The Complete Guide

How Canadian privacy compliance
actually works.

PIPEDA, Law 25, CASL, 8 provincial health acts, plus SOC 2 and ISO 27001 evidence, all in one Canadian platform. Here's exactly how it works, who it's for, and what 'compliant' really means.

Start the Free Quick CheckTour the Platform
Free
Plan to start
8
Provincial health acts
EN/FR
Fully bilingual
🇨🇦
Data in Canada
Product Architecture

Every feature lives in exactly one place

Two clicks (or two keystrokes) gets you anywhere in Valdra. Each area has a clear job.

Area 1Free+

Home

Your daily dashboard. Posture score, AI Agent inbox, breach forecast, regulatory alerts, reports.

Area 2Free+

AI Governance

Govern every AI system. Registry, EU AI Act risk classifier, obligations map, Annex IV / FRIA docs, shadow-AI discovery.

Area 3Free+

Frameworks

Which laws apply to you, and prove you follow them. PIPEDA, Law 25, CASL, GDPR, AB/BC PIPA, 8 health acts, PIAs.

Area 4Starter+

Operations

Things needing a human now. DSAR queue, complaints, breach autopilot, consent center, cookie scanner.

Area 5Starter+

Vendors

Third parties touching your data. Inventory, DPAs, TIAs, integrations, shadow AI detection, eSign.

Area 6Starter+

Data

Where your data lives, and when it dies. Discovery, classification, flows, lineage, DB scanning, retention, destruction.

Area 7Professional+

Security

SOC 2 / ISO 27001 / technical controls. Frameworks, evidence locker, continuous monitoring, threat models.

Area 8Starter+

Training

The people layer. PIPEDA / CASL / Law 25 courses with audio narration, custom training, phishing simulation.

Area 9Free+

Documents

Generate the actual paperwork. AI-templated privacy policy, DPA, ToS, retention schedule, marketplace.

Area 10Professional+

Trust

What you show customers. Public Trust Center, readiness mark, signed certificates, status page.

See all features in detail →
Mental Model

5 ideas that unlock the product

If you remember these, the rest of Valdra makes sense.

Compliance is a layered cake

Six layers, each building on the next. Valdra gives you all of them in one product.

Public Trust
Evidence
Controls
Assessments
Applicability
Org + Data

Every feature in the bottom 5 layers feeds the public score at the top.

1

Compliance is a layered cake

Trust → Evidence → Controls → Assessments → Applicability → Org data. Valdra gives you all six layers in one place, mapped to Canadian law.

2

One score, many feeders

There's no separate 'Canadian readiness' number vs. 'SOC 2 readiness' number. They're the same number, viewed from different angles.

3

AI is connective tissue, not the product

AI writes letters, drafts policy, classifies data, summarizes alerts. But every actual decision is rules-based and auditable, so you can explain it to regulators.

4

PII anonymized before any LLM

Every AI call goes through PII anonymization before reaching the LLM.

5

Plan tiers map to organizational maturity

Free = you don't know what you don't know. Starter = first paying contracts ask for proof. Professional = you have a privacy person, need SOC 2, and want the Partner API and MCP server. Enterprise = a privacy team at scale with SSO and SCIM.

Compliance Journey

From signup to compliant in 8 phases

A Canadian business walks in. Here's every step Valdra walks them through to be audit-ready.

Phase 0

Discover

Free quick check + view of existing Trust Centers. No signup.

Phase 1

Account

Magic-link signup, 2FA. Enterprise adds SSO + SCIM provisioning.

Phase 2

Applicability

Answer a short set of applicability questions → receive personalized list of laws that apply to YOU.

Phase 3

Baseline Assessments

Run each applicable assessment. PIPEDA · Law 25 · CASL · Provincial · Health acts.

Phase 4

Foundation Tracks

3 parallel: Public-facing docs · Vendors managed · People trained. Privacy Policy, DPA, Cookie Banner, Vendor Inventory, courses.

Phase 5

Data Mapping

Discovery → Classification → Flows → Lineage → Retention. Answer 'where is John Doe's data?' in seconds.

Phase 6

Security Hardening (Professional+)

SOC 2 · ISO 27001 · Continuous Monitoring · Gap Analysis. SOC 2-ready evidence package.

Phase 7

Trust Outbound

Publish your Trust Center and earn the Valdra readiness mark at 75%+ readiness (Professional+).

Baseline Compliant
✅ You're audit-ready

Plus the ongoing operational loop keeps running: Agent inbox, DSARs, breach autopilot, continuous monitoring.

Then the operational loop keeps running: daily, weekly, monthly, quarterly
Customer Journeys

Three example Canadian businesses

Click each tab to see how Valdra could unfold for that segment. These are hypothetical scenarios: the companies, people and numbers are illustrative, not customers.

Small Business

Maple Halo Coffee Roasters

Halifax · 6 employees · $1.2M revenue · DTC e-commerce

Starter
Plan tier
$249/mo
Plan price
Pass a retailer's vendor review
Goal
PIPEDA and CASL
Focus

The Trigger

A regional grocery chain emails Sara (owner): 'Before we carry Maple Halo in our stores, please complete our vendor questionnaire including PIPEDA compliance status.' She has two weeks to respond.

Day 1 (60 minutes)

1

First: Free quick check → signup → applicability questions. Confirmed laws: PIPEDA + CASL.

2

Next: Full PIPEDA assessment. A score and a prioritized gap roadmap.

3

Then: Generate a Privacy Policy. AI drafts it in the business's name with PIPEDA citations.

4

Last: Set up the public access request intake form and test it.

First Week

  1. 1.Day 2: Track DPAs with its email and helpdesk vendors
  2. 2.Day 3: Import historical CASL consent records
  3. 3.Day 4: Cookie Scanner lists the site's cookies and trackers
  4. 4.Day 5: Train Sara and her staff on PIPEDA fundamentals
  5. 5.Day 6: Generate a cookie policy and an acceptable use policy
  6. 6.Day 7: Respond to the grocery questionnaire with documented answers

Result

Sara answers the questionnaire with documented evidence instead of guesses, and her PIPEDA score keeps rising as she closes gaps.

For people like Sara

“Get a documented PIPEDA program in place. Answer the vendor questionnaires that enterprise buyers send.”

Start free
How Scoring Works

Will my organization ever be 100% compliant?

The #1 question prospects ask. Here's the honest answer.

The short answer

No one ever becomes '100% compliant', and that's by design. Privacy compliance isn't binary like a driver's licence. It's a posture you maintain, scored on a 0 to 100 maturity scale where 100 is intentionally unreachable, compliance is regulator judgement, and a strong 78/100 already means you're in great shape.

The bands that actually matter

🔴0–40
High risk

Likely OPC findings if audited. You're commercially exposed.

🟠40–60
Starting

Defensible in some areas but obvious gaps still visible to auditors and prospects.

🟡60–75
Defensible

Good-faith-effort defense visible to OPC. Below the readiness mark threshold.

🟢75–85
Strong: most businesses target here

Most enterprise customers happy here. The Valdra readiness mark can be issued from 75. The realistic target.

🟢85–95
Mature

Board-confident. SOC 2-audit-ready posture. Enterprise procurement breeze.

⭐95–100
Excellent

Rare. Usually only at orgs with full-time privacy teams who treat this as an ongoing investment.

The car analogy

Compliance is like vehicle safety. A car never reaches '100% safe'; you keep maintaining it. What matters is: are the brakes serviced, do the airbags work, is the seatbelt in use. PIPEDA is the same: are your principles documented, is your DSAR process working, are breaches being handled. 78/100 means you'd pass inspection. 100/100 isn't even a number on the test.

What to actually optimize for

OPC defensibility (good-faith effort)≥ 60
Earn the Valdra readiness mark≥ 75
Most B2B vendor questionnaires≥ 75
Enterprise customer due-diligence≥ 80
Cyber insurance underwriter friendly≥ 80
SOC 2 Type 2 readiness package≥ 85
Board confidence in privacy posture≥ 85
Best-in-class public positioning≥ 90
The takeaway

Stop chasing 100. Start chasing 75+ with documented evidence and active operations. That score, plus a clean DSAR queue, a maintained breach register, a published Trust Center, and ongoing training: that is what compliance looks like in Canada.

Decision Matrix

Tell us about your business

We'll tell you exactly what to turn on. Real situations, real features.

I handle personal data at all
PIPEDA assessment · Privacy Policy doc · Documents
I have Quebec residents
+ Law 25 assessment · CAI report templates
I'm intra-provincial in AB or BC
+ AB-PIPA / BC-PIPA assessment
I'm a health custodian
+ applicable provincial health-act assessment (8 options)
I send commercial email
+ CASL Consent Center · Consent Forms · Unsubscribes (10-day SLA)
I have a public website
+ Cookie Scanner · Cookie Banner (Professional+)
I have third-party vendors
+ Vendor Inventory · DPA Tracker · Disclosure Log
My vendors are outside Canada
+ Vendor Transfer Impact Assessments (Professional+) for Law 25 art. 17
I'm launching a new product touching PII
+ PIA Threshold → PIA Wizard
I have employees
+ Training courses · cert tracking
Employees might click suspicious links
+ Phishing Simulation (Professional+)
I want SOC 2 or ISO 27001
+ Security suite (Professional+): controls, evidence, monitoring
I run AWS or use GitHub
+ Continuous Monitoring (Professional+)
I want to prove compliance publicly
+ Trust Center · Readiness mark (Professional+)
Customers want proof they can check themselves
+ Readiness mark at a 75%+ score and signed certificates (Professional+)
I want OPC enforcement trend intel
+ Enforcement Themes (Professional+)
I want my breach risk forecast
+ Breach Forecast (Professional+)
I want privacy-safe AI in my workflow
+ AI Copilot · Document Redactor
A breach happens
→ Incident Log · RROSH · OPC Report · Letters · Register
A DSAR or complaint arrives
→ Privacy Rights queue
I want compliance data in my own tools or AI assistant
+ Partner API · MCP server (Professional+)
More than 25 team members
+ Unlimited members · SSO + SCIM (Enterprise)
I make automated decisions about people
+ Law 25 art. 12.1 evidence (PIA wizard)
FAQ

Common questions

Click any question to expand.

No, and that's by design. Valdra's score is a 0 to 100 maturity gauge, not a pass/fail certification. Above 85 you're in mature-org territory; above 75 your organization can issue the Valdra readiness mark; above 60 you have a good-faith-effort OPC defense.

The OPC doesn't issue compliance certificates. Independent attestation comes from a SOC 2 Type 2 report or an ISO 27001 certificate. The Valdra readiness mark states the readiness Valdra measured from your own assessments and the date; it is not an independent audit.

Vanta and Drata are SOC 2 automation tools built for the US market. They speak SOC 2 + GDPR + ISO 27001 well; they speak PIPEDA, Law 25, PHIPA and CASL poorly or not at all.

Valdra is the inverse: Canadian first, with SOC 2 + ISO 27001 as expected enterprise features. For a Canadian company with US enterprise customers, you get both layers in one place.

Basic PIPEDA defensibility: 1 week. Solid PIPEDA + CASL + DSAR program: 1 month. Law 25 ready: 2 to 4 weeks after PIPEDA baseline. SOC 2 Type 1: 3 to 6 months. SOC 2 Type 2: 9 to 12 months. PHIPA program: 2 to 4 months.

Log the incident in Valdra as soon as you learn of it and triage it with AI. Run the real risk of significant harm (RROSH) assessment. If there is a real risk of significant harm, Valdra drafts the OPC report and the notification letters.

PIPEDA s.10.1 says to report to the OPC and notify affected individuals as soon as feasible after you determine the breach has occurred. The law sets no fixed number of hours. Valdra recommends an internal target of 72 hours; that is our recommendation, not a legal deadline.

The Valdra application and its database are hosted in Canada, in Beauharnois, Quebec. A few service providers process limited data outside Canada for specific functions; they are listed by category on our sub-processor page.

Use our sub-processor list to support your own assessment under Quebec Law 25.

Yes, fully bilingual EN/FR by design. The UI, generated documents, breach letters, public intake forms, training course content, and the Quebec regulator form templates render in both languages. Audio narration in courses uses browser-native French voices.

Ready to find your privacy gaps?

Take the free Canadian privacy quick check. No signup, no credit card. Get results in 5 minutes.

Start Free AssessmentOr Create Account
✓ No credit card✓ 5-minute results✓ Canadian data residency

Our own compliance

We run our own compliance programme inside Valdra — the product we sell. Our SOC 2, ISO 27001 and ISO 42001 programmes are actively in progress; we do not claim certifications we do not yet hold.

Valdra readiness mark, click to verify
  • PIPEDA
  • Law 25 (Quebec)
  • CASL
  • Data hosted in Canada 🇨🇦
  • AI governance
View our Trust Centre

Measured by Valdra from our own assessments, not audited by a third party. Click the mark to open its verify page and see what it covers.