Privacy impact assessment, written to the rule your regulator actually applies

Talk to an architectSee what's covered

Trusted by

  • Broadcom
  • SSENSE
  • Mondou
  • Western University
  • Votatec
  • Ren's Pets
  • City of Mississauga
The work

Privacy impact assessment, three pillars, one operator.

One Canadian team finds the rule, maps the data, and writes what your regulator accepts. Privacy by design is the part that has to happen before the build, not after the assessment.

Contact us

  1. Find the rule first

    Which statute or directive applies decides your template, your threshold and your reader. Ontario institutions have had to produce a written assessment before collecting personal information since 2025-07-01.

  2. Map the data honestly

    Collection, use, disclosure, retention and destruction, traced to the systems that hold the records rather than to the project's own description of itself.

  3. Write what gets accepted

    The current form, the named authority, the risks and the mitigations somebody owns. Alberta's commissioner replaced the old template with a new mandatory one on 2026-05-01.

By industry

Does Privacy Impact Assessment work the same way in every industry?

No. The Privacy Impact Assessment work is the same craft in every sector, but the conditions around it are not. In healthcare that means provincial health privacy law; in government, Protected A, B and C data handling. We keep the service and change the part that bends.

  • Expected before a new system touches health information.

    PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.

    • Provincial equivalents
    • PIPEDA
    • Breach notification
    Healthcare IT

  • Mandatory before a new programme touches personal information.

    Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.

    • ITSG-33, and ITSP.10.033
    • CPCSC
    • PIPEDA and the Privacy Act
    Government IT services
Request a consult

What do you need from Privacy Impact Assessment?

Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.

I agree to receive emails from SMEnode.

We use your details to reply to this message. You can unsubscribe from our emails at any time. Privacy

Your request

Service
Privacy Impact Assessment

What happens next

  1. A senior engineer replies within an hour, 24/7, never an SDR.
  2. We book a 30-minute call to listen, sketch options, and flag risks.
  3. You get a scoped statement of work within 3 business days.

Call the 24/7 line

+1 514-465-1584
The deep dive

Privacy impact assessment in Canada, made real.

There isn't one Canadian requirement. There are several, they disagree, and three of them changed in the last fifteen months.

Start with the rule, because the rule sets everything else.

An Ontario institution under the amended access statute has had to produce a written assessment before collecting personal information since 2025-07-01, recorded or not, and update it before a significant change of purpose (IPC Ontario, Bill 194). An Alberta public body works under legislation in force since 2025-06-11 and must use its commissioner's new form, mandatory since 2026-05-01. Federal institutions answer to the Treasury Board Directive on Privacy Practices, which replaced the older assessment-specific directive, and file with both the Secretariat and the federal Privacy Commissioner. Quebec has a different instrument again. Guess wrong and you produce a careful document nobody will accept.

Map the data, not the intentions.

What is collected, under what authority, who sees it, where it lives, how long it stays and what destroys it. The gap we find most often sits between the project's description and its database: a field nobody mentioned, a vendor's analytics on by default, a retention setting left at its factory value. An assessment that describes the plan instead of the system ages badly and gets reopened.

Writing it so a reviewer accepts it.

Reviewers want a named legal authority for each collection, a risk actually characterised rather than labelled medium, a mitigation with an owner and a date, and honesty about residual risk. We'd rather file a document saying one risk stays open, with a plan attached, than one claiming everything is fine. Reviewers have read thousands of these. They can tell.

Want a Senior IT Consultant's Read on Your Setup?

Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.

Request a consult
The method

How our privacy risk assessment and PIA work runs.

Four steps, and step 01 is a question with a real answer. Which instrument binds you. That depends on whether you're public or private, federal or provincial, which province, whether health information is involved, and whether a contract imposes something extra. It takes hours, not weeks, and it decides the template, the threshold, the reviewer and the deadline. Most of the confusion we're called about is this question left unanswered for months.

Engagement phases

Phases 01 to 04

  1. Establish the instrument

    Statute, directive, contractual term or all three, named in writing, with the threshold that decides whether an assessment is required at all and which form applies.

  2. Map the initiative

    Data elements, legal authority for each collection, flows to every internal and third-party recipient, storage locations including where a supplier actually holds it, retention and destruction.

  3. Characterise and mitigate

    Real likelihood and real consequence for the people whose information this is, then mitigations with named owners and dates, and residual risk stated rather than buried.

  4. File and keep it alive

    The document in the form your reviewer expects, submitted where submission is required, plus the trigger list that tells you when a change means reopening it.

Questions

Privacy impact assessment questions, answered straight.

Answers first, including which rule applies to you and when you should do this yourselves instead of hiring us. An architect takes the call, not a salesperson.

Depends on who you are. Ontario institutions under the amended access statute: written, before collection, mandatory since 2025-07-01. Alberta public bodies: under legislation in force since 2025-06-11, on the commissioner's form that became mandatory 2026-05-01. Federal institutions: under the Treasury Board Directive on Privacy Practices, which replaced the older assessment-specific directive, filed with both the Secretariat and the federal Privacy Commissioner. Quebec and BC each have their own. Private companies usually have no statutory duty at all.

For public bodies in several provinces, yes, by statute or directive. For private companies, generally no. What does bind a private company is accountability: PIPEDA holds you responsible for the personal information you hold whether or not anyone made you document the risk. Plenty of private firms do one anyway because a public-sector customer put it in the contract, which is the most common reason we're hired.

Jurisdiction and trigger. A DPIA is the European instrument under the GDPR, required when processing is likely to be high risk, with its own content rules and its own regulator. The Canadian assessment is a public-sector instrument built around legal authority to collect and disclose. The analysis overlaps enough that one can feed the other, and if you serve European users you may genuinely need both documents rather than one bilingual compromise.

Often, yes, and where a regulator publishes one you must. The catch is that templates move: Alberta's became mandatory in a new version on 2026-05-01, so a document on last year's form is now the wrong document. Templates also can't do the two hard parts, which are naming the legal authority for each collection and characterising risk in a way a reviewer accepts. Take the form. The thinking is the work.

When you have a privacy office and the project is small and ordinary, because you'll do it faster than we can and you'll own the result. Call us when the instrument is unclear, when a supplier or a cross-border transfer is in scope, when automated decisions affect people, or when something got launched already and you need an honest assessment rather than a comfortable one.

The assessment on the form your reviewer expects, the data flow map behind it, a legal authority named against every collection, a mitigation register with owners and dates, and the trigger list that says when a change reopens the document. All of it in editable form, in your hands, with no tool to buy from us.
Keep exploring

Where this work connects.

These disciplines share the same senior team and tend to land together. Follow the thread to the next one.

Related reading

Let's connect

Bring Us the IT Problem Your Last
Consulting Firm Handed Off

Explore our servicesRequest a consult

A senior SMEnode engineer replies within an hour, 24/7.