Privacy by design for AI agents.
An AI agent reads your data and acts on it. We assess it before launch, or while it runs: what it can reach, what can take control of it, and how you stop it. Then we write it up so your privacy officer can sign.
New systems, a proven discipline.
Privacy assessment is our core practice: 250+ privacy assessments across a decade, including privacy assessments of AI systems such as biometric liveness checks and a generative-AI contact centre. Agents that use tools and take actions are newer, and we say so. Our agent method is written down, versioned and public.
Read the method changelog →An agent is not ordinary software.
It can be talked into things.
A document or email it reads can carry hidden instructions.
It usually has more access than it needs.
Broad access is the easy way to build it.
Nobody has checked how to stop it.
Until someone proves the stop works, it is a hope.
Five questions, answered with evidence.
| Lens | What we check | What we measure it against |
|---|---|---|
LensReach | What we checkEvery tool and connector: what it needs against what it was given; whether it acts with the user's credentials or its builder's | What we measure it againstA permission matrix: needed vs granted |
LensManipulation | What we checkExposure to prompt injection, including through documents, email and web pages the agent reads | What we measure it againstOWASP Top 10 for LLM Applications (2025): prompt injection, sensitive information disclosure, excessive agency |
LensAutonomy | What we checkWhich actions run unattended, where a person approves, and where the agent must re-authenticate | What we measure it againstYour approval design, tested at user acceptance |
LensPersonal information | What we checkPurpose, collection limits, retention, transfers outside the province or country, notice of automated decisions | What we measure it againstPIPEDA; Quebec's private-sector Act (Law 25); Alberta and BC PIPA; FIPPA for Ontario institutions; the federal Directive on Automated Decision-Making |
LensThe stop | What we checkFive stops — identity, policy, runtime, monitoring and a person — and whether you can show each one works | What we measure it againstA five-stop evidence table |
What we ask you for:
- an architecture diagram
- the list of environments, connectors and tools
- an identity and permission export
- DLP and sensitivity-label settings
- the agent's instructions and knowledge sources
- vendor and data-processing terms
- sample conversations from testing
All client files are stored in Canada, secured in Microsoft 365.
Five stops, each one proven.
- 01
Identity
The agent acts under an identity you control, with only the access it needs.
- 02
Policy
Data-loss and sensitivity rules block what it must never send.
- 03
Runtime
You can pause or switch it off while it runs.
- 04
Monitoring
Its actions are logged, and someone looks.
- 05
A person
A named person approves the actions that matter.
Ways in
Five ways to work with us.
Your team or your build partner builds the agent. We assess it and give you every control it needs.
01 · Free
Agent stop check
Typical timeline: 15 minutes
One agent, five questions. You leave with the three things to check first.
Book it →02 · New agents
Build support
Typical timeline: 4–8 weeks, alongside your build
Your developers or build partner build the agent. We assess the build as it goes, from design to go-live, and provide all the controls it needs.
- Control requirements for your builder
- Two design sessions
- Behaviour tests at user acceptance
- An Agentic Privacy Impact Assessment with a sign-off page
03 · Live agents
Agent retrofit
Typical timeline: 2–4 weeks
For agents already live. We assess how the agent handles data and what it can do, from both the security-controls and the privacy side, then specify the fixes. Your developers make them; we verify each one.
04 · After launch
Ongoing assurance
A re-check twice a year, and whenever the agent changes.
05 · Programs
AI governance for the AI you already run
Inventory, risk-tier classification and the transparency records your legal team will ask for, mapped to the federal Directive on Automated Decision-Making and, for exporters, the EU AI Act.
- Directive on Automated Decision-Making and EU AI Act gap mapping
- Risk-tier classification per system
- Approval pack ready for sign-off
We never assess what we built. Your developers or your build partner make the fixes; we check them.
One report your reviewer already knows how to read.
The Agentic Privacy Impact Assessment follows the same skeleton as our PIAs, so a privacy office used to PIAs can review it quickly.
- 01Executive summary and launch recommendation
- 02System description and purpose
- 03Data-flow map and data inventory
- 04Permission matrix (needed vs granted)
- 05Privacy analysis, by principle and by law
- 06Agent risk analysis: manipulation, autonomy, the stop
- 07Risk register: risk, rating, owner, treatment, status
- 08Control requirements and verification status
- 09Five-stop evidence table
- 10Behaviour test results
- 11Residual risk and conditions for launch
- 12Sign-off page for your privacy officer
The rules that already apply to your agent.
Privacy law already applies to what an agent does with personal information. This map shows where to start; it is not legal advice.
| If your agent… | What applies | Source |
|---|---|---|
| If your agent…handles personal information for a private-sector organization | What appliesPIPEDA's fair information principles. You stay accountable for personal information you hand to a third party for processing, and must secure comparable protection by contract (Schedule 1, clause 4.1.3). Collection is limited to what the purpose needs (clause 4.4.1). Alberta and British Columbia have their own Personal Information Protection Acts. | SourcePIPEDA, laws-lois.justice.gc.ca |
| If your agent…is a new or overhauled system at an enterprise in Quebec | What appliesA privacy impact assessment for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3), and before communicating personal information outside Quebec (s. 17). | SourceAct respecting the protection of personal information in the private sector (Law 25), legisquebec.gouv.qc.ca |
| If your agent…makes decisions about people on its own, at an enterprise in Quebec | What appliesTell the person when a decision is based exclusively on automated processing. On request, explain the information used and the reasons, principal factors and parameters, and let the person submit observations (s. 12.1). | SourceSame Act, s. 12.1 |
| If your agent…helps a federal institution make administrative decisions | What appliesComplete and publish an Algorithmic Impact Assessment before the system goes into production, and update it when its functionality or scope changes (ss. 6.1.1, 6.1.3). | SourceTBS Directive on Automated Decision-Making |
| If your agent…collects personal information for an Ontario provincial institution | What appliesA written assessment before collecting personal information, unless the regulations provide otherwise (s. 38(3)). | SourceFIPPA (Ontario), ontario.ca/laws |
| If your agent…is used by an Ontario public sector entity | What appliesThe Enhancing Digital Security and Trust Act, 2024 (enacted by Bill 194) sets AI duties (public information, an accountability framework, risk management) for entities the regulations prescribe (s. 5). As of October 2026, no regulation has prescribed them. | SourceEDSTA, ontario.ca/laws |
| If your agent…produces output used in the European Union | What appliesThe EU AI Act applies to providers and deployers outside the EU where the AI system's output is used in the Union (Art. 2(1)(c)). | SourceRegulation (EU) 2024/1689, eur-lex.europa.eu |
Frameworks we map to
- NIST AI RMF 1.0
- OWASP Top 10 for LLM Applications (2025)
- OPC principles for generative AI (2023)
Canada's proposed Artificial Intelligence and Data Act was part of Bill C-27, which died when the parliamentary session ended on January 6, 2025. Sources and the dates we read them are listed on the method changelog.
Built for the people who ship agents, and the people who approve them.
AI agencies and builders
You build agents for clients in regulated sectors. Our independent review answers their privacy and security reviewer before the deal stalls.
Organizations running agents
Health, finance, insurance, legal, HR and the public sector. You need evidence that an agent already in use is safe to keep running.
Three questions we get
We have done privacy assessments of AI systems, including biometric liveness checks and a generative-AI contact centre. Tool-using agents are newer; our agent method builds on 250+ privacy assessments, and its changelog is public.
No, deliberately. We never assess what we built. Your developers or build partner make the fixes, and we verify them.
Build support runs 4–8 weeks alongside your build, so the assessment is ready when the agent is. A retrofit takes 2–4 weeks. A privacy impact assessment or a vendor review takes 1–2 weeks. You get a written scope before we start.
Start a conversation.
Tell us about the agent. A senior practitioner replies with a scoping call.