Canada's federal PIPEDA and Quebec's Law 25 govern the collection, use and disclosure of personal information in commercial activity, with consent, accountability, breach reporting and, under Law 25, strengthened rights and transfer assessments.
21 of our 22 tracked controls apply in Canada, graded by how firmly the law requires each one.
A living inventory of what personal data you hold, why, where it sits and where it flows.
A valid legal reason for each use of personal data, mapped per activity.
Where you rely on consent it is freely given, specific, informed, unbundled and withdrawable, with a record.
A published, current privacy notice giving the prescribed information.
Ability to find, correct and delete one person's data on request within the legal deadline.
Every export of personal data is covered by a lawful transfer mechanism.
Encryption in transit and at rest, least-privilege access, and access logging.
A written breach plan and knowledge of each market's notification clock.
DPAs with vendors handling your data, with controller/processor roles defined.
A named person or role accountable for data protection, with published contact where required.
Defined, enforced retention periods and deletion, balancing storage-limitation and legal keep-periods.
Age assurance and verifiable parental consent; no behavioural tracking of children.
Explicit consent, tighter access, and often a DPIA for special-category data.
Lawful basis/consent for e-marketing and an unsubscribe route.
A DPIA/impact assessment for high-risk processing; some markets require a filed dossier.
Card data offloaded to a compliant processor; PCI-DSS scope controlled.
A published route to raise a privacy complaint; India requires a grievance officer.
Cookie/tracker consent and an accurate cookie policy where required (esp. EU/UK).
A local/EU representative where you have no establishment in a market that requires one.
Safeguards and transparency for automated decision-making and profiling.
Local storage/residency requirements for certain data or sectors.
Answer a few questions and PrivMatrix shows you exactly where you stand against PIPEDA · Law 25, then generates the policies, notices and registers that close each gap - written for Canada.
