Privacy in Big Government
A practitioner's guide to public-sector PIAs across Canada
Several regimes set privacy impact assessment duties for Canadian public bodies, each on its own clock — Ontario's municipal duty starts January 1, 2027. This maps five of them, explains why public-sector assessments are structurally different from private-sector ones, and gives a privacy office a working method for triaging and defending its PIA program.
- The Canadian public-sector PIA landscape, mapped regime by regime
- Why government PIAs are structurally different from private-sector ones
- The multi-stakeholder problem — who owns what across a PIA file
- Triaging a PIA backlog by risk, not by request age
- The evidence trail a regulator actually asks for
- Working with outside delivery capacity without losing accountability
Federal and provincial privacy offices, ATIP shops, and broader public-sector executives — written for the office that has to run the program, not just commission it
WHAT IT HELPS YOU DO- Work out which of the overlapping regimes actually binds your program, and on what clock
- Triage a backlog by risk instead of by how long a request has been sitting
- Assemble the evidence trail a regulator asks for while the file is moving, not afterwards
- Allocate accountability across program, delivery partner and technology group without leaving a gap
- Bring in outside delivery capacity without moving accountability off your own books
- Answer the ten questions worth settling before you commission any assessment
Get the guide
Tell us where to send it. The download is immediate.
Start a conversation.
Tell us about your program, the regulators in scope, and the deliverable you are trying to produce. We reply with a named practitioner, a proposed window, and a scoping call — not a marketing sequence.