Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability of misuse, and what…
Read the insight →Automated decisions and AI: transparency duties under Law 25 (s. 12.1) and what Bill C-36 proposes
Law 25 already requires notice, explanations and human review for fully automated decisions. Bill C-36 proposes similar federal rules. What applies now and how to prepare.
Read the insight →Canada’s EU adequacy status and why PIPEDA reform matters to exporters
Canada's EU adequacy status lets European data flow to Canadian businesses with fewer hurdles. It covers PIPEDA only, and federal reform under Bill C-36 is back. What exporters…
Read the insight →Parliament is back: where Bills C-36 and C-8 stand, and what to do this fall
Bill C-36 on privacy is still at first reading; Bill C-8 on cyber security is law but not yet in force. A practical fall checklist for privacy and…
Read the insight →Bill C-36: what Canada’s proposed privacy reform could mean for you
Bill C-36 would replace PIPEDA with the Protecting Privacy and Consumer Data Act. New rights, a new regulator, penalties up to $10 million or 3% of global revenue,…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.