Practical notes on PCI DSS, privacy law, security testing and audit, written by the team that does the work. Filter by topic, month or keyword.
Cookies and tracking under Law 25: privacy by default in practice (ss. 8.1 and 9.1)
Section 8.1 governs tracking and profiling technologies; section 9.1 sets privacy by default but excludes cookie settings. Here is how the two fit together on a real website.
Read the insight →Penetration testing vs vulnerability scanning vs ASV scans: what PCI DSS actually requires
Vulnerability scans, ASV scans and penetration tests are different activities with different PCI DSS rules. Here is what requirements 11.3 and 11.4 ask for, and how often.
Read the insight →The EU’s Digital Omnibus: what proposed GDPR changes could mean for Canadian businesses
The European Commission's Digital Omnibus proposes major GDPR changes, from the definition of personal data to breach deadlines. It is not law yet. Here is what Canadian businesses…
Read the insight →Answering client security questionnaires without starting from zero every time
Security questionnaires eat sales and security time. A practical method to build a reusable answer library, back it with evidence and keep it current.
Read the insight →Segmentation testing: why reducing PCI scope needs proof
Segmentation can shrink PCI DSS scope, but only with proof. Merchants must test it yearly and service providers every six months, plus after changes. Here is what that…
Read the insight →Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability of misuse, and what…
Read the insight →Automated decisions and AI: transparency duties under Law 25 (s. 12.1) and what Bill C-36 proposes
Law 25 already requires notice, explanations and human review for fully automated decisions. Bill C-36 proposes similar federal rules. What applies now and how to prepare.
Read the insight →Canada’s EU adequacy status and why PIPEDA reform matters to exporters
Canada's EU adequacy status lets European data flow to Canadian businesses with fewer hurdles. It covers PIPEDA only, and federal reform under Bill C-36 is back. What exporters…
Read the insight →What the CAI’s first enforcement actions under Law 25 tell businesses
Few Law 25 penalties are public, but the CAI's AMP framework and recent orders on biometrics and SIN collection show clearly what Quebec's regulator expects from businesses.
Read the insight →Webinars, conference talks and private sessions on PCI DSS, privacy law and cybersecurity, in English and French.
Tell us what you need and when. We’ll tell you what it takes, what it costs and how long it’ll take. No obligation.