Privacy & Compliance Blog

Canadian Privacy Insights

Practical, plain-language guides on PIPEDA, Law 25, CASL, and AI privacy — written for Canadian business owners, not lawyers.

Featured

AI Incident Response: Building a Playbook Before Something Goes Wrong

Breach

The worst time to sort out who does what when an AI system fails is while it's failing. Write the playbook in a calm moment and a 2 a.m. scramble becomes a checklist.

September 18, 2026·9 min read

Read article

Compliance

A Records of Processing (ROPA) Starter Guide for Canadian Companies

You can't protect, report on, or delete data you've never mapped. A Records of Processing is that map — and it's the quiet foundation nearly every privacy obligation ends up resting on.

September 15, 2026Read

PIPEDA

De-Identification vs Anonymization Under Canadian Privacy Law

Plenty of teams toss around 'anonymized' and 'de-identified' as if they're the same word. Under Canadian law — Quebec's Law 25 especially — they're not, and the gap bites hardest when you're prepping data to train AI.

September 11, 2026Read

AI for Business

Human Oversight of AI: What 'Meaningful Review' Actually Means

Putting a human 'in the loop' does nothing unless that human can actually understand the AI, question it, and overrule it. Here's what separates real oversight from a rubber stamp.

September 8, 2026Read

AI Tools

Model Cards and AI Documentation: What to Record About Every AI System

If you can't describe an AI system's purpose, data, and limits on a single page, you can't govern it. That page has a name — the model card. Here's what to put on it, and why regulators keep asking to see one.

September 4, 2026Read

CASL

CASL and AI-Generated Marketing Emails

AI can write the email in seconds — but it can't get you consent, identify you, or honour an unsubscribe. CASL still governs every message, no matter who drafted it.

September 1, 2026Read

Compliance

Writing a Privacy Policy for an AI Feature in Canada

The day you ship an AI feature, your privacy policy goes stale. Here's what Canadian law expects you to tell people — purposes, data, models, decisions, retention.

August 28, 2026Read

Law 25

Cross-Border Data Transfers After Quebec Law 25

If personal information leaves Quebec — and with US cloud tools it almost always does — Law 25 expects you to assess the transfer first. Here's what that actually asks of you.

August 25, 2026Read

Breach

PIPEDA Breach Response: Your First 72 Hours

The moment you find a breach, the clock and the questions start together. Here's the test PIPEDA actually applies — and a calm, ordered plan for the first 72 hours.

August 21, 2026Read

Data Risk

AI Vendor Risk: 12 Questions to Ask Before You Buy

Buy an AI tool and you inherit whatever it does with data. These twelve questions drag the risks into the open — the ones a slick demo would rather you skipped — before your client data ends up somewhere you can't see it.

August 18, 2026Read

Compliance

Data Residency in Canada: Why Where Your AI and Data Live Actually Matters

Where your AI and data physically live shapes your legal exposure and your customers' trust. Here's the CLOUD Act concern, what Canadian law actually requires on cross-border transfers, and how to pressure-test a "data stays in Canada" claim.

August 14, 2026Read

PIPEDA

Do You Need a Privacy Impact Assessment? A Decision Guide for Canadian Businesses

Not every project needs a formal Privacy Impact Assessment, but some legally do — especially under Quebec's Law 25. Here's a decision guide for when a PIA is expected, plus a lightweight approach that fits SMBs.

August 11, 2026Read

Law 25

Consent Under Quebec's Law 25: A Practical Checklist for AI-Powered Products

Quebec's Law 25 raised the bar on consent, and AI products test every part of it. Here's a practical checklist: express consent, purpose specification, privacy by default, and the privacy officer role.

August 7, 2026Read

PIPEDA

PIPEDA and Automated Decision-Making: What to Disclose When AI Influences Decisions About People

The moment an algorithm helps decide who gets a loan, a job interview, or a price, PIPEDA's transparency principles kick in. Here's what to explain to people and what to put in your privacy notice.

August 4, 2026Read

Compliance

ISO/IEC 42001 Explained in Plain English: The First AI Management System Standard

ISO/IEC 42001 is the first international standard for managing AI responsibly. Here's what it actually asks of you, how it lines up with ISO 27001, and when a Canadian company should start paying attention.

July 31, 2026Read

Compliance

AI Risk Classification 101: The Four Tiers of the EU AI Act in Plain English

The EU AI Act drops every AI system into one of four risk tiers, and your obligations depend entirely on which one you land in. Here is each tier in plain English, with examples.

July 28, 2026Read

AI for Business

Shadow AI at Work: Finding and Governing the Tools You Don't Know About

Your staff are adopting unsanctioned AI tools faster than any IT team can track them. Here is why it happens, the real risks under PIPEDA, and how to govern it without killing productivity.

July 24, 2026Read

AI Tools

How to Write an AI Acceptable Use Policy for a Canadian Team

Your team is already using AI, whether you have blessed it or not. A short Acceptable Use Policy turns that from a liability into a managed practice. Here is a practical, section-by-section outline.

July 21, 2026Read

AI for Business

AIDA Explained: What Canada's AI and Data Act Means for Your Business

Canada's proposed Artificial Intelligence and Data Act would regulate "high-impact" AI systems. Here is what AIDA would ask of your business — and how to get ahead of it before it becomes law.

July 17, 2026Read

AI for Business

The EU AI Act for Canadian SMBs: When It Actually Applies to You

Most Canadian SMBs treat the EU AI Act as a European problem. Here is exactly when it reaches across the Atlantic to a business run out of Halifax or Calgary — and what to do about it.

July 14, 2026Read

AI for Business

Does the EU AI Act Apply to My Canadian Business? A 2026 Decision Guide

You don't need an office in Europe for the EU AI Act to reach you. If your AI touches people in the EU, or your output lands there, you may be in scope. Here's a decision guide built for Canadian businesses.

July 11, 2026Read

AI for Business

What the OPC's ChatGPT Ruling Means for Your Canadian Business

Canada's federal and provincial privacy regulators found that OpenAI collected personal information without valid consent and gave people no real way to correct or delete it. Here's what the ChatGPT finding actually changes for a business using AI.

July 10, 2026Read

Breach

I Read Every OPC Enforcement Decision From the Last 5 Years. Here's the Pattern.

The OPC publishes its investigation findings. Five years of reading them reveals consistent patterns — the same failures appearing across industries, organization sizes, and complaint types.

June 26, 2026Read

Breach

What a $150,000 OPC Investigation Looks Like — and the PII Failure That Started It

An OPC investigation is triggered by a complaint or a reported breach. What follows is a months-long process with real costs, public findings, and remediation demands. Here's what it looks like.

June 23, 2026Read

Compliance

Multi-Jurisdiction Privacy Compliance: How Canadian Businesses Handle PIPEDA, Law 25, and CASL at Once

Canadian businesses with national operations must navigate PIPEDA, Law 25, and CASL simultaneously. Here's the unified approach — one program that satisfies all three without triple the work.

June 19, 2026Read

Compliance

Redacting a Court Document in Canada: What the Rules Actually Require

Court files in Canada are public records. The personal information in filed documents is accessible to anyone who looks. Here's what the rules require and where litigants and their lawyers get it wrong.

June 16, 2026Read

Compliance

Your SaaS Vendors Are a PIPEDA Liability. Most Canadian Businesses Have No Idea.

PIPEDA's accountability principle holds your organization responsible for personal information you disclose to third parties — including every SaaS tool your team uses. Most Canadian SMBs have no vendor contracts.

June 12, 2026Read

PIPEDA

Canadian Real Estate Agents Are Sitting on a PII Time Bomb

Real estate agents handle SINs, bank statements, ID documents, and financial histories as a matter of course. Most treat this information with far less care than PIPEDA requires.

June 9, 2026Read

Breach

The 72-Hour Breach Notification Clock: A Canadian Business Owner's Survival Guide

A breach happens. You have a clock running. Most Canadian business owners don't know what PIPEDA requires or what to do first. Here's the practical guide.

June 5, 2026Read

AI Tools

Why Open-Source PII Tools Like Presidio Are Not Enough for Canadian Compliance

Presidio is a well-engineered open-source tool. It's also US-centric, requires significant configuration for Canadian identifiers, and puts the compliance burden entirely on your engineering team.

June 2, 2026Read

Compliance

What a Privacy Impact Assessment Actually Looks Like for a 10-Person Canadian Company

Every PIA guide you'll find is written for enterprise legal teams. Here's what a privacy impact assessment actually looks like for a small Canadian business — practical, not theoretical.

May 29, 2026Read

AI Tools

PII Redaction for SaaS Companies in Canada: What Your Terms of Service Isn't Protecting

SaaS companies routinely process customer personal information through their product pipelines. Terms of service shift liability — they don't eliminate the underlying PIPEDA obligations.

May 26, 2026Read

CASL

CASL Is the Most Violated Law in Canadian Business. Enforcement Is Coming.

CASL has been in force since 2014. Most Canadian businesses treat it as an inconvenience. The CRTC is increasingly treating violations as enforcement opportunities — and the fines are real.

May 22, 2026Read

PIPEDA

The 6 Types of PII Hiding in Your Business Documents That No Scanner Is Catching

Six PII categories routinely appear in Canadian business documents and get missed by manual review. Most basic scanners catch names and emails. These six require more sophisticated detection.

May 19, 2026Read

PIPEDA

Your Privacy Policy Does Not Make You PIPEDA Compliant. Here's What Does.

A privacy policy is PIPEDA's openness principle — one of ten. Canadian businesses that stop there are 90% non-compliant and don't know it.

May 15, 2026Read

Compliance

PHI in Emails: How Canadian Healthcare Clinics Are Getting PHIPA Wrong

Canadian healthcare clinics send personal health information over email dozens of times a day. Most of it is unencrypted, untracked, and non-compliant with PHIPA. Here's what the law actually requires.

May 12, 2026Read

PIPEDA

The PIPEDA Compliance Checklist That Matches What the OPC Actually Looks For

Most PIPEDA checklists are generic legal boilerplate. This one is built from actual OPC investigation findings — what the Privacy Commissioner actually looks for when a complaint is filed.

May 8, 2026Read

Compliance

What Actually Happens When a Canadian Law Firm Sends an Unredacted Document to the Wrong Party

Inadvertent disclosure of unredacted legal documents triggers professional misconduct complaints, client claims, and regulatory scrutiny. Here's what it looks like and why it keeps happening.

May 5, 2026Read

Law 25

Law 25 Is Not Just a Quebec Problem — Every Canadian Business That Touches Quebec Data Is Affected

Quebec's Law 25 doesn't only apply to Quebec businesses. Any organization handling personal information of Quebec residents is caught — including ones based in BC, Ontario, and Alberta.

May 1, 2026Read

PIPEDA

Document Scanning for PIPEDA Compliance: What the Law Actually Requires

What does PIPEDA actually require when it comes to scanning documents with personal information? Most businesses are doing it wrong — here's the practical answer.

April 28, 2026Read

PIPEDA

PIPEDA Compliance in 2026: The Real Guide for Canadian SMBs

PIPEDA compliance for small and mid-size Canadian businesses in 2026 — what it actually requires, what the OPC looks for, and how to build a program that holds up.

April 24, 2026Read

Compliance

Your HR Team Is Leaking SINs Every Week and Nobody Is Checking

Canadian HR teams handle SINs, banking details, and medical records daily. Most have no automated PII detection in place — and the exposure is happening right now.

April 18, 2026Read

AI for Business

PIPEDA vs GDPR: What Canadian Businesses Actually Need to Know

Most Canadian businesses don't need GDPR — but knowing the difference between PIPEDA and GDPR matters more than ever now that AI tools are part of everyday operations.

April 11, 2026Read

AI Tools

AI Tools for Canadian Accountants: What's Safe to Use in 2026

Canadian accountants face real PIPEDA and professional conduct obligations when using AI. Here's which tools are safe, which tasks work, and how to protect client data.

April 9, 2026Read

Healthcare

PHIPA Compliance Checklist for Ontario Healthcare Providers Using AI in 2026

Ontario healthcare providers using AI face real PHIPA compliance gaps. This checklist covers inventory, consent, safeguards, breaches, and staff training for 2026.

April 7, 2026Read

Data Risk

ChatGPT for Canadian Real Estate Agents: The Risks Nobody Talks About

Canadian real estate agents using ChatGPT with client data face real PIPEDA and professional conduct risks. Here's what's safe, what isn't, and what to do instead.

April 4, 2026Read

AI for Business

Quebec Law 25 and AI Tools: What Every Business Operating in Quebec Must Know

Quebec Law 25 applies to any business collecting data from Quebec residents — including AI tool usage. Here's what compliance actually requires in 2026 and where most businesses fall short.

April 2, 2026Read

AI Tools

The Honest Guide to AI Privacy Tools for Canadian Professionals in 2026

A practical evaluation of what Canadian professionals actually need, where most tools fall short, and what the landscape looks like in 2026 for someone who needs to use AI with client data.

March 28, 2026Read

Healthcare

How Canadian Doctors Can Use AI Without Violating PHIPA

Canadian physicians are in an awkward spot with AI. The tools are genuinely useful — but PHIPA creates liability that most physicians don't fully understand. Here's what the law actually requires.

March 28, 2026Read

PIPEDA

Is ChatGPT PIPEDA Compliant? What Canadian Businesses Need to Know

The short answer is no. The longer answer is that it depends on how you're using it, what tier you're on, and whether you've taken steps to address the compliance gap yourself.

March 28, 2026Read

PIPEDA

PIPEDA and AI Tools: What Every Canadian Business Must Know in 2026

Canadian businesses adopted AI tools fast. The compliance conversation followed slowly. In 2026, that gap has closed enough that "I didn't know" is no longer a credible position.

March 28, 2026Read

AI Tools

Can Canadian Lawyers Use ChatGPT? The Real Answer in 2026

Can Canadian lawyers use ChatGPT without violating PIPEDA or solicitor-client privilege? Here's the honest answer — and what to do instead.

March 28, 2026Read

Email & CASL

5 AI Tools Every WooCommerce Store Owner Should Know About in 2026

These 5 AI tools help WooCommerce store owners automate product descriptions, pricing, and customer support — saving 15+ hours weekly on store management.

March 18, 2026Read

Compliance

Atlantic Canada AI Adoption Report 2026: Where We Stand and What Is Coming

340% surge in AI jobs across Atlantic Canada. See how Halifax became a top-2 tech hub and what's next for your business in 2026.

March 10, 2026Read

AI for Business

How AI Content Generation Actually Works Inside WordPress — A Technical Overview

See exactly how WordPress AI plugins process your commands in seconds. From prompt assembly to API calls — the technical steps behind content generation.

March 5, 2026Read

Compliance

The Complete Guide to PIPEDA Compliance for AI-Powered Websites in Canada

Your AI chatbot sends data across the border daily. Here's exactly what PIPEDA requires — and how to stay compliant without killing functionality.

February 28, 2026Read

Compliance

Why Halifax Businesses Should Start Using AI in 2026 — A Practical Guide

Halifax SMBs are adopting AI fast. Learn which 3 types of AI actually work for your business, real costs, and how to start this month.

February 15, 2026Read

Stay Current

Privacy law changes fast. We track it.

New articles every week on PIPEDA, Law 25, CASL, and Canadian AI compliance. No spam — ever.

Canadian Privacy Insights

A Records of Processing (ROPA) Starter Guide for Canadian Companies

De-Identification vs Anonymization Under Canadian Privacy Law

Human Oversight of AI: What 'Meaningful Review' Actually Means

Model Cards and AI Documentation: What to Record About Every AI System

CASL and AI-Generated Marketing Emails

Writing a Privacy Policy for an AI Feature in Canada

Cross-Border Data Transfers After Quebec Law 25

PIPEDA Breach Response: Your First 72 Hours

AI Vendor Risk: 12 Questions to Ask Before You Buy

Data Residency in Canada: Why Where Your AI and Data Live Actually Matters

Do You Need a Privacy Impact Assessment? A Decision Guide for Canadian Businesses

Consent Under Quebec's Law 25: A Practical Checklist for AI-Powered Products

PIPEDA and Automated Decision-Making: What to Disclose When AI Influences Decisions About People

ISO/IEC 42001 Explained in Plain English: The First AI Management System Standard

AI Risk Classification 101: The Four Tiers of the EU AI Act in Plain English

Shadow AI at Work: Finding and Governing the Tools You Don't Know About

How to Write an AI Acceptable Use Policy for a Canadian Team

AIDA Explained: What Canada's AI and Data Act Means for Your Business

The EU AI Act for Canadian SMBs: When It Actually Applies to You

Does the EU AI Act Apply to My Canadian Business? A 2026 Decision Guide

What the OPC's ChatGPT Ruling Means for Your Canadian Business

I Read Every OPC Enforcement Decision From the Last 5 Years. Here's the Pattern.

What a $150,000 OPC Investigation Looks Like — and the PII Failure That Started It

Multi-Jurisdiction Privacy Compliance: How Canadian Businesses Handle PIPEDA, Law 25, and CASL at Once

Redacting a Court Document in Canada: What the Rules Actually Require

Your SaaS Vendors Are a PIPEDA Liability. Most Canadian Businesses Have No Idea.

Canadian Real Estate Agents Are Sitting on a PII Time Bomb

The 72-Hour Breach Notification Clock: A Canadian Business Owner's Survival Guide

Why Open-Source PII Tools Like Presidio Are Not Enough for Canadian Compliance

What a Privacy Impact Assessment Actually Looks Like for a 10-Person Canadian Company

PII Redaction for SaaS Companies in Canada: What Your Terms of Service Isn't Protecting

CASL Is the Most Violated Law in Canadian Business. Enforcement Is Coming.

The 6 Types of PII Hiding in Your Business Documents That No Scanner Is Catching

Your Privacy Policy Does Not Make You PIPEDA Compliant. Here's What Does.

PHI in Emails: How Canadian Healthcare Clinics Are Getting PHIPA Wrong

The PIPEDA Compliance Checklist That Matches What the OPC Actually Looks For

What Actually Happens When a Canadian Law Firm Sends an Unredacted Document to the Wrong Party

Law 25 Is Not Just a Quebec Problem — Every Canadian Business That Touches Quebec Data Is Affected

Document Scanning for PIPEDA Compliance: What the Law Actually Requires

PIPEDA Compliance in 2026: The Real Guide for Canadian SMBs

Your HR Team Is Leaking SINs Every Week and Nobody Is Checking

PIPEDA vs GDPR: What Canadian Businesses Actually Need to Know

AI Tools for Canadian Accountants: What's Safe to Use in 2026

PHIPA Compliance Checklist for Ontario Healthcare Providers Using AI in 2026

ChatGPT for Canadian Real Estate Agents: The Risks Nobody Talks About

Quebec Law 25 and AI Tools: What Every Business Operating in Quebec Must Know

The Honest Guide to AI Privacy Tools for Canadian Professionals in 2026

How Canadian Doctors Can Use AI Without Violating PHIPA

Is ChatGPT PIPEDA Compliant? What Canadian Businesses Need to Know

PIPEDA and AI Tools: What Every Canadian Business Must Know in 2026

Can Canadian Lawyers Use ChatGPT? The Real Answer in 2026

5 AI Tools Every WooCommerce Store Owner Should Know About in 2026

Atlantic Canada AI Adoption Report 2026: Where We Stand and What Is Coming

How AI Content Generation Actually Works Inside WordPress — A Technical Overview

The Complete Guide to PIPEDA Compliance for AI-Powered Websites in Canada

Why Halifax Businesses Should Start Using AI in 2026 — A Practical Guide

Privacy law changes fast. We track it.

Our own compliance