Privacy law · 15
Privacy law
Canadian privacy and cyber rules explained for businesses: PIPEDA, provincial laws, Quebec Law 25, PHIPA, CASL and incident reporting.
- Privacy lawPrivacy & AIAlberta PIPA and mandatory breach notificationAlberta was the first Canadian jurisdiction to make private-sector breach notification mandatory, in 2010.
- Privacy lawPrivacy & AIBC PIPA for private organizationsMost private-sector organizations operating in British Columbia answer to BC's Personal Information Protection Act rather than PIPEDA for their in-province activity.
- Privacy lawPrivacy & AICASL basics for business email and textsCanada's Anti-Spam Legislation applies to almost every promotional email, text and app message a business sends.
- Privacy lawPrivacy & AIElectronic monitoring of employees in OntarioOntario employers with 25 or more employees must have a written policy saying whether and how they electronically monitor staff.
- Privacy lawPrivacy & AIFIPPA and MFIPPA: what vendors to Ontario public bodies need to knowIf you host, process or support systems for an Ontario ministry, municipality, police board or other public institution, their privacy law becomes your contract.
- Privacy lawPrivacy & AILaw Society of BC technology and cloud guidanceBC lawyers have a technology-competence duty in the BC Code, a detailed cloud computing checklist from the Law Society, and records rules that decide whether a cloud…
- Privacy lawPrivacy & AIOntario's Bill 194: cyber security in the public sectorBill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, changed how Ontario public institutions handle cyber security, privacy…
- Privacy lawPrivacy & AIOSFI Guideline B-13 basicsGuideline B-13 sets out what the Office of the Superintendent of Financial Institutions expects from federally regulated financial institutions on technology and cyber…
- Privacy lawPrivacy & AIPHIPA for clinics and health information custodiansOntario's Personal Health Information Protection Act puts clear duties on clinics, practitioners and the vendors who support them: protect records, notify patients of…
- Privacy lawPrivacy & AIPIPEDA breach reporting and record-keepingPIPEDA has three linked breach duties: report serious breaches to the Privacy Commissioner, notify the people affected, and keep a record of every breach, even the small…
- Privacy lawPrivacy & AIPIPEDA's safeguards principle in practicePIPEDA says personal information must be protected by security safeguards appropriate to its sensitivity.
- Privacy lawPrivacy & AIQuebec Law 25: confidentiality incidents and the incident registerQuebec's private-sector privacy law has its own incident regime: its own definition, its own 'risk of serious injury' test, specific notice contents for the Commission…
- Privacy lawPrivacy & AIReal risk of significant harm: how the assessment worksWhether a Canadian privacy breach must be reported usually turns on one judgment: does it create a real risk of significant harm? The legal test is short.
- Privacy lawPrivacy & AIStoring and processing data outside CanadaMost Canadian organizations already send personal information abroad: to a U.S. email platform, a SaaS tool, an offshore support desk.
- Privacy lawPrivacy & AIWho to tell after a cyber incident in CanadaAfter a cyber incident, the list of people who may need to hear from you is longer than most organizations expect: privacy regulators, police, the Cyber Centre, your…
Incident line · 24 hours, 7 days
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.