PIPEDA Compliance Checklist for Canada: The IT Controls Small Businesses Need

PIPEDA is built on ten fair information principles. The ones that touch IT most directly are safeguards (personal information must be protected by security appropriate to its sensitivity), limiting retention (do not keep data longer than needed), and accountability (someone in your organization is responsible for compliance). Since 2018, PIPEDA also requires organizations to report breaches that pose a real risk of significant harm to the Privacy Commissioner and to affected individuals, and to keep records of all breaches.

The law expects physical, organizational, and technological safeguards. On the technology side, that generally means: access controls so staff only see the data they need, encryption for sensitive data at rest and in transit, protection against malware and intrusion, secure disposal of old equipment and data, and monitoring that lets you detect a problem when it happens, because you cannot report a breach you never noticed.

• Know where personal information lives: every system, database, mailbox, and spreadsheet. 2. Restrict access by role and remove access promptly when staff leave. 3. Turn on multi-factor authentication everywhere, especially email and admin accounts. 4. Encrypt laptops, mobile devices, and backups. 5. Keep systems patched and endpoints protected. 6. Maintain tested, encrypted backups with defined retention periods. 7. Put monitoring or managed detection in place so incidents are caught quickly. 8. Document an incident response plan that includes the breach-reporting steps. 9. Securely wipe or destroy retired hardware. 10. Train staff on phishing: most breaches start with an inbox.

The breach rules are where unprepared businesses get hurt. If personal information is exposed and the breach poses a real risk of significant harm, you must notify the Privacy Commissioner and affected individuals as soon as feasible, and keep a record of every breach for at least two years: reportable or not. That requires knowing what happened, what data was touched, and when: exactly the visibility that logging, monitoring, and detection provide.

Most small and mid-sized businesses do not have in-house staff to run access reviews, encryption, monitoring, and incident response. A managed IT provider implements and operates these safeguards day to day, and gives you the documentation trail that demonstrates diligence. Compliance is ultimately your organization's responsibility, but the technical foundations can be handled for you.

One important exception on scope: if your organization holds personal health information in Ontario, a dental office, clinic or other health information custodian, the governing law is PHIPA rather than PIPEDA, and the notification duties differ. Two other sectors carry obligations that sit on top of PIPEDA rather than beside it, and we set out the technical controls behind them on our managed IT for law firms and IT support for accounting and CPA firms pages. The technical safeguards overlap almost entirely, but the obligations do not. Our dental office IT guide for Ontario practices works through what that looks like in a clinical setting, and our IT and cybersecurity checklist for accounting firms does the same for CPA and bookkeeping practices.

Schools are another case where the applicable law needs checking: public school boards fall under Ontario's public-sector privacy legislation, while independent schools and tutoring centres may be subject to PIPEDA for some activities, so confirm the position with counsel. The safeguards are the same either way, and our IT and cybersecurity checklist for schools applies them to student accounts, shared devices and student records.

IT Rapid Support helps businesses across Toronto and the GTA put the technical safeguards behind PIPEDA compliance in place: access controls, encryption, MFA, managed detection and response, and tested backups. Call (289) 582-9930 to review where your current setup stands.