industry is not. A twelve-person company does not need stage five, and pursuing it will consume attention that would produce more risk reduction if spent on stage three basics. Getting retention actually enforced and access actually reviewed beats a beautifully documented management system that describes controls nobody runs.

The exception is a hard commercial one. If your buyers demand SOC 2 or ISO 27001, you need stage four evidence regardless of size, because the audit tests evidence rather than intent. That is a sales requirement wearing a compliance costume, and it should be budgeted as one.

For the sequencing question specifically, the order to do compliance in sets out what to build first.

This is general information, not legal advice.

Valdra is built to move a programme from stage two to stage four without adding headcount: triggers replace reminders, and the evidence accumulates as controls run.