Six services. One standardized process.
Expert-led privacy delivery built on a proprietary methodology — every engagement scoped, documented, and signable from day one.
The standardized process — drawn end-to-end.
Scroll the services on the left. The diagram on the right pins in view and shows how each one is actually delivered — every step, every artefact, every gate the legal team will ask about.
Vendor Privacy Assessments (VPAs) and full PIAs across regulated programs. Expert-led risk analysis and reporting from a named senior privacy practitioner.
- Aligned with the TBS Directive on Privacy Practices · FIPPA / PHIPA / PIPEDA
- Risk register harmonized across the portfolio
- Standardized report shape — signable by legal
Privacy Impact Assessments — drawn radial.
PIA
Methodology
Aligned with the TBS Directive on Privacy Practices · FIPPA / PHIPA / PIPEDA.
Four moves, in order, every engagement.
The same discipline whether we're rating a vendor PIA or a Crown corporation's AI governance baseline. Documented in the file. Defensible at audit.
The same spine runs under every engagement — Privacy Impact Assessments, Outsourced Privacy Office, Security Risk & Compliance, AI Governance. The artefact differs; the discipline does not.
Four moves · One spine
- 01
Map the data, not the policy.
We start at the data flow. What's collected, where it lands, who can see it, and how long it lives — before a single policy clause is reviewed. Policy follows reality, not the other way around.
- 02
Calibrated against precedent.
Every risk we rate is scored against the same severity and residual-risk criteria. Same severity bar, same residual logic, every time. No bespoke risk language per consultant.
- 03
One standardized report.
One artefact shape. The regulator sees the same structure whether it's a Crown corporation, a ministry, or an enterprise. Predictable for review boards. Defensible at audit.
- 04
Regulator-readiness review.
Internal QC pass, client-team review cycle, and a final regulator-readiness check before the artefact ships. Assumptions tested, dependencies confirmed, residual risk re-scored. The review is documented in the file.
- Engagements across a decade in privacy
- 150+
- Privacy deliverables
- 250+
- Vendor privacy assessments standardized
- 25+
- Delivered on time
- 100%
Start a conversation.
Tell us about your program, the regulators in scope, and the deliverable you are trying to produce. We reply with a named practitioner, a proposed window, and a scoping call — not a marketing sequence.