PIPEDA compliance for Canadian organisations, built to still hold when Bill C-36 replaces the Act.
One Canadian team maps the data, fixes the consent, and proves the safeguards. Personal information protection and consent management sit with the same engineers, so nothing falls between the person who writes the policy and the person who owns the system.
What personal information you hold, why you hold it, and what people actually agreed to. Consent management starts by matching the language at the collection point to what the systems really do with the data afterwards.
The security controls the safeguards principle asks for, evidenced rather than described in a policy. Bill C-36 was tabled 2026-06-15, and the work it would require is the work PIPEDA already asks for, so nothing here is wasted if the Act changes.
PIPEDA breach reporting decisions, notice to affected individuals, and a record of every breach, not just the reportable ones. The law makes you keep those records for two years whether a breach met the real risk of significant harm test or not (Office of the Privacy Commissioner of Canada).
The Privacy Commissioner cannot fine you or order a change today. Bill C-36 would alter both, which is the honest reason to start privacy compliance work in Canada now rather than after royal assent.
IN PRODUCTION
We thought we were fine because we had a privacy policy. SMEnode asked to see the list of systems holding customer data and we couldn't produce one. That was the finding. Eleven weeks later we had the inventory, the consent language matched what we actually do, and the breach log existed.
Written by the engineer who runs this work, not by a product team. Most organisations have a privacy policy and no privacy programme, so the policy describes a company that doesn't exist.
Good PIPEDA work starts with an inventory, not a document. You can't honour a purpose limit, a retention limit, or an access request without knowing which systems hold personal information and why each one has it. A privacy policy audit on its own tells you what you claim. The inventory tells you what you do, and the gap between the two is the finding. That inventory is the boring half nobody funds, and it's the half every complaint tests. The ten principles then stop being an abstract list: accountability means a named person, consent means language matching what you actually do, and safeguards mean controls somebody verified.
We work from the systems outward, which is the reverse of how a template does it. The risk sits in three places. A privacy policy written by a lawyer who never saw the database. Consent collected once, years ago, for purposes that have since expanded, which is why consent management is a running job rather than a launch task. And a breach process that exists on paper but has never been run, so the first real incident becomes a decision made in a panic by whoever is awake. Personal information protection fails at those three seams far more often than it fails at the firewall.
The enforcement picture as of 2026-09-02, stated precisely because most pages get it wrong. The Commissioner can investigate, audit under section 18 where reasonable grounds exist, publish findings, and sign a compliance agreement under section 17.1. It cannot order you to change a practice, award damages, or fine you. Binding remedies come from a Federal Court application, which can award damages. Knowingly failing to report a breach or keep the records is a separate offence carrying fines. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled 2026-06-15 and sits at first reading. It would replace Part 1 of PIPEDA, create a Digital Safety and Data Protection Commission with binding order power, and carry penalties up to the greater of 10 million dollars or 3 percent of gross global revenue (Gowling WLG, 2026-06-24; McCarthy Tetrault, 2026-06-16).
Four steps, and step 01 is the one that changes the conversation. We ask for a list of every system holding personal information about customers or staff, and almost nobody can produce it. That isn't a criticism, it's the normal starting point, and it's why privacy work that begins with policy language fails. The inventory decides the scope of everything after it, including how much you actually need.
Every system holding personal information, what it holds, why, who can reach it, how long it keeps it, and whether it leaves Canada. We write down what nobody has written down.
We compare what you tell people at collection against what the systems actually do, then rewrite the language and the collection points so the two match. That is consent management with the plumbing attached, not a banner.
The safeguards principle needs controls that work, not controls described. We verify them and keep the proof where a reviewer can find it.
The reporting decision, the notice to individuals, and the log of every breach. Then we run a tabletop, because an untested process is a document.
Answers first, including the one where we say you don't need us yet. An architect takes the call, not a salesperson.
LET'S CONNECT
A senior engineer replies within an hour, 24/7.