Security solutions by need

Most private-sector organizations in Ontario fall under PIPEDA, the federal privacy law. It requires reasonable safeguards for personal information and, since 2018, mandatory breach reporting to the Privacy Commissioner when a breach creates a real risk of significant harm.

Health information custodians in Ontario also answer to PHIPA, overseen by the Information and Privacy Commissioner of Ontario. Clients with customers in Quebec have Quebec Law 25, which adds privacy impact assessments and a named person responsible for personal information. Anyone who takes card payments has PCI DSS through their acquiring bank.

In practice, the questions arrive from three places: a client security questionnaire, a cyber insurance renewal form, or a regulator letter after something has gone wrong. The work below is aimed at answering those with evidence.

Each line links to the full industry page. These are the sectors we have pages for; if yours is not listed, the general approach still applies.

• Law firms: PIPEDA plus Law Society of Ontario expectations on protecting client confidentiality. The usual gaps are shared mailboxes, document management permissions and wire instructions sent by email. IT for law firms
• In-house legal departments: Legal holds, eDiscovery exports from Microsoft 365 and privileged material kept out of general SharePoint sites. IT for in-house legal departments
• Accounting and CPA firms: PIPEDA and client tax data. Tax season is when phishing and fake CRA messages peak, so MFA and email authentication come first. IT for accounting and cpa firms
• Healthcare: PHIPA for custodians, including notice to patients and the IPC for certain breaches. The front desk, the EMR and shared workstations are where most of the work sits. IT for healthcare
• Dental practices: PHIPA again, plus imaging systems and practice software that often run on an old server nobody wants to touch. IT for dental practices
• Financial services: PIPEDA, plus whatever your dealer, regulator or bank partner puts in their own questionnaire. Expect questions on MFA, logging and vendor access. IT for financial services
• Mortgage brokerages and lenders: Identity documents and income records travel by email. The work is secure intake, retention and payout fraud controls. IT for mortgage brokerages and lenders
• Insurance brokerages: PIPEDA and carrier requirements, with broker management systems and email as the main exposure. IT for insurance brokerages
• Retail: PCI DSS for card payments: segmented point-of-sale networks, no card data stored where it should not be, and patched terminals. IT for retail
• Property management and real estate: Tenant files, payment details and many part-time users. Offboarding and shared-account cleanup are the recurring jobs. IT for property management and real estate
• Manufacturing: Production systems that cannot be patched on a normal schedule, ERP downtime and supplier email fraud. Segmentation and tested restores matter more than compliance paperwork. IT for manufacturing
• Construction: Site laptops and phones, project file sharing with subcontractors, and payment-change fraud on progress draws. IT for construction
• Nonprofits and charities: Donor data under PIPEDA where commercial activity applies, volunteers with accounts, and tight budgets that make Microsoft nonprofit licensing worth checking. IT for nonprofits and charities
• Professional services: Client confidentiality clauses and security questionnaires from larger customers. IT for professional services

Whatever the sector, the technical work tends to be the same short list, checked against the specific rule.

• A written inventory of where personal information lives: mailboxes, SharePoint, file servers, line-of-business apps.
• Multi-factor authentication on every account, with stronger methods for administrators.
• Email authentication (SPF, DKIM and DMARC) so your domain is harder to forge. Our email spoofing check shows where yours stands.
• Backups kept out of reach of the office network, with test restores on record.
• An incident contact sheet and a breach decision path, so the reporting question is answered in hours rather than weeks. Our incident contact sheet is a starting point.
• Evidence for questionnaires and insurance renewals: screenshots, policy exports and dates.

We do not certify compliance, act as your privacy officer or give legal advice. When a breach may be reportable, we gather the facts and timeline your lawyer or privacy lead needs to make that call. For security questionnaires, we answer the technical questions accurately, including the ones where the honest answer is "not yet".

If you have a questionnaire or renewal form in front of you, send it to us with a list of your systems and we will mark which answers you can already evidence. If something has already happened, call the 24/7 incident line at (289) 582-9930. We are staffed 24/7 for everything else too.