Frequently asked questions.
Last updated: 14 October 2026
Short answers to what clients ask most. If your question isn't here, use the contact form and a practitioner will reply.
What does Mosaic Effect do?
We deliver expert-led Privacy Impact Assessments and privacy program support for Canadian public-sector, broader-public-sector, and regulated organizations, using a proprietary, standardized methodology with senior practitioner review.
How long does a PIA take?
It depends on scope, but a standardized single-system PIA is typically delivered in weeks, not months. You get a written scope and timeline before we start.
What does it cost?
Engagements are scoped to the work, not a rate card. A single PIA is fixed-scope; ongoing programs are retainer-based. Book a short call to discuss pricing, and we follow with a written scope and budget.
Which laws do you work under?
PIPEDA, Ontario's FIPPA, PHIPA, and MFIPPA, Quebec's Law 25, the TBS Directive on Privacy Practices, and the TBS Directive on Automated Decision-Making, among others. We confirm the framework in scope at the start of every engagement.
Does anyone at Mosaic hold security clearance?
Our founder holds a personal federal Secret clearance. Mosaic Effect does not hold a corporate facility clearance; where a contract needs one, we say so at the outset.
Who actually does the work?
A named senior privacy practitioner leads and signs every engagement, backed by an elite bench of specialists in privacy, cybersecurity and governance.
How do we start?
Use the contact form or email us. We will set up a short discovery call and send a written scope within a couple of business days.