Privacy & Data Protection
Canadian privacy law now carries real penalties and real deadlines. Most organisations discover the gap when someone asks them to prove compliance.
We assess what personal information you hold, where it goes and what the law requires of you — then help you close the distance between the two. The work is grounded in privacy engineering rather than policy templates, because a privacy programme that lives only in a document fails at the first access request.
Most privacy work starts for one of four reasons
A regulator or customer has asked
Someone wants evidence of your privacy programme and you do not have it in a form you can hand over.
You do not know where the data is
Personal information has spread across systems, vendors and spreadsheets, and nobody has mapped it.
You operate across provinces or borders
Quebec, British Columbia and Alberta each impose their own regime, and transfers outside Canada carry their own conditions.
You need a Privacy Officer
The role has to be designated and it has to be someone competent to hold it. Not every organisation has that person in house.
The regimes that apply to Canadian organisations
Which of these binds you depends on where you operate, what sector you are in and whose information you hold. Establishing that is the first thing we do, because organisations routinely assume the wrong one applies.
PIPEDA
The federal baseline for personal information collected in the course of commercial activity, including breach reporting to the Privacy Commissioner.
Quebec Law 25
The strictest private-sector regime in the country. Mandatory privacy impact assessments, a designated Privacy Officer, data portability and limits on automated decision-making.
PIPA — British Columbia and Alberta
Substantially similar provincial regimes with their own commissioners and their own breach notification duties.
Health information
Provincial health privacy statutes impose separate safeguard and notification obligations on anyone handling health records.
Cross-border transfer
What you must assess and disclose before personal information leaves the province or the country, including under Law 25.
Contractual privacy terms
The obligations your own customers have pushed down to you, which frequently exceed what the statute requires.
From what you hold to what you can prove
Establish scope
Which regimes apply to you, which entities and jurisdictions are in play, and what has already been done.
Map the data
What personal information you collect, why, where it lives, who it is shared with and how long it stays. This is the step most programmes skip and later regret.
Assess the gap
Measured against the obligations that actually bind you, separating legal requirements from good practice so you can decide what to fund.
Build and embed
Impact assessments, records of processing, retention rules and the internal process that keeps them current after we leave.
Three ways this is usually bought
Assessment and gap analysis
A defensible picture of where you stand: data inventory, records of processing, privacy impact assessments and a prioritised remediation plan you can take to a board.
Privacy Officer support
Holding or supporting the designated role on a retained basis — handling access requests, complaints, assessments and the regulator relationship. Scope and model are set with each client.
Privacy by design
Working alongside engineering while a system is being built: data minimisation, retention, consent, de-identification and access control decided at design time rather than retrofitted.
What you receive
- A data inventory and processing record showing what personal information you hold and on what basis
- A gap assessment against each regime that applies, with legal obligations separated from recommended practice
- Privacy impact assessments in a form that satisfies the requirement rather than merely referencing it
- A prioritised remediation plan sequenced by exposure, not by ease
- A debrief for leadership covering what is owed, to whom, and what happens if it is not done
Timing and cost
Privacy work scales with the number of systems holding personal information, the number of jurisdictions you operate in and how much documentation already exists. A single-province organisation with one core platform is a different engagement from a multi-province group with a vendor estate.
We do not publish packages or rates. Every engagement begins with a short call, followed by a written scope and a fixed price for that scope before any work starts.
What we need to scope it
Where you operate, roughly how many systems hold personal information, whether you have a designated Privacy Officer today, and what has triggered the enquiry.
Common questions
Are you giving legal advice?
Does Law 25 apply to us if we are not based in Quebec?
Can you act as our Privacy Officer?
We already have a privacy policy. Is that enough?
Can you work in French?
Tell us what prompted this
A regulator, a customer questionnaire, a new system, or simply not knowing where you stand. Thirty minutes and we will tell you which regime applies and what is worth doing first.
Start with a scoping call