Canadian privacy practice, built for the regulator's review.
Mosaic Effect is an expert-led privacy and data-governance consultancy helping Canadian organizations meet their obligations through a proprietary methodology and a standardized process — turning regulatory complexity into clear, defensible deliverables that hold up to scrutiny.
ABOUT US
From Data Points to Defined Protection
The Meaning Behind The Mosaic Effect
Our name is derived from a core privacy principle: the 'Mosaic Effect,' where fragmented, innocuous data points can be synthesized to reveal sensitive identities. We apply this philosophy to every assessment, moving beyond surface-level checks to evaluate your systems holistically, ensuring that no hidden detail compromises your organization's privacy.
Fragments → Defined Identity
MEET OUR LEADERS
Named practitioners. An elite bench of specialists.
Every engagement is led — and signed — by a named privacy practitioner, backed by an elite bench of specialists in privacy, cybersecurity and governance. The work that lands in front of regulators carries an individual's reputation, not a brand's.
Sukhpreet Singh
Founder & Privacy Practitioner
Government of Canada Secret clearance (personal) · Hons BPA · MPPAL · 8+ years
Founder and lead practitioner. Eight-plus years of privacy and information governance work across federal (TBS), provincial (OCIC), Crown, and regulated enterprise programs, with more than 150 privacy engagements — Privacy Impact Assessments, third-party and vendor assessments, and threat and risk assessments — for clients including CMHC, Ontario Health, and private-sector organizations across Canada, plus 35 privacy breach investigations during his time at TBS. Built Mosaic's proprietary assessment methodology and leads and signs every engagement the firm delivers. Deep coverage of the Privacy Act, PIPEDA, PHIPA, MFIPPA, FIPPA, Law 25, GDPR, CCPA, and HIPAA. Extensive applied-AI expertise: evaluating and red-teaming AI models on Canadian privacy law, designing AI governance and quality-assurance frameworks, and assessing AI/ML systems, biometrics, and other novel technologies for privacy risk.
Senior privacy advisor with eight years of progressive experience delivering and supporting Privacy Impact Assessments across federal and provincial public-sector, healthcare, financial services, and high-growth technology programs. Hands-on across FIPPA, PHIPA, PIPEDA, MFIPPA, the Privacy Act, and HIPAA, with technical fluency in cloud architecture, API security, and encryption standards. At Mosaic he supports Ontario Health and federal Crown corporation assessments, third-party and vendor PIAs, and enterprise privacy program build-out — pairing deep regulatory analysis with an engineering background to assess modern digital and cloud-based service delivery.
The bench
Sahib Johar
Privacy & Cybersecurity Consultant
Nik Baker
Security Engineering Specialist
Yonah Aviv
Business Development
OUR PHILOSOPHY
Three principles underneath every engagement.
Excellence is the floor, adaptation is the work, and standardized process is what makes the math work. Drop one and the model breaks.
01 · FOUNDATION
Built for Excellence
We never start from scratch. We use a comprehensive suite of expert-crafted templates and industry-leading frameworks from day one. This ensures your compliance strategy is built on a robust, defensible foundation without wasting time reinventing the wheel.
02 · ADAPTATION
Meticulous Adaptation
Generic models fail to address operational nuances. We treat standard resources as merely a starting point. Our experts rigorously adapt every policy and workflow to fit your specific internal culture, business context, and unique regulatory requirements.
03 · EFFICIENCY
Standardized Process Efficiency
Our proprietary methodology compresses the manual portion of compliance work — refined across 150+ engagements spanning a decade in privacy. The scalability and speed of a large firm with the dedicated, personal care of a boutique consultancy.
Credentials & coverage
Insured, reviewed, and ready for the work.
What a procurement officer checks first: who reviews the work, who holds the clearance, and what insurance stands behind it.
Senior review
Expert-led privacy assessment with clear evidence trails
Secret clearance
Our founder holds a personal Government of Canada Secret clearance, valid to 2029
PROLINK
E&O and CGL insurance · effective April 2026
Who we serve
Regulated sectors. Canadian regulators.
The methodology is the same; the regulatory context shifts. We calibrate to the statute, the oversight body, and the program's risk appetite — not to a generic compliance template.
Three things every regulated organization needs from its privacy partner — security depth, visibility, and jurisdictional reach.
Uncompromising Security
We practice what we preach. Your data is protected by enterprise-grade security controls and granular role-based access.
Eliminate Data Blindspots
You cannot protect what you cannot see. We illuminate shadow IT and hidden data silos, giving you complete visibility before the auditors ask.
Work across jurisdictions
Operating in more than one province? We map the overlapping requirements into one program your team can run.
Start the engagement
Start a conversation.
Tell us about your program, the regulators in scope, and the deliverable you are trying to produce. We reply with a named practitioner, a proposed window, and a scoping call — not a marketing sequence.
