Federal Crown Corp · TPPA Program
Third-party privacy assessments.
25+ vendor assessments across cloud, HR, financial, and analytics platforms, delivered in parallel inside the client's own procedure and templates.
25+ TPPAs · Since 2024 · Ongoing
Founder-led privacy advisory · Founder holds Government of Canada Secret clearance · Ontario, Canada
Next-generation privacy assessments. Expert-led compliance.
Mosaic Effect Inc. is a federally incorporated Canadian privacy consultancy delivering Privacy Impact Assessments, privacy program development, vendor risk assessments, and regulatory compliance advisory to government and private sector organizations across Canada. More than 150 privacy engagements across a decade in privacy. Founder-led; our founder holds a personal Government of Canada Secret clearance.
Trusted by
Why programs choose Mosaic
What sets the work apart. One standardized process.
Differentiator 01
Privacy governance for the “move fast” era.
Eliminate data blindspots.
Map every flow, every vendor, every cross-border hop — before the auditor asks. We illuminate shadow IT and hidden data silos so you have complete visibility before regulators are at the door.
Federal Crown Corp · Featured proof
25+ vendor privacy assessments · since 2024
One standardized report shape. Same risk register methodology across the portfolio. Signable by legal.
150+
Engagements across a decade in privacy.
Founder track record · 2016–2026
Federal Department · Enforcement PIA
Enforcement branch privacy assessment.
Privacy impact assessment of enforcement intelligence activities. Cross-agency information-sharing agreements audited and mapped to remediation.
TBS- and OPC-ready · Cross-agency
Six services · One delivery spine
The standardized process — drawn end-to-end.
Scroll the services on the left. The diagram on the right pins in view and shows how each one is actually delivered — every step, every artefact, every gate the legal team will ask about.
Vendor Privacy Assessments (VPAs) and full PIAs across regulated programs. Expert-led risk analysis and reporting from a named senior privacy practitioner.
- Aligned with the TBS Directive on Privacy Practices · FIPPA / PHIPA / PIPEDA
- Risk register harmonized across the portfolio
- Standardized report shape — signable by legal
Active service · 01 of 06 · Radial pattern
Privacy Impact Assessments — drawn radial.
Directive on Privacy Practices · scoped timeline
TBS-Aligned
PIA
Methodology
PIA
Methodology
Scope &
Authority
Data Inventory
& Flow Map
Stakeholder
Interviews
Threat &
Vulnerability
Risk Register
Build
Mitigation
Design
Regulator-readiness
Review
Signed Report
→ Legal
Aligned with the TBS Directive on Privacy Practices · FIPPA / PHIPA / PIPEDA.
OUR METHODOLOGY
Four moves, in order, every engagement.
The same discipline whether we're rating a vendor PIA or a Crown corporation's AI governance baseline. Documented in the file. Defensible at audit.
The same spine runs under every engagement — Privacy Impact Assessments, Outsourced Privacy Office, Security Risk & Compliance, AI Governance. The artefact differs; the discipline does not.
Four moves · One spine
- 01
Map the data, not the policy.
We start at the data flow. What's collected, where it lands, who can see it, and how long it lives — before a single policy clause is reviewed. Policy follows reality, not the other way around.
- 02
Calibrated against precedent.
Every risk we rate is scored against the same severity and residual-risk criteria. Same severity bar, same residual logic, every time. No bespoke risk language per consultant.
- 03
One standardized report.
One artefact shape. The regulator sees the same structure whether it's a Crown corporation, a ministry, or an enterprise. Predictable for review boards. Defensible at audit.
- 04
Regulator-readiness review.
Internal QC pass, client-team review cycle, and a final regulator-readiness check before the artefact ships. Assumptions tested, dependencies confirmed, residual risk re-scored. The review is documented in the file.
- Engagements across a decade in privacy
- 150+
- Privacy deliverables
- 250+
- Vendor privacy assessments standardized
- 25+
- Delivered on time
- 100%
MEET OUR LEADERS
Named practitioners. An elite bench of specialists.
Every engagement is led — and signed — by a named privacy practitioner, backed by an elite bench of specialists in privacy, cybersecurity and governance. The work that lands in front of regulators carries an individual's reputation, not a brand's.
Sukhpreet Singh
Founder & Privacy Practitioner
Government of Canada Secret clearance (personal) · Hons BPA · MPPAL · 8+ years
Founder and lead practitioner. Eight-plus years of privacy and information governance work across federal (TBS), provincial (OCIC), Crown, and regulated enterprise programs, with more than 150 privacy engagements — Privacy Impact Assessments, third-party and vendor assessments, and threat and risk assessments — for clients including CMHC, Ontario Health, and private-sector organizations across Canada, plus 35 privacy breach investigations during his time at TBS. Built Mosaic's proprietary assessment methodology and leads and signs every engagement the firm delivers. Deep coverage of the Privacy Act, PIPEDA, PHIPA, MFIPPA, FIPPA, Law 25, GDPR, CCPA, and HIPAA. Extensive applied-AI expertise: evaluating and red-teaming AI models on Canadian privacy law, designing AI governance and quality-assurance frameworks, and assessing AI/ML systems, biometrics, and other novel technologies for privacy risk.
LinkedInHarjeevan Maan
Senior Privacy Advisor
BEng (Co-op), McMaster University
Senior privacy advisor with eight years of progressive experience delivering and supporting Privacy Impact Assessments across federal and provincial public-sector, healthcare, financial services, and high-growth technology programs. Hands-on across FIPPA, PHIPA, PIPEDA, MFIPPA, the Privacy Act, and HIPAA, with technical fluency in cloud architecture, API security, and encryption standards. At Mosaic he supports Ontario Health and federal Crown corporation assessments, third-party and vendor PIAs, and enterprise privacy program build-out — pairing deep regulatory analysis with an engineering background to assess modern digital and cloud-based service delivery.
The bench
Sahib Johar
Privacy & Cybersecurity Consultant
Nik Baker
Security Engineering Specialist
Yonah Aviv
Business Development
Start the engagement
Start a conversation.
Tell us about your program, the regulators in scope, and the deliverable you are trying to produce. We reply with a named practitioner, a proposed window, and a scoping call — not a marketing sequence.
Read the workin the practitioner’s own words.
AI Governance
6 min read
The AIA Asks Where Your Data Comes From. It Never Asks How You Destroy It.
The Algorithmic Impact Assessment weighs data more heavily than any other risk area, yet none of its questions ask where data is stored, how long it is kept or how it is destroyed. The answers belong in the PIA and your institution's retention rules. Here is where to check them, and what vendors need to have ready.
Read article →Program Ops
6 min read
The Data Is Flowing. The Agreement Doesn't Exist.
Personal information can start moving to a vendor or another organization before anyone signs the agreement meant to govern it. When a service provider handles it for you, Canada's private-sector privacy laws keep the responsibility with you. Find the gaps this week with a three-column inventory.
Read article →Program Ops
5 min read
Does Your PIA Still Match Your Service?
A privacy impact assessment is written against a design, and then the service keeps changing. Here is how to check whether yours still describes the service running today, record what changed, decide what needs attention, and wire the next change into a process you already run.
Read article →Program Ops
6 min read
Nobody Owns Retention Until It's Too Late
A system can go live holding personal information with no approved retention schedule, and default to keeping it forever because nobody decided otherwise. Retention isn't a records-management chore to sort out after launch — it's a launch requirement. Here's how to make it one, and how to test whether yours is real.
Read article →STAY AHEAD
Subscribe for Expert Insights
Field-tested guidance from active practitioners. No fluff — and never a sales sequence.