INSIGHTS

Privacy, in plain language.

Practitioner writing on privacy law, AI governance, and the mechanics of building programs that hold up under scrutiny.

The AIA Asks Where Your Data Comes From. It Never Asks How You Destroy It.

The Algorithmic Impact Assessment weighs data more heavily than any other risk area, yet none of its questions ask where data is stored, how long it is kept or how it is destroyed. The answers belong in the PIA and your institution's retention rules. Here is where to check them, and what vendors need to have ready.

The Data Is Flowing. The Agreement Doesn't Exist.

Personal information can start moving to a vendor or another organization before anyone signs the agreement meant to govern it. When a service provider handles it for you, Canada's private-sector privacy laws keep the responsibility with you. Find the gaps this week with a three-column inventory.

Does Your PIA Still Match Your Service?

A privacy impact assessment is written against a design, and then the service keeps changing. Here is how to check whether yours still describes the service running today, record what changed, decide what needs attention, and wire the next change into a process you already run.

Nobody Owns Retention Until It's Too Late

A system can go live holding personal information with no approved retention schedule, and default to keeping it forever because nobody decided otherwise. Retention isn't a records-management chore to sort out after launch — it's a launch requirement. Here's how to make it one, and how to test whether yours is real.

August 14, 2026

Read article →

Public Sector Privacy

5 min read

Bill 97 and the Municipal Privacy Clock

Ontario's Bill 97 brings municipalities under the same privacy impact assessment and breach reporting regime provincial institutions have lived under since July 2025 — with the substantive obligations landing January 1, 2027. Here's what municipal clerks and FOI coordinators should be doing between now and then.

Law 25 Isn't Done With You: The Mid-Market Compliance Checklist

Québec's Law 25 finished phasing in on September 22, 2024, and every obligation is now in force — including for organizations outside Québec that do business there. Here's the checklist a COO can run this quarter — privacy officer, incident register, PIAs, and the penalties that follow if you skip them.

Ontario's AI-Scribe Moment: What the IPC's Guidance Means for Clinics

On January 28, 2026, Ontario's privacy regulator released detailed guidance on AI scribes in healthcare settings — and it lands squarely on the desks of clinic owners, not just IT vendors. Here's what the IPC actually expects custodians to have in place, and the gaps worth checking first.

AI Made the Decision — Who Has to Explain It? Canada's Real Rules in 2026

Ottawa's attempt to regulate AI decisions died with Bill C-27 in January 2025. Quebec didn't wait — Law 25's automated-decision rules have been in force since September 2023, with a real notice obligation, a right to be told the reasons and principal factors behind a decision, and a right to submit observations to someone who can review it. Here's what's actually enforceable in Canada right now, and what it means for any organization deploying AI in a decision that touches people.

July 20, 2026

Read article →

Public Sector Privacy

5 min read

Ontario's New Cyber Security Rules Are Live: What Public Sector Entities Need to Do Now

Two new regulations under Ontario's Enhancing Digital Security and Trust Act, 2024 came into force July 1, 2026 — cyber security governance for Group A, B and C public hospitals, school boards, colleges, universities, and children's aid societies, and new student-data notice rules for school boards. Here's what changed and what it means for your compliance calendar.

The EU AI Act is Here: Is Your Organization Ready for the 'GDPR of AI'?

What Canadian organizations operating in or selling to the EU need to know now: the AI Act's risk tiers, deployer duties and revised high-risk deadlines — and how they line up with the TBS Directive on Automated Decision-Making and Quebec's Law 25.

Why Excel Is Killing Your Privacy Compliance (And How to Fix It)

The hidden cost of running a privacy program out of spreadsheets — and what a standardized process replaces it with.

Privacy Impact Assessments: When You Need One in Canada and the EU, and How to Keep It Moving

When a PIA is a legal duty in Canada, when the GDPR requires a DPIA, and the four-step method that keeps the assessment rigorous without making it a bottleneck.

The 'Human-in-the-Loop': Why Privacy Still Needs Human Judgment

Why meaningful human oversight is the linchpin of a defensible AI governance framework — and what the GDPR, Quebec's Law 25, the EU AI Act and the federal Directive on Automated Decision-Making actually require.

March 29, 2025

Read article →

STAY AHEAD

Subscribe for Expert Insights

Field-tested guidance from active practitioners. No fluff — and never a sales sequence.