PIPEDA compliance, built for the law that's coming as well as the one in force
Trusted by
PIPEDA compliance, three pillars, one operator.
One Canadian team maps the data, fixes the consent, and proves the safeguards. Personal information protection and consent management sit with the same engineers, so nothing falls between the person who writes the policy and the person who owns the system.
Data and consent
What personal information you hold, why you hold it, and what people actually agreed to. Consent management starts by matching the language at the collection point to what the systems really do with the data afterwards.
Safeguards you can show
The security controls the safeguards principle asks for, evidenced rather than described in a policy. Bill C-36 was tabled 2026-06-15, and the work it would require is the work PIPEDA already asks for, so nothing here is wasted if the Act changes.
A breach process that holds
PIPEDA breach reporting decisions, notice to affected individuals, and a record of every breach, not just the reportable ones. The law makes you keep those records for two years whether a breach met the real risk of significant harm test or not (Office of the Privacy Commissioner of Canada).
Does PIPEDA Compliance work the same way in every industry?
No. The PIPEDA Compliance work is the same craft in every sector, but the conditions around it are not. In healthcare that means provincial health privacy law; in legal, Law Society duties and solicitor-client privilege; and in government, Protected A, B and C data handling. We keep the service and change the part that bends.
The federal baseline, and where provincial health law takes over.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
The notification duty, documented before you need it.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
The baseline that applies regardless of classification.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
What do you need from PIPEDA Compliance?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- PIPEDA Compliance
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584PIPEDA compliance in Canada, made real.
Written by the engineer who runs this work, not by a product team. Most organisations have a privacy policy and no privacy programme, so the policy describes a company that doesn't exist.
A privacy policy isn't a privacy programme.
Good PIPEDA work starts with an inventory, not a document. You can't honour a purpose limit, a retention limit, or an access request without knowing which systems hold personal information and why each one has it. A privacy policy audit on its own tells you what you claim. The inventory tells you what you do, and the gap between the two is the finding. That inventory is the boring half nobody funds, and it's the half every complaint tests. The ten principles then stop being an abstract list: accountability means a named person, consent means language matching what you actually do, and safeguards mean controls somebody verified.
Where the risk actually sits.
We work from the systems outward, which is the reverse of how a template does it. The risk sits in three places. A privacy policy written by a lawyer who never saw the database. Consent collected once, years ago, for purposes that have since expanded, which is why consent management is a running job rather than a launch task. And a breach process that exists on paper but has never been run, so the first real incident becomes a decision made in a panic by whoever is awake. Personal information protection fails at those three seams far more often than it fails at the firewall.
What enforcement looks like today, and what Bill C-36 would change.
The enforcement picture as of 2026-09-02, stated precisely because most pages get it wrong. The Commissioner can investigate, audit under section 18 where reasonable grounds exist, publish findings, and sign a compliance agreement under section 17.1. It cannot order you to change a practice, award damages, or fine you. Binding remedies come from a Federal Court application, which can award damages. Knowingly failing to report a breach or keep the records is a separate offence carrying fines. Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled 2026-06-15 and sits at first reading. It would replace Part 1 of PIPEDA, create a Digital Safety and Data Protection Commission with binding order power, and carry penalties up to the greater of 10 million dollars or 3 percent of gross global revenue (Gowling WLG, 2026-06-24; McCarthy Tetrault, 2026-06-16).
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our privacy compliance and consent management work runs.
Four steps, and step 01 is the one that changes the conversation. We ask for a list of every system holding personal information about customers or staff, and almost nobody can produce it. That isn't a criticism, it's the normal starting point, and it's why privacy work that begins with policy language fails. The inventory decides the scope of everything after it, including how much you actually need.
Engagement phases
Phases 01 to 04
Inventory the data
Every system holding personal information, what it holds, why, who can reach it, how long it keeps it, and whether it leaves Canada. We write down what nobody has written down.
Fix the consent
We compare what you tell people at collection against what the systems actually do, then rewrite the language and the collection points so the two match. That is consent management with the plumbing attached, not a banner.
Evidence the safeguards
The safeguards principle needs controls that work, not controls described. We verify them and keep the proof where a reviewer can find it.
Rehearse the breach
The reporting decision, the notice to individuals, and the log of every breach. Then we run a tabletop, because an untested process is a document.
PIPEDA compliance questions, answered straight.
Answers first, including the one where we say you don't need us yet. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedPrivacy Impact Assessment (PIA)Privacy impact assessment for Canadian institutions and their vendors, written to the rule that actually binds them.
- RegulatedThird-Party Risk ManagementThird party risk management for Canadian organisations, covering the subcontractors and concentration OSFI B-10 asks about.
- RegulatedBill C-26 ReadinessBill C-26 became Bill C-8, now Canadian law, and designation starts a 90-day statutory clock.
