Privacy impact assessments your reviewer can sign.
Expert-led PIAs for federal, provincial and municipal institutions, health organizations and regulated businesses, in every province and territory across Canada. A named practitioner leads and signs every one, on a proprietary, standardized methodology.
Track record
- Privacy assessments across a decade
- 250+
- Delivered on time
- 100%
- Our founder holds a personal Government of Canada Secret clearance
- Secret
One standardized report, section by section.
Every PIA follows the same skeleton and the same risk scale, so a review board always knows where to look.
- 01
Executive summary
What we found, and what we recommend.
- 02
System description and purpose
What the program or system is for, and who uses it.
- 03
Data-flow map and data inventory
What personal information is collected, where it goes, who sees it and how long it's kept.
- 04
Privacy analysis
Each principle and each law that applies, and whether the program meets it.
- 05
Risk register
Each risk rated High, Moderate or Low on likelihood and impact, with an owner, treatment and status.
- 06
Residual risk and sign-off
What is left after treatment, who accepts it, and where your approver signs.
Where a PIA is already required.
Federal institutions
Before a new program or activity uses personal information for an administrative purpose, and when one changes substantially.
TBS Directive on Privacy Practices, Standard on Privacy Impact Assessment (C.2.2.9)
Ontario provincial institutions
A written assessment before collecting personal information, unless the regulations provide otherwise.
FIPPA (Ontario), s. 38(3)
Enterprises in Quebec
Before acquiring, developing or overhauling an information system involving personal information, and before communicating it outside Quebec.
Act respecting the protection of personal information in the private sector (Law 25), ss. 3.3 and 17
Private-sector work elsewhere in Canada runs under PIPEDA, or Alberta's or British Columbia's PIPA. This is where to start, not legal advice: we confirm the framework in scope at the start of every engagement.
Built for public bodies and regulated organizations.
Federal, provincial and municipal institutions, and the regulated organizations that work alongside them.
- Health
- Municipal
- Financial Services
- Education
- Public Sector
- Non-profit
- Crown Corporations
- Regulated Enterprise
Check the work before you call.
Sample assessment
A section-by-section walk-through on a fictional system. Our PIAs use the same skeleton and the same risk scale.
See the sample →Procurement kit
Supplier facts for procurement, legal and compliance reviewers. No form, no sales call.
Open the kit →Start a conversation.
Tell us about the agent or the system. A senior practitioner replies with a scoping call.