Privacy program build and refresh
A privacy program is the set of roles, policies and habits that let you show you handle personal information properly. We build programs sized for small and mid-sized Canadian organizations, mapped to PIPEDA's ten fair information principles and the provincial rules that apply to you.
Reviewed by the ITRS security team · Last updated
This page is general information, not legal advice. For advice on your obligations, speak with your lawyer.
The 10 fair information principles in practice
PIPEDA's Schedule 1 sets out ten principles. Here is what each one usually means for an organization of 10 to 300 people:
| Principle | What it looks like in practice |
|---|---|
1. Accountability | A named person responsible for privacy, and contracts that protect data you send to vendors |
2. Identifying purposes | You know and can state why you collect each type of information |
3. Consent | Forms, websites and processes obtain meaningful consent at the right time |
4. Limiting collection | Forms ask only for what you need |
5. Limiting use, disclosure and retention | A retention schedule, applied in your systems |
6. Accuracy | Records are kept current where it matters for decisions |
7. Safeguards | Security controls appropriate to the sensitivity of the data |
8. Openness | A clear, accurate privacy policy |
9. Individual access | A process to answer access requests on time |
10. Challenging compliance | A way to receive and resolve privacy complaints |
Accountability: roles and the privacy officer
PIPEDA requires an organization to designate an individual or individuals accountable for compliance, and to make that person's identity known on request. Quebec goes further: by law the person with the highest authority in the enterprise is the person in charge of the protection of personal information, may delegate the function in writing, and the title and contact information must be published on the website.
We help you decide who holds the role, write a short mandate, and set up the supporting structure: who handles access requests, who assesses incidents, who signs off on new systems and vendors. For most smaller organizations this is a part-time responsibility of an existing leader, supported by clear procedures.
Policies and notices
We draft or refresh the documents that make the program visible: an external privacy policy written in plain language, internal privacy and information-handling policies, consent wording for forms and websites, and employee privacy notices. The Office of the Privacy Commissioner's Guidelines for obtaining meaningful consent set out seven guiding principles, including emphasizing key elements, allowing individuals to control the level of detail they get and when, and making consent a dynamic and ongoing process. We use those as the test for every notice we write. Your counsel reviews the final text.
Access requests and complaints
Under PIPEDA, organizations must respond to an access request within 30 days, with limited room to extend. We set up an intake route, a request log, search procedures for your actual systems, and template responses, so a request doesn't become a scramble.
We also design a complaints process: how a complaint is received, who investigates, how the outcome is recorded and how lessons feed back into policy.
Vendors and transfers
PIPEDA holds you responsible for personal information you transfer to a third party for processing, and requires contractual or other means to provide a comparable level of protection. We list the vendors that touch personal information, review their terms for security, breach notification, sub-processing and data location, and give you standard clauses for new contracts. Where data goes outside Canada, we help you meet the transparency expectations the OPC has set, and the assessment Quebec requires before personal information is communicated outside the province.
Breach readiness
Every program needs a breach plan that people can follow at 2 a.m.: who to call, how to preserve evidence, how to assess real risk of significant harm, who decides on reporting and notification, and how breach records are kept. We write the plan, link it to your incident response plan, and run a short tabletop exercise so the people named in it have practised their roles.
Maintaining the program
Annual review
Update the data inventory, policies and vendor list; confirm the privacy officer and backups.
Training
Short, role-specific privacy training at onboarding and yearly refreshers.
Change triggers
New systems, vendors, AI tools or cross-border services go through a privacy check before launch.
Evidence file
Keep records of training, reviews, requests, complaints and breaches in one place so you can show your work.
Frequently asked questions
It depends on where you operate and what you do. PIPEDA covers private-sector commercial activity in most provinces, while Quebec, Alberta and British Columbia have their own private-sector laws, and Ontario health custodians are governed by PHIPA. Many organizations deal with more than one. We map the program to every regime your counsel confirms applies.
A policy is one piece. A program is the policy plus the people, procedures and records that make it true: an accountable person, a data inventory, consent practices, an access-request process, vendor controls, a breach plan, training and periodic review.
We can support the technical and operational parts on an ongoing basis, such as access-request searches, vendor reviews, retention configuration and breach assessments. Accountability for the program stays with a person inside your organization.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related.
- PracticePrivacy, Data Governance & AIPIPEDA and Quebec Law 25 readiness, data mapping, breach notification and AI governance.
- ServicePrivacy breach assessment and notification supportAfter a cyber incident, someone has to turn log files and mailbox exports into a defensible answer to three questions: whose information was involved, how much risk it…
- ArticlePIPEDA Compliance Checklist for Canada: The IT Controls Small Businesses NeedA PIPEDA compliance checklist for Canadian small and mid-sized businesses: the IT safeguards, breach reporting and record-keeping the law expects, with practical notes…
Not sure what your obligations require of your systems?
Speak with our privacy practice. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.