Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what organizations certified to the…
Read the insight →The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11
Selling connected hardware or software into the EU? The Cyber Resilience Act's 24-hour vulnerability reporting duty applies since 2026-09-11, and the main obligations follow on 2027-12-11. Scope, deadlines,…
Read the insight →Cookies and tracking under Law 25: privacy by default in practice (ss. 8.1 and 9.1)
Section 8.1 governs tracking and profiling technologies; section 9.1 sets privacy by default but excludes cookie settings. Here is how the two fit together on a real website.
Read the insight →The EU’s Digital Omnibus: what proposed GDPR changes could mean for Canadian businesses
The European Commission's Digital Omnibus proposes major GDPR changes, from the definition of personal data to breach deadlines. It is not law yet. Here is what Canadian businesses…
Read the insight →Canada’s EU adequacy status and why PIPEDA reform matters to exporters
Canada's EU adequacy status lets European data flow to Canadian businesses with fewer hurdles. It covers PIPEDA only, and federal reform under Bill C-36 is back. What exporters…
Read the insight →Bill C-36: what Canada’s proposed privacy reform could mean for you
Bill C-36 would replace PIPEDA with the Protecting Privacy and Consumer Data Act. New rights, a new regulator, penalties up to $10 million or 3% of global revenue,…
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.