Reference
I put this glossary together because privacy law reads like a foreign language, even for people who work with it every day. These are the 333terms I find myself explaining most: Law 25, PIPEDA, CASL, the CAI and OPC, consent, PIAs, AI governance, and the individual rights behind them.
Each definition helps you get oriented; it is no substitute for reading the statute or talking to qualified counsel about your facts.
Reading someone else's policy or notice? Paste it into the jargon decoder, which uses these same 333 definitions to translate privacy text into plain language, right in your browser.
No terms match your search. Try a different word, or ask me about it.
An access request is how you ask an organization what personal information it holds about you. Under PIPEDA and Québec's Law 25, the organization generally has 30 days to respond, either with the information or a refusal with reasons. Missing the deadline is a red flag that privacy regulators take seriously.
Access request exceptions are the situations where PIPEDA lets an organization refuse to give a person their information, such as where disclosure would reveal confidential commercial information, compromise an investigation, or identify another individual. Refusals must be explained with reasons, and blanket refusals without examining the request are not allowed. These exceptions are read narrowly, in favor of the requester's right of access.
Under PIPEDA, organizations can charge a reasonable fee for responding to an access request, but they must tell the person the fee in advance and give them the chance to withdraw the request. Many organizations charge nothing to keep the process simple and goodwill intact. A fee that is really a barrier to access will not survive a regulator's review.
The Access to Information Act gives the public a right to request records held by federal institutions, subject to exemptions. Unlike the Privacy Act, it covers records generally rather than just personal information about the requester. Institutions must respond within 30 days, with limited extensions, and refusals can be complained about to the Information Commissioner.
An accidental meltdown is when an AI agent pursuing a legitimate goal hits friction, a missing file, a failed API call, a permission denial, and goes hunting for a workaround that crosses a security boundary: reconnaissance, privilege escalation, secret discovery, or data exfiltration. The term comes from Cornell researchers who measured meltdowns in 64.7% of agent rollouts that hit simulated errors. No malicious prompt is involved; the agent becomes the adversary by being helpful. Teams deploying agents should treat unexpected workaround behavior as an incident to triage.
Related insight: AI agentRogue AI agent
The Access to Information and Protection of Privacy Act, 2015 is Newfoundland and Labrador's law governing public access to government records and the protection of personal information held by public bodies. The province's information and privacy commissioner has called it the strongest access-to-information law in Canada. A statutory review underway in 2026 is examining targeted updates on solicitor-client privilege claims, political party data, artificial intelligence, and commissioner oversight powers.
Accountability means the organization is responsible for the personal information it collects, even after handing it to a vendor. PIPEDA makes it a named principle; Law 25 puts the duty squarely on the person carrying on the enterprise. In practice it means named owners, documented decisions, and evidence, not just a policy PDF.
The accuracy principle says personal information must be as accurate, complete, and up to date as necessary for the purposes it is used for. A mailing list can tolerate some staleness; a credit decision cannot. Organizations also have to minimize the chance that inaccurate information gets passed on when they disclose it.
This is Quebec's public-sector statute governing access to documents held by public bodies and the protection of personal information within them. It plays the role that FIPPA-type laws play in other provinces. The CAI oversees both halves: access and privacy.
This is Quebec's private-sector privacy statute, the counterpart to PIPEDA for organizations doing business in the province. Bill 64 modernized it in 2021, introducing rules on automated decisions, incident notification, and default privacy settings. Law 25 is the popular shorthand for the Bill 64 reforms to this act.
The European Commission can issue an adequacy decision finding that another country's privacy law protects personal data well enough that data can flow there from the EU without extra safeguards. It is the strongest transfer basis under the GDPR and applies to the whole receiving country at once. Canada holds a partial adequacy finding covering commercial organizations under PIPEDA, which is why EU-to-Canada commercial transfers usually need no extra paperwork.
Administrative monetary penalties are the CRTC's main enforcement tool under CASL: fines issued without a criminal trial, with maximums among the highest in Canadian regulatory law. They scale with the violation and the organization's history, and directors and officers can be personally liable if they directed or acquiesced. Voluntary compliance undertakings are often negotiated as an alternative.
ADMT stands for automated decision-making technology: systems that make or support decisions about people, like screening résumés, scoring credit, or triaging benefits, with little or no human involvement in each case. Regulators treat it as high-risk because errors and bias scale instantly and affected people often cannot see or challenge the logic. Under Law 25, organizations must inform individuals when a decision about them is made exclusively through automated processing.
Age assurance is the broader practice of estimating or confirming a user's age, covering everything from self-declaration and document checks to estimation methods that infer an age range without asking for identity. Good age assurance returns only an attribute, like “over 16,” and retains nothing else, so the check cannot become a tracking database. The privacy challenge is matching the strength of the method to the risk: stronger assurance usually means collecting more personal information, which is exactly what data minimization pushes against.
Age estimation is a form of age assurance that infers how old a user probably is, usually by analyzing a face image, rather than confirming identity with a document. Ofcom's 2026 rapid assessment notes a margin of error of a few years at 16, which is why services use a challenge-age protocol: estimates near or below the threshold get a second, document-based check. For Canadian teams, estimation is the weakest of the four methods Ofcom found capable at 16, and the ICO warns it should not prop up a weak age gate.
Under Law 25, a child under 14 cannot give valid consent for the collection, use, or disclosure of their personal information, the parent or tutor must consent instead. Organizations dealing with young users need parental-consent flows, not just a ticked box. This raised the bar well above the old norms.
Age prediction is a form of age assurance that estimates whether a user is over or under an age threshold by analyzing behavioral signals as they use a service, rather than checking a document at sign-up. OpenAI applies continuous age prediction in ChatGPT to move estimated minors into a teen experience with stronger limits, reassessing the signals throughout use. The privacy tension is that prediction is invisible to the user: unlike a document check, it can reclassify someone without asking, and a wrong classification restricts what the service will show. For Canadian teams, prediction sits alongside the four methods Ofcom assessed in 2026, and none of the Canadian proposals currently on the table regulate it.
Related insight: OpenAI teen safety and Community Safety Report article
Age verification is the process of confirming that a user meets a minimum age before letting them use a service, for example checking an ID document or running a verified age check at sign-up. Proposals like the EU Kids Act and Canada's Bill C-34 would make it a precondition for social media and other services used by minors. The privacy-safe version proves the age attribute without storing the identity evidence behind it, because a verification log that keeps everyone's documents becomes a high-value target.
Related insight: EU Kids Act age-verification article
An agent is someone authorized to act for a health information custodian with respect to personal health information: employees, contractors, and sometimes students or volunteers. Agents may only use the information as the custodian permits and must notify the custodian of breaches or privacy complaints. The custodian remains accountable for what its agents do.
An AI agent is an AI system that takes actions on a user's behalf rather than only producing text: booking appointments, running searches, changing settings, or completing multi-step tasks across apps. Agents raise distinct privacy questions because they hold credentials, see sensitive context, and can act without the user reviewing each step. Canadian teams deploying agents should inventory what each agent is authorized to do, confirm users know they are dealing with an agent, and log what the agent did for later review.
AI-generated content labelling is the practice of marking text, images, audio, or video produced or modified by an AI system so people can tell it is synthetic, through visible labels, metadata, or watermarks. Labelling matters for two audiences: the person viewing the content, who can weigh it with care, and the person depicted in it, who gains a practical route to challenge decisions or copies based on a fake. In Canada, the OPC's October 2026 submission to ISED's AI transparency consultation argued that labelling should be paired with fast removal mechanisms, and proposed federal legislation would add deletion rights covering synthetic content. Teams using generative AI should treat labelling as part of the content's lifecycle, not a badge added at publication.
An AI inventory is a living list of every AI system an organization builds, buys, or uses, from resume-screening tools to customer-service chatbots. It is the starting point of AI governance: you cannot assess risks, complete privacy impact assessments, or answer a regulator for systems you do not know you have. The hard part is keeping it current, because employees adopt AI tools on their own (shadow AI), so practitioners recommend continuous discovery rather than a once-a-year spreadsheet.
AI safety escalation is the internal process by which an AI provider's safety team flags concerning user content, such as plans of violence or instructions for wrongdoing, and routes it for review, action, or referral to authorities. It covers who sets the escalation threshold, who can override a recommendation, and what gets recorded when escalation does or does not happen. The British Columbia lawsuit against OpenAI, filed in September 2026, put this process in the spotlight by alleging that internal safety reviewers recommended police contact and were overruled. Organizations buying AI services should treat a vendor's escalation practice as part of due diligence, not just its model capabilities.
An AI safety report is a recurring public document in which an AI provider describes its safety systems, the risks it is seeing in practice, and how well its mitigations are working. OpenAI committed in October 2026 to publishing a Community Safety Report every six months, starting in early 2027 with anonymized examples and data on violence prevention. For buyers of AI services, a vendor's safety report works as a transparency artifact: a fixed cadence makes gaps visible over time, and the absence of one is itself information about a vendor's maturity.
Related insight: OpenAI teen safety and Community Safety Report article
An AI scribe is an AI tool that listens to a clinical encounter, such as a doctor-patient conversation, and drafts the visit notes or chart entries from the recording or transcript. Scribes are the most widely deployed form of AI in Canadian health care, and they raise the privacy questions the sector is working through: whether the patient was told, whether the recording is stored or only processed, and whether the vendor improves its model on clinical conversations. Alberta, Ontario, and BC privacy regulators have each published scribe-specific guidance, and the October 2026 federal-provincial-territorial resolution on AI in health names scribes among the systems its six principles cover.
AI transparency means making information about AI systems available to the people affected by them: when a system is in use, how it was built, what data trained it, and how incidents are handled. It is the starting point of most AI governance regimes because users, customers, and regulators cannot assess or contest what they cannot see. Canada's federal government ran a public consultation on AI transparency in the summer of 2026, and several jurisdictions, including the EU and California, already require forms of disclosure from AI developers.
AIDA is Canada's proposed AI law, introduced as part of Bill C-27. It would require organizations building or using high-impact AI systems to assess and mitigate risks, keep records, and notify authorities of serious harms. Because it is still a proposal, the details are not settled, so treat any claimed obligations from it as subject to change.
Alberta PIPA is Alberta's private-sector privacy law, covering the collection, use, and disclosure of personal information by organizations in the province. It has been deemed substantially similar to PIPEDA, so it displaces the federal law for most Alberta business activity. Unlike PIPEDA, it gives the provincial commissioner the power to issue binding orders and fines.
An algorithmic impact assessment is a structured review of what could go wrong with an automated system before it is deployed: who it affects, how it could discriminate, and what safeguards are needed. Several Canadian governments already require versions of it for their own AI tools. Private-sector organizations are adopting the practice to show regulators they took AI risk seriously.
Anonymization means altering personal information so it no longer allows identification of the person, and Law 25 reserves the label for irreversible processes. The CAI sets the criteria, focusing on irreversibility and resistance to re-identification through reasonable means. Techniques that can be reversed with outside data are de-identification, not anonymization, and they do not escape the law.
De-identification removes direct identifiers (like names) so someone can't be picked out directly, but the data can still count as personal information. Anonymization goes further: it is meant to be irreversible, so the data no longer relates to an identifiable person at all. Law 25 treats the two differently, anonymized information falls outside the Act, while de-identified information does not.
Japan's APPI is the national law governing how businesses handle personal information. It was substantially amended in 2020 to add stronger individual rights, and Japan holds an EU adequacy decision for commercial transfers. Canadian organizations working with Japanese partners will see APPI-style clauses in those contracts.
Appropriate purposes is the PIPEDA rule that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. It acts as a backstop, so consent alone does not make a shady practice lawful. Regulators have used it against purposes like covert surveillance and selling location data without a defensible reason.
Article 50 of the EU AI Act sets transparency duties for certain AI systems, in force since August 2026. Providers of generative AI must mark synthetic text, audio, image, and video outputs in a machine-readable way so they can be detected as AI-generated, while deployers must disclose AI interaction, emotion recognition use, and deepfakes. For Canadian organizations, the key point is reach: the duties can apply to providers outside the EU when their systems or outputs are used in Europe.
Related insight: AI transparency
As soon as feasible is PIPEDA's timing standard for breach notifications to the Commissioner and affected individuals once the real risk threshold is met. It does not set a fixed number of days; instead it expects prompt action given what the organization knew and when. Delays spent on internal deliberation rather than investigation tend to draw regulatory scrutiny.
Audit logs in health care record who accessed a patient's electronic health information, when, and what they did with it. Custodians must be able to produce them on request, and they are the primary evidence in snooping investigations. Patients can ask for a list of who has viewed their records, and the logs make that answer possible.
The B2B exemption allows commercial electronic messages between organizations when the sender and recipient have a relationship and the message concerns the recipient's activities, roles, or functions. In practice, it means business-to-business outreach to work addresses about work matters can proceed without consent. It does not cover messages to personal addresses or pitches unrelated to the recipient's role.
Background checks are pre-employment screens of candidates: criminal records, credit history, references, education verification, and sometimes social media. Privacy law requires consent and limits collection to what is reasonable for the position, so a credit check for a cashier role needs justification. In some provinces, criminal record checks are further restricted by human rights and policing-record laws.
Advertising personalized to you based on data collected about your behavior, such as browsing history, purchases, or app activity. The more data a company collects, the more precisely it can target ads, which is why behavioral advertising drives large-scale data collection. In Canada it is usually governed by consent and purpose-limitation rules under PIPEDA and Law 25, and Quebec requires privacy-friendly defaults for tracking technologies.
BC's Freedom of Information and Protection of Privacy Act covers provincial public bodies, including ministries, municipalities, and universities. It includes distinctive data-residency expectations that made British Columbia an early outlier on keeping public-sector data in Canada. BC's OIPC enforces it.
BC PIPA is British Columbia's private-sector privacy law, governing how organizations in the province handle personal information. Deemed substantially similar to PIPEDA, it replaces the federal law for most private-sector activity in BC. It is known for its strict employee personal information rules and the commissioner's order-making powers.
Bill 64 is the statute that modernized Quebec's private-sector privacy law. Passed in 2021, it substantially amended the Act respecting the protection of personal information in the private sector, with the resulting package of reforms usually known as Law 25. Think of Law 25 as the nickname and Bill 64 as the law that delivered it.
Binding corporate rules are an internal privacy code that a multinational group writes and gets approved by European regulators, so it can move personal data between its own companies worldwide. They are legally binding on every member company and must be enforceable by the individuals whose data is transferred. Smaller companies rarely use them because the approval process is long and expensive.
Before creating a database of biometric characteristics, such as fingerprints, facial images, or voiceprints, an organization must file a declaration with the CAI. The filing describes the database and its purposes, and any later change to those purposes must also be declared. Biometrics are treated as especially sensitive, so this extra layer of transparency is built into the law.
Biometric information identifies you through unique physical traits: fingerprints, face geometry, voiceprints, iris scans. Because it can't be changed if compromised, Québec law treats it as sensitive and requires organizations to disclose biometric databases to the CAI before creating them. Collect it only when truly necessary.
A confidentiality incident is Québec's term for a privacy breach: unauthorized access, use, communication, or loss of personal information. Law 25 requires organizations to keep a register of every incident and to notify the CAI and affected individuals when there is a risk of serious injury. PIPEDA has a parallel breach-notification duty to the OPC and individuals when there is a real risk of significant harm.
When PIPEDA requires breach notification, the notice to affected individuals must contain prescribed content: a description of the breach, the kinds of information involved, steps the organization is taking, and what the individual can do to reduce the risk. Notices to the Commissioner go through a prescribed form with similar detail. Vague reassurance without these elements does not satisfy the law.
Breach record-keeping is the PIPEDA requirement that organizations record every breach of security safeguards involving personal information, whether or not it meets the notification threshold. The records must be kept for a prescribed period and made available to the Commissioner on request. Regulators use these records to check whether an organization's notification decisions were reasonable.
Business contact information is details like a person's work title, work address, and work phone number or email that identify them in their professional role. PIPEDA does not treat it as personal information when it is collected, used, or disclosed solely to communicate about employment or business. This is why sending a work email to a colleague's office address does not trigger the usual consent rules.
BYOD, bring your own device, is the workplace practice of employees using personal phones or laptops for work. It creates a privacy collision: the employer's need to secure work data versus the employee's personal information on the same device. Good programs use technical separation like work profiles, written policies, and clear rules about remote wipe, rather than blanket access to the personal device.
The Commission d'accès à l'information du Québec is the province's privacy and access-to-information regulator, covering both public bodies and private enterprises. Under Law 25 it gained real teeth: investigation powers, orders, and the ability to impose administrative monetary penalties. It is the first place Québecers turn with a complaint.
Before an organization can receive personal information for research without consent, it must obtain the CAI's authorization. The application sets out the project's purpose, the information needed, and how it will be protected. This keeps a regulator in the loop on high-risk secondary uses instead of leaving it to the parties' judgment alone.
The CAI can investigate on its own initiative or after a complaint, and it can demand documents, access systems, and question people under oath. Organizations that refuse to cooperate risk separate penal offences. These powers are the enforcement engine behind Law 25's rules.
The CAI can offer mediation to resolve disputes between individuals and organizations over access requests or correction requests. It is an informal, consensual process aimed at settling the matter without a full examination or order. Many complaints that start out confrontational end here, which saves time for both sides.
A trade agreement concluded by Canada and the European Union at their October 30, 2026 summit in Montreal, under the banner of an 'Alliance for the Future.' It updates digital trade rules and aims to make cross-border transactions simpler for Canadian businesses selling goods and services online in Europe, alongside a commitment to reciprocal access to each other's cloud and AI markets. It is a trade instrument: it does not by itself change cross-border data-transfer rules, and Canada's EU adequacy finding and the proposed Cloud and AI Development Act continue on their own tracks.
Capacity to consent in health privacy means the individual can understand the information relevant to the decision and appreciate its reasonably foreseeable consequences. Under PHIPA, capacity is presumed and assessed relative to the specific decision, not as a blanket label. When a person lacks capacity, a substitute decision-maker steps in following a ranked list.
CASL originally included a private right of action letting individuals sue senders directly for violations. It has been suspended by government order since before it was due to take effect, so no private lawsuits can proceed under it. For now, enforcement runs only through the CRTC, the Competition Bureau, and the Privacy Commissioner.
The CCPA is California's main consumer privacy law, in force since 2020. It gives Californians rights to know, delete, and opt out of the sale of their personal information, and it applies to businesses over certain size thresholds even if they are not based in California. Canadian companies that sell into the US market often have to comply with it alongside Canadian law.
Quebec's centralized health record makes clinical information available across providers through a shared provincial record system. Clinicians can access a patient's history regardless of where care was delivered, subject to consent and access controls. Patients can also see their own information and, in defined circumstances, restrict who views it.
Challenge age is the age-assurance practice of setting the check threshold above the legal age, the same logic retailers use in Challenge 25 for alcohol sales. Because facial age estimation can miss by a few years at 16, Ofcom's rapid assessment recommends challenging anyone estimated near or below the threshold with a document-based check, since a 15-year-old can be estimated as 17. The result is that many 16- and 17-year-olds prove their age with photo ID anyway, which is why Ofcom treats photo ID as the backstop for every method at 16.
Challenging compliance is the tenth PIPEDA principle: anyone can question how an organization follows the law and must get a clear path to do so. Organizations have to designate someone to handle complaints and explain their privacy practices on request. It turns privacy rights from theory into something a person can actually exercise.
A Charter Statement is a document the Minister of Justice tables in Parliament for every federal government bill, as required by the Department of Justice Act. It describes the bill's potential effects on the rights and freedoms protected by the Canadian Charter of Rights and Freedoms, so that MPs, senators, and the public can debate the bill with that analysis in view. It is not a legal opinion on whether the bill is constitutional, and it reflects the bill as introduced, so it is not updated as the text changes during debate. In practice, it is the first public look at how the government expects to justify any limits the bill places on Charter rights.
Related insight: Four Months In, Bill C-34 Still Has No Charter Statement. The Silence Is the Signal.
The Children's Privacy Code is guidance the Office of the Privacy Commissioner of Canada launched on October 20, 2026, setting expectations for how organizations handle children's personal information online. It calls for meaningful consent (including parental consent for under-13s and opt-in consent for non-essential uses), age-appropriate communication, correction and deletion of children's data, no profiling of children for marketing or AI-driven decisions, and privacy-by-default settings. It also rejects deceptive design practices aimed at children. The Code is the first of its kind in Canada, and the OPC accepted public comments on it until January 20, 2027.
Related insight: Canada's First Children's Privacy Code Is Live. Five Rules, and Your Product Is in Scope
The circle of care is not a legal term but a widely used shorthand for the health providers involved in a person's care who may share personal health information with each other under PHIPA's implied consent. It covers the treating team, not the whole health system: a specialist you were referred to is in, a researcher you never met is out. Patients can still withdraw or withhold consent through a lockbox instruction.
CADA is the European Commission's June 2026 proposal for regulating cloud and artificial intelligence infrastructure as a sovereignty matter. Its core mechanism is four Union assurance levels that would gate sensitive public-sector and critical-sector workloads to providers meeting graduated requirements on EU ownership, control, data location, and independence from foreign government access. It is still a proposal working through the European Parliament and the Council, not law in force. For Canadian teams, it matters because Canada is seeking associated-country status that would let its providers be audited at the higher levels.
Related insight: The EU Wrote a Tier List for Sovereign Clouds. Canada's Pivot Makes It Your Vendor Problem.
PIPEDA applies to the collection, use, or disclosure of personal information in the course of commercial activity, which means activity with a business or profit-seeking character. Courts have read this broadly, so even a not-for-profit can fall under PIPEDA when it sells things or charges fees. The scope question is why most Canadian private-sector businesses need to comply with the law.
A commercial electronic message is any electronic message that encourages participation in commercial activity: sales emails, texts, direct messages, and even some app notifications. CASL regulates them heavily: you generally need consent before sending, plus proper sender identification and a working unsubscribe. The law's definition is broader than most people expect, which is why marketing teams keep getting it wrong.
When one business acquires or merges with another, personal information needed for the deal can be shared without consent. Both parties must first agree in writing to use it only for that purpose, protect its confidentiality, and limit access. If the transaction falls through, the information must be destroyed or returned.
If a Québec organization refuses your access request or you believe it mishandled your information, you can file a complaint with the CAI. The Commission can investigate, mediate, and order an organization to take specific steps. It can now also impose financial penalties for non-compliance.
A compliance letter is a written agreement between the federal Privacy Commissioner and an organization under investigation, in which the organization commits to specific corrective measures. The Commissioner keeps the investigation open and closes it only once satisfied that the commitments have been met. It is a cooperative alternative to a published finding or a Federal Court application under PIPEDA, where the Commissioner has no order-making power against private-sector organizations. Commissioner Dufresne has made the tool a signature of his tenure, using it to resolve cases like the 2025 WestJet breach more quickly than adversarial proceedings.
CASL's computer program provisions make it unlawful to install software on someone else's computer without consent in the course of commercial activity. Express consent is needed when the installation does things a reasonable user would find unexpected, like collecting personal information or changing settings. The classic targets were spyware and adware bundles, but the rules also catch deceptive browser extensions and bundled installers.
Law 25 requires every enterprise to maintain a written register of confidentiality incidents, not just the ones it reports. The register records what happened, when it was discovered, and what was done about it. The CAI can demand a copy at any time, so this is where breach readiness gets audited.
Consent is the permission an individual gives an organization to collect, use, or disclose their information. Implied consent is inferred from actions (like handing over an email at checkout), while express consent is a clear yes, and Law 25 requires express consent for sensitive information. Law 25 also demands that consent be manifest, free, informed, given for specific purposes, and requested separately from other communications when in writing.
Individuals can withdraw consent they previously gave, subject to legal or contractual restrictions. The withdrawal works going forward, data already lawfully used can't be un-rung, but the organization must stop the consented processing. This is why consent management has to be more than a one-time banner click.
Consistent use is a Privacy Act rule that lets a federal institution use personal information for the purpose it was collected for, or for a use consistent with that purpose that the individual would reasonably expect. Uses outside that scope generally need the person's consent or specific legal authority. It is the federal equivalent of purpose limitation in the private sector.
Consistent purpose is a FIPPA rule that lets a BC public body use or disclose personal information for the purpose it was collected for, or for a use consistent with that purpose. A use counts as consistent when it has a reasonable and direct connection to the original purpose and the individual would reasonably expect it. In the October 2026 Kamloops order, the investigator rejected a mayor's public self-defense as a consistent purpose for disclosing staff text messages. Privacy teams use this test to decide whether a secondary use stays inside the original purpose.
Conspicuous publication is when an email address is posted publicly, for example on a company contact page, without any statement that the person does not want commercial messages. CASL treats that as implied consent, but only for messages relevant to the person's role or business. It does not cover addresses harvested at random or messages unrelated to the published role.
The Consumer Privacy Protection Act is a proposed federal law that would replace PIPEDA's private-sector provisions with a modernized privacy regime. It would give the Commissioner order-making powers and introduce significant administrative penalties, among other changes. Privacy programs track it because it would reshape compliance expectations if enacted.
Contextual integrity is a theory of privacy that says information flows are fine only when they fit the norms of their context: your doctor sharing test results with a specialist is expected, your doctor selling them to a marketer is not. It judges privacy by whether a flow breaks social expectations, not by whether data was technically public. Privacy scholars use it to explain why people object to some data uses even when they agreed to others.
Convention 108+ is the Council of Europe's modernized data protection treaty, open to countries outside Europe as well. It sets baseline standards for fair processing, security, and individual rights that its member states must write into national law. Canada has not joined it, but it is the main treaty shaping how other democracies benchmark their privacy regimes.
Cookies, pixels, and SDKs that collect personal information are subject to Law 25's consent rules. Organizations must explain tracking technologies that identify, locate, or profile people and give them a way to deactivate profiling functions. Non-essential trackers generally need an informed opt-in, and privacy settings must default to the highest level of confidentiality.
COPPA is the US federal law protecting the personal information of children under 13 online. Websites and apps aimed at kids, or ones that knowingly collect children's data, must get verifiable parental consent before collecting it. It has been the template for stronger children's privacy rules debated in several countries, including Canada.
The CPRA is the 2020 ballot measure that amended and expanded the CCPA. It created a dedicated enforcement agency, added a right to correct inaccurate data, and introduced limits on sensitive personal information like precise geolocation. It took effect in January 2023 and remains the US law most similar in reach to Canadian privacy statutes.
Credit monitoring is a service that watches your credit file at one or both of Canada's credit bureaus, Equifax and TransUnion, and alerts you when something changes, such as a new account, an inquiry, or an address change. Organizations often offer it free for a set period after a data breach so affected people can spot identity theft early. It detects misuse after it happens; it does not prevent someone from opening an account in your name, which is what a credit freeze or fraud alert is for. If you are offered monitoring after a breach, enroll, read the alerts, and check your free credit reports directly as well.
A critical incident is an AI safety event serious enough to trigger mandatory reporting. Examples include a model materially enabling harm or behaving far outside its safety evaluations. California's SB 53 uses the concept to decide which events frontier-model developers must disclose to the state. Exact legal thresholds vary by jurisdiction, so map reporting duties per market rather than assuming one global standard.
Cyber Security Awareness Month is a national public awareness campaign held every October, led in Canada by Get Cyber Safe, the campaign run by the Communications Security Establishment. Each edition has a theme and four weekly focus areas; the 2026 edition, 'Your best defence is you,' put AI-driven scams front and centre. Privacy and security teams often use the month to run internal training, phishing simulations, and MFA pushes, since regulators treat employee awareness as part of an organization's safeguards.
A cross-border transfer is any communication of personal information outside Québec (or outside Canada), including cloud storage hosted in another country. Law 25 requires a privacy assessment before the transfer and a written contract ensuring comparable protection at the receiving end. Under PIPEDA, organizations remain accountable and must use contractual safeguards for transfers for processing.
Before sending personal information outside Quebec, an organization must assess what could happen if the data is accessed or disclosed abroad. The review considers the foreign jurisdiction's legal framework, its privacy protections, and any other factors affecting confidentiality. This is the closest Quebec gets to adequacy decisions: the duty to assess sits with the exporting organization, not the regulator.
The CRTC enforces CASL's rules on commercial electronic messages, unsolicited telecoms, and malware. It investigates complaints, can demand production of records, and issues penalties and undertakings to violators. It coordinates with the Competition Bureau and the Privacy Commissioner, who cover deceptive marketing and the computer program provisions respectively.
The CSA Model Code is the 1996 Canadian Standards Association standard that set out ten fair information principles for handling personal data. PIPEDA's Schedule 1 is built directly on it, turning those principles into law. Privacy professionals still cite the Model Code as the original architecture behind Canada's consent-based approach.
Dark patterns are interface designs that manipulate users into choices they would not otherwise make: pre-ticked boxes, hidden decline buttons, or countdown timers that reset. Regulators increasingly treat them as invalidating consent, because consent obtained through deception is not meaningful. Several Canadian enforcement actions have targeted them.
Dark web monitoring is the practice of watching underground forums, marketplaces, and leak sites for an organization's stolen data or credentials after a breach. It can give early warning that exfiltrated information is being traded or published, and investigators use it to assess whether stolen data has been re-disclosed. Its limits matter: a quiet result means nothing has been seen, not that nothing exists, because monitoring only covers the forums and markets it watches. Breach notices that cite monitoring should state those limits plainly.
Dashcam video surveillance means recording video from cameras mounted in or on vehicles, and it becomes a privacy issue when the camera films people rather than the road. Quebec's CAI ordered a delivery company to limit in-cab dashcam recording to a few seconds around incidents, stop recording after engine shutdown, and destroy excess footage. The ruling treats continuous filming of a workspace, even a truck cab, as collection that must be proportionate and limited. Organizations using vehicle cameras should aim them at the road, limit retention, and restrict who can watch the footage.
A data broker is a company that collects personal information about people, mostly from other sources rather than directly, and sells it to advertisers, insurers, employers, and others. Most people have never heard of the brokers trading their profiles. Quebec's Law 25 and US state laws have begun giving individuals rights to find and delete broker-held data.
Data minimization means collecting only the personal information you actually need for the purpose at hand, nothing more. Both PIPEDA and Law 25 require necessity-based collection. It is the simplest, most underused way to cut privacy risk: data you never collect can't be breached.
Data portability is the right to receive your personal information in a structured, commonly used format and have it transmitted to another organization. Law 25 introduced it in Québec effective September 2024, going beyond what PIPEDA currently offers. It matters most when switching providers, think health apps, banks, and platforms.
Data retention is how long an organization keeps personal information, and when it destroys what it no longer needs. Canadian privacy law requires keeping personal information only as long as necessary for its stated purpose, with Quebec's Law 25 making the obligation explicit. Stale data is a standing liability: every old record that survives past its useful life is a record that can be breached. A breach notice that describes data dating back to the 1990s taken in a recent intrusion is a textbook case of retention failure compounding a security incident.
Proposed federal legislation, Bill C-34 (the Safe Social Media Act), that would create a Digital Safety Act imposing duties on operators of regulated social media, chatbot, and online services. The duties include acting responsibly to mitigate harmful content, making certain content inaccessible (such as intimate images shared without consent and content that sexually victimizes children), protecting children through design features and age verification or estimation, and labelling bot-disseminated and synthetic content. A new Digital Safety Commission would enforce the regime. As of 2026 it is a bill before Parliament, not law.
The regulator that Bill C-34 (the Safe Social Media Act) would create to enforce the Digital Safety Act. It would set standards and guidance, judge whether operators' measures are adequate, grant exemptions from the under-16 minimum age requirement for services with adequate child safeguards, handle complaints about certain harmful content, and impose administrative monetary penalties. Bill C-36 would fold it into a broader Digital Safety and Data Protection Commission with a Privacy and Consumer Data Commissioner. As of 2026 the Commission is proposed, not yet established.
Digital sovereignty is a country's ability to decide where its data lives, who owns the infrastructure that holds it, and whose laws govern access to it. In Canada, the idea moved from rhetoric to policy in 2026: Saskatchewan's Data Centre Framework requires Canadian ownership and self-supplied power for new data centres, and the federal government launched responsible data centre development principles with major cloud and AI firms as signatories. For privacy teams, the term matters in procurement: a vendor's claim of sovereignty is worth what the contract says about corporate control, data location, staff, and foreign government access.
A data processing agreement is the contract between an organization and a vendor that processes personal information on its behalf. It spells out the permitted purposes, security safeguards, sub-processor rules, breach notification duties, and what happens to the data when the contract ends. A DPA is where accountability gets written down in enforceable terms.
De-indexation is the right to have a link to your personal information removed from search results or to stop its dissemination. Law 25 (in force September 2024) lets individuals ask organizations to cease disseminating their information or de-index hyperlinks attached to their name. It is Québec's version of the broader “right to be forgotten” debate, and the OPC has also issued draft guidance on de-indexing for search engines.
A deemed refusal happens when an organization fails to respond to an access request within the statutory timeframe, and the law treats the silence as a refusal. The requester can then complain to the regulator as if they had been formally refused. It stops organizations from killing requests by simply ignoring them.
Defense in depth is the practice of stacking multiple, varied, redundant safeguards so that no single failure causes a breach: if one layer is circumvented, others remain. For AI agents, Perplexity's 2026 formulation adds three design rules: safeguards must fail for independent reasons and sit outside the agent's reach, at least one layer must be deterministic code the agent cannot decline or reconfigure, and risk signals may only reduce the agent's authority, never grant more. A prompt telling an agent to behave is guidance, not a layer.
Related insight: Accidental meltdown (AI agents)
Law 25 requires that the highest level of privacy protection be the default when an organization launches a technological product or service. Users can choose to lower their settings, but they should never have to opt out of invasive defaults. This flips the old model, where products often collected everything unless the user dug through menus to turn it off.
A designated investigative body is an organization, such as a fraud or counterfeit watchdog, formally recognized in federal regulations under PIPEDA. It can collect personal information without consent in the course of investigating breaches of agreements or the law, within defined limits. Banks and payment companies rely on this provision when sharing fraud intelligence.
Under Québec's Law 25, the statute's term is “communication”: sharing personal information with anyone outside the enterprise or the original purpose. Communication generally requires consent unless a specific exception applies (such as a legal obligation). PIPEDA uses “disclosure” for the same idea, and cross-border communications trigger extra assessment and contract requirements.
The Treasury Board Secretariat's Directive on Security Screening sets the high-level rules for how federal institutions screen employees who hold or are seeking a security clearance. It governs the parameters of collecting, using, and disclosing screening-related personal information. The OPC has pressed TBS to back it with detailed guidance on assessing and mitigating privacy risks, and to test each collection against necessity, proportionality, effectiveness, and minimal intrusiveness.
India's DPDPA is the country's first comprehensive privacy law, passed in 2023. It gives Indians rights over their digital personal data and puts duties on the companies handling it, with significant penalties for breaches. Details are still being filled in through government rules, so Canadian firms doing business in India should watch how it is implemented.
DPIA (data protection impact assessment) is the GDPR's name for the assessment; PIA (privacy impact assessment) is the Canadian term used by the OPC and Québec's EIVP (évaluation d'impact sur la vie privée). They are the same family of exercise: identify privacy risks before launching something new. Name aside, Law 25 makes the assessment mandatory for certain projects.
Double extortion is a ransomware tactic with two pressure levers: the attacker encrypts the victim's files and also steals data, then threatens to publish the stolen data unless a ransom is paid. The public leak site is the second lever. In Canada, the theft side of the attack typically triggers breach notification duties even when the encryption alone would have been only an outage.
Related insight: On a Leak Site at Last: What Nipigon's Ransomware Listing Means for Small Hospitals
A duty of care is a legal obligation to take reasonable steps to prevent foreseeable harm to others. In the online safety debate, it would require platforms to design services that do not expose children to foreseeable harm, rather than reacting after harm occurs. The House of Commons Heritage Committee recommended a legally enforceable duty of care for online services in its June 2026 report on children and social media. Bill C-34 takes a different route, imposing specific design duties and an account ban instead of a general duty of care.
An electronic health record is the province-wide system that pulls together a patient's health information from many providers into one accessible record. PHIPA gives the Minister or a designated agency authority to operate it, with patients able to place lockbox restrictions on who sees what. Access is logged and audited, and snooping by curious staff is a classic enforcement case.
Ontario employers with 25 or more employees must have a written electronic monitoring policy describing whether and how they monitor workers electronically. The Employment Standards Act requires the policy to state if monitoring occurs, but it does not restrict what monitoring is allowed. It is a transparency rule, not a consent rule, and privacy laws still apply on top.
An electronic record that meets the conditions in section 8 of the proposed Enabling Digital Trade Act to stand in for a paper trade document such as a bill of lading. The record must carry the same information, be identifiable as distinguishable from its copies, remain controllable by a reliable method for its whole life, and be protected against unauthorized alteration. Where federal law requires possession of the paper document, exclusive control of the electronic record through a reliable method counts as possession.
The emergency exception lets an organization collect, use, or disclose personal information without consent where there is an emergency that threatens someone's life, health, or security. A hospital sharing a patient's details with first responders is the classic example. Once the emergency passes, the usual consent rules apply again.
Employee monitoring is the tracking of workers' activity by employers: keystroke logging, email and chat review, location tracking, screen capture, and similar tools. In Canada's private sector, PIPEDA and provincial laws require notice and a reasonable purpose, with consent generally implied from the employment relationship only where expectations are clear. Monitoring that goes beyond what a reasonable person would expect, especially in unionized workplaces, gets struck down.
Employee personal information is data about staff, resumes, payroll, performance, health accommodations, monitoring logs. Unlike some other provinces' laws, Law 25 applies fully to employee data, so the same consent, transparency, and access rules apply. Monitoring employees (cameras, keystroke logging, location tracking) needs necessity, proportionality, and clear notice.
Under the Alberta and BC private-sector privacy laws, employee personal information gets its own regime distinct from customer data. Employers can collect, use, and disclose it without consent where it is reasonable for establishing, managing, or terminating employment, with notice to the employee. Customer-style consent rules still apply where the information falls outside that employment relationship purpose.
Quebec treats employee personal information as personal information, with no broad employer exemption of the kind some other provinces have. Employers must therefore inform staff, limit collection to what is necessary, and apply consent and security rules to HR data. Employment files are privacy-regulated files.
Executive Council records are the documents behind cabinet decisions: the report, recommendation, memorandum, or presentation, plus the schedules and supporting documents submitted with them. Under Nova Scotia's new FOIPOP Act (section 32, in force April 1, 2027), the term is defined broadly and every such record is subject to a mandatory exemption, with no access for 15 years. Privacy teams advising public bodies should treat these as a distinct classification, since the 15-year seal interacts with retention schedules and access playbooks.
A proposed federal statute, introduced in 2026 as Part 2, Division 8 of Bill C-39, that would create Canada's first federal framework for electronic trade documents such as bills of lading, implementing the UNCITRAL Model Law on Electronic Transferable Records. Its section 26 would let federal ministers and officials share import and export information received from a person with other federal officials permitted by law to collect it, including despite confidentiality provisions in statutes listed in the Act's schedule. The bill is at first reading and is not in force.
Encryption scrambles data with a mathematical key so that only someone holding the key can read it. It protects data in transit across networks and data at rest on disks and backups. Canadian regulators treat proper encryption as a basic expectation, and its presence can reduce the harm assessment of a lost device.
Enforcement of commissioner orders is the legal path that turns a privacy commissioner's order into something a court can compel. In British Columbia, the commissioner can file a certified copy of an order with the Supreme Court, where it has the same force as a court judgment. In Ontario, no equivalent filing route exists for access orders, so the backstop is an offence provision for wilful non-compliance. The difference shapes how institutions treat orders: a judgment-backed order is a deadline, while an order with no court route is closer to a strong request.
Once the original purpose for collecting personal information is fulfilled, the organization must either destroy the information or anonymize it according to CAI criteria. There is no legal parking lot for data that might be useful someday. This rule makes purpose limitation operational rather than aspirational.
End-to-end encryption means only the sender and the intended recipient can read a message, because the keys are generated and held on their devices. The service provider moving the data cannot read it, and it cannot decrypt the data in response to a request. It is widely used in messaging apps and is the focus of debates about lawful access powers, since providers that cannot read messages cannot produce their contents to law enforcement.
Equivalent protection is the standard that privacy contracts must meet: a vendor or processor must protect personal information to a level comparable to what the originating organization owes. It is typically implemented through contractual clauses covering purpose limits, safeguards, sub-processors, breach notice, and return or deletion at the end. Without equivalent protection in writing, the transfer itself can be a compliance failure.
The EU AI Act regulates artificial intelligence according to risk: unacceptable uses are banned, high-risk uses face strict duties, limited-risk uses face transparency duties, and minimal-risk uses face almost nothing. It is the first comprehensive AI statute anywhere, and it applies to providers outside the EU whose systems are used inside it. Canadian AI vendors selling into Europe must figure out where their systems land in this ladder.
The EU-US Data Privacy Framework is the 2023 successor to Privacy Shield: a deal under which the EU found the United States protects data adequately, but only for US companies that self-certify into the program. A certified US vendor can therefore receive EU personal data without extra transfer contracts. Canadian companies should still verify a vendor's certification is current before relying on it.
Under the Access to Information Act, exemptions are discretionary or mandatory reasons to withhold records, such as personal information, solicitor-client privilege, or national security. Exclusions remove records from the Act entirely, so they cannot be requested at all, covering items like published material and Cabinet confidences. The distinction matters because excluded records get no independent review.
An existing business relationship means the recipient bought, leased, or contracted for products or services from the sender within the past two years, or made an inquiry or application within the past six months. It is the most common basis for implied consent under CASL. Organizations must track when the window closes, because messages sent on stale implied consent are unlawful.
An existing non-business relationship covers interactions outside commerce: donations to a charity, membership in a club or association, or volunteer work within the past two years. CASL gives these relationships the same implied-consent treatment as business ones. Political parties and candidates rely on this, alongside a separate exemption for their own messaging.
Explainability is the ability of an AI system to give a human-understandable account of why it produced a particular output. It matters for privacy and fairness because people cannot challenge decisions they cannot understand, like a rejected application scored by a model. Complete explainability is often technically hard, so the practical question is whether the explanation is good enough for the decision at stake.
Express consent is explicit permission from a recipient to receive commercial electronic messages, given orally, in writing, or by clicking a box. Under CASL the request must name the sender, describe the purpose, and state that consent can be withdrawn, and pre-checked boxes do not count. It has no expiry date: it lasts until the person opts out.
PIPEDA sets out factors for judging whether a breach creates a real risk of significant harm: the sensitivity of the information, the probability it has been or will be misused, and any other relevant circumstances. Highly sensitive data points toward risk, as does evidence the information is in the wrong hands. Organizations must weigh these factors and document the call, since regulators will second-guess it.
CASL exempts commercial electronic messages sent between people with a family or personal relationship. A personal relationship means prior in-person or voice contact within the past two years plus two-way communication beyond a business interaction. It is meant for genuine personal ties, not for sales reps who once called a prospect.
Federal Court damages are the remedy available under PIPEDA when a person applies to the Federal Court after the Commissioner issues a report of findings. The court can order the organization to correct its practices and award damages to the individual, including for humiliation. It is one of the few ways PIPEDA puts money behind a privacy right.
After the Commissioner issues a report of findings, either the complainant or the Commissioner can apply to the Federal Court for a hearing on the matter. The court hears the case fresh and can order the organization to correct its practices and award damages to the individual. It is the enforcement backstop that gives OPC investigations their ultimate leverage.
When a federal institution refuses a Privacy Act access request, the requester can apply to the Federal Court for review within the statutory time limit. The Court can order disclosure, and the Privacy Commissioner's findings, while not binding, carry weight. It is the one enforcement path with real teeth under the Privacy Act.
Federal works, undertakings and businesses are the federally regulated organizations, like banks, telecoms, airlines, and interprovincial transport companies, where PIPEDA always applies regardless of province. Employees of FWUBs are also covered by PIPEDA for their employee personal information. In Alberta, British Columbia, and Québec, other private-sector organizations fall under their own provincial laws instead.
FIPPA is Ontario's Freedom of Information and Protection of Privacy Act, covering provincial ministries, agencies, and broader public-sector bodies. It gives individuals access to records held by these bodies and sets rules for how they collect and use personal information. Ontario's Information and Privacy Commissioner oversees it.
The Fair Information Practice Principles are the US-origin set of eight principles for handling personal data: collection limitation, data quality, purpose specification, use limitation, security, openness, individual participation, and accountability. First published by a US advisory committee in 1973, they became the conceptual ancestor of privacy laws worldwide, including Canada's.
FOIPOP is Nova Scotia's Freedom of Information and Protection of Privacy Act, covering provincial public bodies. It gives the public a right to request records held by these bodies and sets rules for how they handle personal information. A rewritten FOIPOP Act takes effect on April 1, 2027, and drew public objections from the province's Information and Privacy Commissioner over its mandatory 15-year exemption for Executive Council records.
Facial recognition is software that identifies or verifies a person by measuring their face, turning facial geometry into a template and comparing it against stored templates. Because faces cannot be changed if the data is compromised, Canadian regulators treat facial biometrics as sensitive: Quebec's Law 25 requires express consent before using biometrics to verify identity, and biometric databases must be declared to the CAI. The CAI has ordered companies to stop using facial recognition for employee access and blocked a grocery chain's planned shopper-identification pilot. Before deploying the technology, an organization needs a lawful basis, a proportionality assessment, and a plan for destroying the templates.
The form of consent under PIPEDA ranges from express to implied, depending on how sensitive the information is and how the person would reasonably expect it to be used. Sensitive information, like health or financial details, generally calls for clear express consent. Implied consent may be acceptable for low-sensitivity information used in an obvious way the person would anticipate.
A foundation model is a large general-purpose AI model, like the big language models, trained on broad data and adapted later for specific tasks. One model can power thousands of applications, which concentrates risk: a flaw or bias in the base model flows into everything built on it. Regulators in the EU and Canada have singled these models out for extra scrutiny.
FPT stands for federal-provincial-territorial: joint action by Canada's federal, provincial, and territorial governments. In privacy, it usually means the information and privacy commissioners meeting or acting together, as they did in Ottawa in September 2026 on AI governance. When the FPT commissioners align, organizations operating across provinces get one clear signal instead of thirteen.
Information a company collects directly from its own customers through its own products, websites, or apps, rather than buying it from data brokers or other third parties. Because it comes from a direct relationship, companies sometimes treat it as freely usable, but privacy law still limits what it can be used for: PIPEDA requires appropriate purposes and Law 25 requires clear consent for each purpose. Rules that target only third-party data sales miss the harms possible with first-party data alone, as the DraftKings behavioral-targeting reporting showed.
The fraud prevention exception lets organizations collect, use, or disclose personal information without consent to detect, suppress, or prevent fraud. It covers sharing intelligence about suspected fraudsters, including with designated investigative bodies and other organizations. This is why banks can exchange fraud signals without asking the fraudster's permission first.
An organization may use personal information without consent when doing so is necessary to prevent or detect fraud, or to identify its perpetrators. This is limited to what is genuinely needed for the fraud-fighting purpose. It does not license general surveillance, and the organization must still be able to explain its reasoning.
A frontier model is a large AI model at or near the cutting edge of capability, meaning the biggest general-purpose models from the leading labs. Regulators single them out because their scale creates novel safety risks that smaller models do not. California's SB 53 requires their developers to publish safety frameworks and report critical safety incidents to the state.
Function creep is when data collected for one purpose gradually gets used for others it was never meant for: a contact-tracing app repurposed for policing, or employee wellness data used in performance reviews. Privacy law fights it with purpose limitation, the rule that personal information may only be used for the purposes it was collected for. Each new use needs its own justification.
This federal law bans anyone providing goods or services, or entering into or continuing a contract, from requiring a genetic test or asking for its results. It targets discrimination based on genetic characteristics, most famously in insurance and employment. Violations carry criminal penalties, which is rare in Canadian privacy-adjacent law.
Geo-fenced key management is the practice of wrapping decryption keys so they can only be unwrapped on servers inside a chosen geography. The wrapped key may travel globally, but the root key that unwraps it never leaves its region, and a request that lands anywhere else fails closed: it is rejected, not rerouted. Cloudflare's PQ GeoKey Manager is the current reference example, combining geo-fencing with hybrid post-quantum wrapping. For Canadian teams, the audit question is what the vendor's region contains and what happens mechanically when a request lands outside it.
Related insight: Harvest now, decrypt later
Get Cyber Safe is the Government of Canada's national public awareness campaign on cyber security, led by the Communications Security Establishment. It runs Cyber Security Awareness Month each October and publishes year-round guidance on phishing, passwords, multi-factor authentication, and reporting scams. For privacy practitioners, it is a credible source of free, plain-language material for internal awareness programs.
Getting Accountability Right is an OPC, Alberta, and BC guidance document that explains what regulators expect from a privacy management program. It lays out the building blocks: organizational commitment, program controls, and ongoing assessment. Organizations use it as a checklist when standing up or auditing their privacy functions.
The Global CBPR system is a certification scheme run by APEC economies (and now some non-APEC ones) that lets companies demonstrate their privacy practices meet common cross-border standards. Certified companies can move personal data between participating economies with less friction. Canada is a participant, so it shows up in transfer discussions with Asia-Pacific partners.
Global Privacy Control is a browser-level signal that tells websites the user wants to opt out of the sale or sharing of their personal information. Some US state laws require websites to honor it as a valid opt-out. It is the modern successor to the old Do Not Track idea, this time with legal teeth behind it.
Law 25 requires enterprises to establish and implement governance policies for personal information: roles and responsibilities, a retention schedule, a process for handling complaints, and security measures. The privacy officer oversees this framework, and the policies must be published. It is the documentary spine of Law 25 compliance.
A government plaintiff is a public body, such as a province, state, or municipality, that sues a private organization, rather than individuals bringing the claim themselves. Governments can seek recovery of public money spent on emergency response, rebuilding, and victim services, and those invoices give them a damages theory that is simpler to prove than individual harm. In September 2026, British Columbia became the first government plaintiff to sue OpenAI, seeking the costs of responding to and recovering from the Tumbler Ridge school shooting. For organizations deploying AI in schools, hospitals, or other high-vulnerability settings, this model widens the pool of potential claimants beyond users and families.
Harvest now, decrypt later is the attack where an adversary records encrypted traffic today and decrypts it once a cryptographically relevant quantum computer exists, breaking the classical public-key exchange that protected it. The migration clock therefore starts when data is first recorded, not when the quantum computer arrives. The defence is hybrid post-quantum key encapsulation, such as ML-KEM combined with X25519, which stays safe as long as at least one component holds. Data that must stay secret for decades, health records or defence files, is the highest priority for migration.
Related insight: Geo-fenced key management
Harvest now, forge later is the signature-side twin of the better-known harvest-now-decrypt-later threat. An attacker records classically signed artifacts today, such as firmware or build attestations, and forges those signatures once a cryptographically relevant quantum computer exists, producing counterfeit artifacts that long-lived verifiers accept as authentic. It is why NSA's CNSA 2.0 puts software and firmware signing on the earliest exclusive-use deadline: the artifacts you sign today must stay trustworthy for their whole operational lifetime.
Ontario's health privacy law requires custodians to notify affected individuals of a privacy breach at the first reasonable opportunity. Serious breaches, including theft, loss, or unauthorized use or disclosure, must also be reported to the Information and Privacy Commissioner. The Commissioner can impose administrative penalties on custodians and their agents for violations.
A health information custodian is the person or organization with custody or control of personal health information under Ontario's PHIPA: hospitals, physicians, pharmacies, long-term care homes, and similar providers. Custodians are legally responsible for the information even when agents handle it. They must have information practices, a contact person, and safeguards in place.
The health number is the unique identifier on an Ontario health card, used to identify patients across the health system. PHIPA restricts its collection and use: only custodians and authorized persons may collect it, and only for health purposes. Using health numbers for unrelated purposes, like loyalty programs, is prohibited.
A health research ethics board reviews research proposals that use personal health information to ensure they meet ethical and legal standards. Under PHIPA, its approval is required before a custodian may disclose information to a researcher without consent. The board must weigh the public interest in the research against privacy risks and impose conditions on safeguards.
Alberta's Health Information Act governs health information held by custodians such as Alberta Health Services, physicians, and pharmacies. It balances patient privacy with the needs of a functioning health system, allowing defined flows of information for care while restricting the rest. Alberta's OIPC oversees it.
A high-impact AI system is the category of AI that Canada's proposed AIDA would regulate most strictly, covering systems whose use could cause significant harm like biased hiring or unsafe medical advice. Which systems qualify would be defined in regulations that do not yet exist. The label matters because it would trigger assessment, monitoring, and notification duties.
Saskatchewan's Health Information Protection Act governs personal health information held by trustees such as health districts, physicians, and pharmacies. Individuals can access their records and request corrections, and trustees must limit collection and safeguard what they hold. The province's Information and Privacy Commissioner oversees it.
HIPAA is the US federal law governing the privacy and security of health information held by providers, plans, and their vendors. It sets strict rules on how patient data can be used and shared, and it requires security safeguards plus breach notification. Canadian health organizations deal with its equivalent concepts under provincial health privacy laws like Ontario's PHIPA.
HPKE is a standard way to encrypt a message so that only the holder of a specific private key can read it, combining public-key and symmetric encryption for speed. In Oblivious HTTP, the client uses the gateway's HPKE public key to seal the request, which is why the relay carrying it cannot read the contents. If the private key is compromised, past sealed messages can be opened, so key rotation matters.
Human in the loop means a person reviews and approves an AI system's output before it takes effect, rather than the system acting alone. It is the main safeguard organizations point to when an automated process affects people's rights. The protection is only real if the human can genuinely disagree with the machine, not just rubber-stamp it.
Article 17 of the International Covenant on Civil and Political Rights turns the UDHR's privacy principle into binding treaty law: everyone has the right to protection against unlawful or arbitrary interference with privacy. Canada ratified the treaty, so this article is part of the international obligations Canadian courts may consider. It is cited in debates on government surveillance and data retention.
Information is “personal” when it relates to an identifiable individual, someone who can be picked out directly (name, ID number) or indirectly (a combination of data points). Courts and regulators increasingly accept indirect identifiability. If there's a reasonable possibility of re-identification, treat it as personal information.
Identity and access management, usually shortened to IAM, is the discipline of making sure the right people have the right access to the right systems, and nothing more. It covers how accounts are created and removed, how privileges are granted and reviewed, and how authentication is enforced. Breaches increasingly start with a compromised identity rather than a software flaw, which is why regulators now probe IAM controls in post-breach investigations. Least-privilege access and phishing-resistant authentication on administrative accounts are the core controls.
Identity documents are government-issued records that prove who you are: a driver's licence, passport, or health card, including their photos, numbers, and signatures. Scans of these documents are high-value breach targets because the numbers are stable for years and hard to replace. Under PIPEDA's safeguards principle and Law 25, storing identity document images after verification is finished is difficult to justify, so retention should be minimal and the reasons documented.
Identity verification is the process of confirming a person is who they claim to be, often by checking a government-issued ID at a door, a desk, or during online onboarding. It can be a simple yes-or-no decision that leaves no copy behind, or it can involve storing ID images in a vendor database, which is a separate privacy choice with its own risks. Because verification vendors hold sensitive documents on your behalf, PIPEDA treats you as responsible for how they safeguard them, so vetting and contract terms matter before the first scan.
Identifying purposes is the second PIPEDA principle: tell people why you collect their information at or before the time you collect it. People can only consent meaningfully if they know the purpose first. New uses that were not identified up front need fresh notice and consent.
Implied consent lets an organization send commercial electronic messages without explicit permission in narrow situations set out by CASL: an existing business or non-business relationship, or a conspicuously published address without an opt-out notice. It is time-limited, generally two years for business relationships and six months for inquiries, and it lapses if the relationship ends. It never applies where the law requires express consent.
When a confidentiality incident creates a serious risk of harm, the organization must notify the CAI and the affected individuals promptly. The notification must describe the incident, the information involved, what the organization is doing about it, and a contact point for questions. It is a communication duty, not an admission of fault, and regulators expect it to be written for real people rather than lawyers.
AI incident reporting is the practice, increasingly a legal duty, of notifying regulators when an AI system causes or nearly causes serious harm. California's SB 53 requires frontier-model developers to report critical incidents to the state, making it the first major jurisdiction with mandatory AI incident reporting. Privacy teams should treat it like breach notification: know your thresholds, have a playbook, and document like a stranger will audit you.
An incident response plan is a written playbook for what to do when a security breach hits: who is called, what gets contained first, how evidence is preserved, and when regulators and individuals must be notified. Canadian privacy law sets tight breach-notification timelines, so the plan has to include them. An untested plan fails, which is why organizations rehearse it.
Individual access is the ninth PIPEDA principle: on request, an organization must tell a person whether it holds their information and let them see it. The person can also challenge the accuracy and completeness of the information and ask for corrections. Organizations generally have 30 days to respond, in an understandable form and at minimal or no cost.
Individual rights are the powers privacy law gives people over their own information: access, rectification, erasure, de-indexation, portability, and withdrawing consent. Law 25 expanded the Québec toolkit well beyond PIPEDA's baseline. A good privacy program treats these as service requests with deadlines, not legal threats.
Info Source is the federal government's annual directory of information holdings, including personal information banks, for every federal institution. It exists so the public can exercise access rights under the Privacy Act and the Access to Information Act without guessing where records live. Institutions must keep their entries current.
The Information and Privacy Commissioner of Ontario is the province's independent oversight body for access and privacy. It investigates complaints, issues binding orders, and promotes best practices for public bodies and health custodians. Ontario privacy practitioners read its orders the way lawyers read case law.
A joint investigation is when two or more privacy regulators pool their powers to investigate the same organization or practice at once. Canada's federal and provincial commissioners have run joint investigations into companies operating across jurisdictions. For organizations, it means one coordinated probe with combined enforcement weight rather than separate fights in each province.
Personal information collected, used, or communicated for journalistic purposes is carved out of key Law 25 obligations. The exemption protects newsgathering and publication, provided the material was lawfully obtained in the course of journalistic activity. It is about the activity, not the label, so calling a blog a newspaper does not automatically qualify.
PIPEDA does not apply to the collection, use, or disclosure of personal information for journalistic, artistic, or literary purposes, a carve-out that protects freedom of expression. News organizations rely on it when reporting stories that involve identifiable people. The exclusion is narrow: it covers the journalistic work itself, not a publisher's marketing or HR databases.
Law 25 is Québec's modernized private-sector privacy law (formally Bill 64, amending the Act respecting the protection of personal information in the private sector). It took full effect in phases from 2022 to 2024, adding mandatory PIAs, a default privacy officer, express consent rules for sensitive data, data portability, de-indexation rights, incident reporting, and fines up to $10 million or 2% of worldwide turnover.
The CAI publishes guides explaining how to apply Law 25, on topics like privacy impact assessments, consent, and incident notification. These are not statutes, but they are the regulator's stated expectations, and organizations ignore them at their own risk. When a compliance question is ambiguous, the guides are the first place practitioners look.
Lawful access is the set of powers that let law enforcement and intelligence agencies obtain data from service providers under court authorization or other legal authority. In Canada, existing powers cover production orders, wiretaps, and subscriber-data requests; proposed bills such as the Lawful Access Act (Bill C-22) would add new capability and data-retention obligations for designated providers. Privacy teams track these powers because they affect vendor risk, data retention design, and incident readiness.
LCCJTI is short for the Act to establish a legal framework for information technology. It gives electronic documents and signatures legal standing in Quebec and sets rules on the integrity, transferability, and retention of digital records. Privacy practitioners meet it where digitization meets evidence: how a record was created and kept affects whether it proves anything.
Least privilege means giving each user and system only the access it needs to do its job, and nothing more. It limits the damage from a compromised account or a curious insider because most of the organization's data stays out of reach. It is one of the cheapest and most effective security principles in practice.
PIPEDA allows personal information to be collected or disclosed without consent when it is needed for legal proceedings, such as litigation, a regulatory hearing, or enforcing a legal right. Lawyers and organizations rely on it to gather and share evidence that a court or tribunal requires. The exception does not cover fishing expeditions; the information must genuinely relate to the proceedings.
Brazil's LGPD is the country's general data protection law, modeled closely on the EU GDPR with similar principles, individual rights, and a national regulator. It applies to organizations outside Brazil that handle Brazilians' personal data when offering them goods or services. Canadian businesses expanding into Latin America usually meet the LGPD first.
Limiting collection is the fourth PIPEDA principle: collect only what is necessary for the identified purposes, and collect it fairly and lawfully. It is the statutory cousin of data minimization, pushing organizations to resist the urge to gather data just in case. Over-collection is one of the most common findings in regulator investigations.
Limiting use, disclosure and retention is the fifth PIPEDA principle, holding that personal information should be used and shared only for the purposes the person consented to. Once those purposes are fulfilled, the information must be destroyed or de-identified. It is the principle that turns a one-time collection into an ongoing obligation with an end date.
A lockbox is a patient's express instruction under PHIPA to withhold or withdraw consent for the sharing of their personal health information for health care purposes. Custodians must respect it, subject to narrow overrides for emergencies or legal requirements. In practice it is implemented through flags in electronic health records that block specified providers from seeing the data.
A material privacy breach is a breach involving federal personal information that creates a real risk of significant harm, such as identity theft or reputational damage. Treasury Board rules require institutions to report material breaches to the Privacy Commissioner and the Treasury Board Secretariat and to notify affected individuals. The materiality assessment must be documented even when the conclusion is no.
Meaningful consent is the Privacy Commissioner's standard that consent must be an informed choice, not a buried checkbox. Organizations have to explain what they collect, why, and who it goes to, in plain language, before asking. Consent that is uninformed or obtained through dark patterns can be treated as no consent at all.
MFIPPA is Ontario's Municipal Freedom of Information and Protection of Privacy Act, covering municipalities, school boards, and local boards. It mirrors FIPPA's two halves, access to records and protection of personal information, at the local level. Requests to a city hall go through this statute.
ML-DSA is the Module-Lattice-Based Digital Signature Algorithm, standardized as NIST FIPS 204, designed to resist attacks from both classical and quantum computers. It comes in three parameter sets, ML-DSA-44, ML-DSA-65, and ML-DSA-87, targeting NIST security categories 2, 3, and 5, which trade signature size, key size, and speed against security margin. All three share one signing algorithm, ML_DSA_SHAKE_256, which is why AWS's kms:SigningAlgorithm condition key cannot tell the variants apart while kms:KeySpec can.
Multi-factor authentication requires two or more proofs of identity at login: something you know, like a password, plus something you have or are, like a phone code or fingerprint. It blocks the vast majority of account-takeover attacks because stolen passwords alone are not enough. Regulators and insurers increasingly treat MFA as baseline security for sensitive systems.
Necessity asks whether collecting this information is truly needed for the stated purpose, not merely useful or convenient. Law 25 requires collection be limited to what is necessary, and regulators apply a proportionality lens: the more intrusive the collection, the stronger the justification required. If you can't explain why you need it, you shouldn't collect it.
NSIRA is the independent review body that examines the national security and intelligence activities of the federal government, including CSIS, the CSE, the RCMP, and the Department of National Defence, to assess whether they are lawful, reasonable, and necessary. It reports to Parliament and can also investigate public complaints. Its 2026 review of DND and Canadian Armed Forces open-source intelligence found the collection lawful but flagged gaps in documentation, risk assessment, vendor evaluation, and records.
The NIST AI Risk Management Framework is a voluntary guide from the US National Institute of Standards and Technology for managing AI risks, organized around govern, map, measure, and manage. It does not impose legal duties, but many organizations use it as a practical checklist for responsible AI. Canadian privacy teams often borrow it when building their AI governance programs.
The CAI is the Commission d'accès à l'information, Quebec's privacy and access regulator. Under Law 25, any confidentiality incident posing a serious risk of harm must be reported to it promptly, in addition to notifying affected individuals. The CAI keeps a register of incidents and can investigate what went wrong and order fixes.
The OECD Privacy Guidelines are a set of internationally agreed principles for protecting personal data, first adopted in 1980 and revised in 2013. They introduced ideas like purpose specification and openness that later appeared in PIPEDA, the GDPR, and many other laws. PIPEDA itself was drafted with these guidelines in mind.
Oblivious HTTP is an IETF standard (RFC 9458, January 2024) that splits every web request between two independently operated parties. A relay sees the client's network identity (IP address) but cannot read the encrypted request; a gateway decrypts and reads the request but never learns the client's identity. The privacy guarantee depends on the two operators not sharing data with each other. Cloudflare offers both a managed relay and, in closed beta as of 2026, a managed gateway.
The Office of the Information and Privacy Commissioner of Alberta oversees the province's public-sector, private-sector, and health privacy laws. It investigates complaints, conducts inquiries, and issues binding orders. Alberta is unusual in having a single commissioner cover all three regimes.
The Office of the Information and Privacy Commissioner for British Columbia oversees the province's access and privacy laws, including FIPPA, PIPA, and the health-sector statutes. It issues guidance, investigates complaints, and can order public bodies and organizations to comply. Its technology guidance is widely read across Canada.
The ombudsman model describes how the federal Privacy Commissioner has historically worked: investigating complaints, mediating resolutions, and issuing non-binding findings rather than orders. It favors persuasion and negotiated fixes over penalties. Critics say it lacks teeth, which is why proposed federal reforms aim to add order-making and fining powers.
An onward transfer is any further sharing of personal information after it first leaves your hands, from a vendor to its sub-processor or on to a partner. Each hop must stay within the original purposes and protections, which is why contracts should require consent or at least notice before data moves again. Losing track of onward transfers is how data ends up in places no one approved.
The Office of the Privacy Commissioner of Canada is the federal privacy watchdog, overseeing PIPEDA for the private sector and the Privacy Act for federal institutions. It operates largely as an ombudsman: it investigates complaints, issues findings, and seeks cooperation, though proposed reforms would add order-making powers and penalties. Its guidance shapes privacy practice nationwide.
The Privacy Commissioner can audit an organization's privacy practices, either after receiving complaints that suggest systemic issues or on the Commissioner's own initiative. Audits can compel the production of records and examine how personal information is handled. Public audit reports are a strong motivator, since no organization wants its gaps published by the regulator.
OPC findings are the published outcomes of the Commissioner's investigations into privacy complaints. They name the issue, assess whether the law was violated, and recommend fixes. While not court orders, findings carry reputational weight and often foreshadow where enforcement is heading.
Interpretation bulletins are the Privacy Commissioner's published explanations of how the office reads specific PIPEDA provisions, from what counts as meaningful consent to how long breach records must be kept. They are not statutes, but organizations ignore them at their peril because they signal how investigations will be decided. Privacy programs use them as the practical layer between the law and daily operations.
An OPC report of findings is the written outcome of a Privacy Commissioner investigation, setting out the facts, the analysis, and whether the organization complied with PIPEDA. Most reports end in non-binding recommendations rather than orders. A complainant who is unsatisfied can take the report to the Federal Court, which is where findings can turn into enforceable remedies.
Open-source intelligence is intelligence drawn from publicly available sources: social media posts, public records, news, websites, and commercial data. Public does not mean free of privacy rules: collecting and analyzing public information about identifiable people can still engage privacy law, and regulators expect the collection to be necessary, documented, and overseen. NSIRA's 2026 review of military OSINT is the clearest Canadian example of that test in action.
Openness is the duty to make your privacy practices visible and understandable: what you collect, why, who you share it with, and how people can exercise their rights. PIPEDA names it as a principle; Law 25 requires published governance policies and clear notices. Transparency isn't a banner, it's whether a normal person can actually understand what happens to their data.
Opt-out consent assumes the person agrees unless they take action to refuse, such as unchecking a box or calling to decline. PIPEDA permits it only in narrow circumstances: the information is not sensitive, the use is reasonable and expected, and the opt-out is clear and easy. Regulators have rejected opt-out approaches where any of those conditions failed.
Order-making powers let some provincial privacy commissioners, such as those in Alberta, BC, and Québec, issue legally binding orders telling an organization what it must do or stop doing. This contrasts with the federal ombudsman model of non-binding recommendations. Organizations in those provinces face enforceable commands rather than advice alone.
Law 25 creates penal offences for conduct like collecting, using, or disclosing personal information in breach of the law, and for knowingly obstructing the CAI. Penalties escalate for repeat offenders and are higher for legal persons than for individuals. Directors and officers can also be personally liable when they direct or authorize the offence.
Under Quebec privacy law, this is the entity that collects and holds personal information in a business context. The phrase covers companies, partnerships, and solo operators, not just corporations. Law 25 places duties like consent, transparency, and security on this person, and their liability cannot be quietly shifted to a vendor.
Personal health information is identifying information about a person's health or health care: diagnoses, treatment records, health numbers, and even the fact that someone received care. Ontario's PHIPA and similar provincial laws give it stronger protection than general personal information. Custodians can only collect, use, or disclose it with consent or specific legal authority.
Personal information is any information about an identifiable individual, from a name and email to an IP address or purchase history, depending on context. Québec law phrases it as information that relates to a natural person and allows that person to be identified. It does not cover business contact details used for business purposes.
Personal information banks are Treasury Board's standardized descriptions of the personal information holdings of each federal institution, published so people can find records about themselves. They describe what is collected, why, and how long it is kept. When you file a Privacy Act access request, the relevant bank tells you where to look.
This Nova Scotia statute limits the storage of and access to personal information by public bodies outside Canada. It requires public bodies to ensure their data stays under Canadian protection unless strict conditions are met. It is one of the strongest data-residency rules for a provincial public sector in the country.
Law 25's obligations came into force in three stages, phased in over 2022 to 2024, giving organizations time to adjust. Early measures included appointing a privacy officer and reporting serious incidents; later stages added rules on automated decisions, the right to portability, and express consent for sensitive information. Knowing which phase a rule belongs to explains why some obligations still feel new.
Manitoba's Personal Health Information Act governs personal health information held by trustees like regional health authorities, hospitals, and health professionals. It sets rules for collection, use, and disclosure, and gives individuals access and correction rights. Manitoba's ombudsman and the Information and Privacy Adjudicator handle oversight.
Newfoundland and Labrador's Personal Health Information Act covers personal health information held by custodians across the health system. It sets rules for collection, use, and disclosure, with access and correction rights for individuals. Oversight rests with the province's Information and Privacy Commissioner.
Nova Scotia's Personal Health Information Act governs personal health information held by custodians across the health system. It gives individuals access and correction rights and restricts disclosure outside the circle of care. Oversight sits with the Office of the Information and Privacy Commissioner for Nova Scotia.
PHIPA is Ontario's Personal Health Information Protection Act, governing personal health information held by health information custodians like hospitals, physicians, and labs. Patients have rights of access and correction, and custodians must keep audit logs of who viewed a record. Breaches posing risk require notification to the patient and, in serious cases, to the IPC.
PHIPAA is New Brunswick's Personal Health Information Privacy and Access Act, covering personal health information in the hands of custodians. Patients can access their records and request corrections, and custodians must safeguard the information. New Brunswick's Integrity Commissioner handles complaints.
Phishing is a scam in which an attacker impersonates a trusted sender, usually by email or text, to trick someone into handing over credentials or clicking a malicious link. It remains the most common way breaches begin, because one rushed click can bypass technical defenses. Training people to verify before acting is the main defense.
Phishing-resistant MFA is multi-factor authentication designed so a stolen password and a relayed MFA prompt cannot complete the sign-in on their own. FIDO2 security keys, device-bound passkeys, and platform authenticators tie the authentication to the real login domain, so a lookalike page cannot relay it. The Canadian Centre for Cyber Security's alert AL26-028 recommends it, particularly for privileged and high-risk users, because conventional MFA falls to adversary-in-the-middle relay.
A privacy impact assessment (évaluation d'impact sur la vie privée) is a structured review of a new project or system to spot privacy risks before launch. Under Law 25, enterprises must conduct one before acquiring, developing, or overhauling an information system or electronic service involving personal information, and before communicating personal information outside Québec. The assessment must be proportionate to the sensitivity of the data and the risks involved.
A privacy impact assessment is a structured review an organization does before a project that affects personal information. Under Law 25 it is mandatory for any technological product or service offered to the public that collects, uses, or communicates personal information. It is also required before communicating information outside Quebec, which makes PIAs a recurring discipline rather than a one-time form.
PIPEDA (the Personal Information Protection and Electronic Documents Act) is Canada's federal private-sector privacy law, built on ten fair information principles. It applies wherever provinces lack “substantially similar” legislation, Québec, B.C., and Alberta have their own. It requires meaningful consent, limits collection and retention, and gives individuals access rights; proposed reforms would modernize it.
China's PIPL is the country's comprehensive privacy law, in force since 2021. It echoes the GDPR on consent, purpose limits, and individual rights, but it pairs those duties with strict rules on moving data out of China. Multinationals operating in China often face the hardest compliance puzzle of any market there.
A prescribed entity is an organization designated by regulation under PHIPA to collect and use personal health information for health system planning, evaluation, or resource allocation without individual consent. Ontario Health and ICES are examples. Prescribed entities face strict review requirements and must have their information practices approved by the Information and Privacy Commissioner.
A prescribed person is designated by regulation under PHIPA to compile and maintain specific health registries, such as cancer or cardiac registries, using personal health information without individual consent. The designation comes with conditions on collection, use, disclosure, and security. It is a narrower role than a prescribed entity, tied to a specific registry purpose.
The Privacy Act governs how federal government institutions collect, use, and disclose personal information about individuals. It gives people the right to access their own records held by institutions and to request corrections. Complaints go to the Privacy Commissioner of Canada, and unresolved refusals can be taken to Federal Court.
A Privacy Act complaint is filed with the Office of the Privacy Commissioner when a federal institution mishandles personal information or mishandles an access request. The OPC investigates and issues findings and recommendations, which are not binding orders. If the institution refuses access, the complainant can escalate to the Federal Court.
Privacy by default means the most privacy-protective settings apply automatically, without the user having to change anything. It is a companion to privacy by design: the system should not require people to opt out of data collection they never asked for. Both PIPEDA guidance and Law 25 expect organizations to think this way.
Privacy by design means building privacy into products and processes from the start rather than bolting it on later. The concept, seven foundational principles from Ontario's former commissioner Ann Cavoukian, calls for proactive, default-private, embedded safeguards. Law 25's mandatory PIAs before new systems are, in effect, privacy-by-design requirements with teeth.
A privacy management program is the OPC's framework for building accountability into an organization, with named leadership, policies, training, and monitoring scaled to the organization's size and risk. The Commissioner has said a documented program is the expected evidence of compliance, not an optional extra. It is the backbone that due-diligence questionnaires and investigations both ask to see.
A privacy notice is the point-of-collection explanation: what you're collecting right now, why, and what choices the person has. A privacy policy is the organization's overall governance document covering all its practices. Law 25 goes further, requiring published governance rules (roles, retention, complaint handling, security). Notices face the user; policies face the auditor.
The privacy officer is the person accountable for an organization's privacy program. Under Law 25, the default is the person with the highest authority in the enterprise, who may delegate the role in writing; the title and contact details must be published. This person oversees the governance framework, handles access requests, and approves PIAs.
The privacy paradox is the gap between what people say about privacy and what they do: surveys show deep concern, yet people routinely trade data for small conveniences. It does not mean people do not care; it usually means the choices are designed badly or the costs are hidden. Regulators use it to justify stronger defaults rather than relying on informed consent alone.
Privacy risk reviews are the federal government's scaled assessments for initiatives that touch personal information, ranging from checklists to full privacy impact assessments. TBS requires them before launching new programs, systems, or data-sharing arrangements. The review must identify risks and mitigations and be updated when the initiative changes materially.
A private right of action lets individuals sue directly for privacy violations instead of relying on a regulator. Law 25 gives Québecers this right, including minimum damages (commonly cited as $1,000 per person) and the possibility of class actions. It turns privacy rights into courtroom leverage.
Proactive disclosure is the federal practice of publishing certain government records automatically, without waiting for access requests: travel and hospitality expenses, contracts, grants, and briefing note titles. It is required by the Access to Information Act for institutions and ministers' offices. The goal is transparency by default rather than transparency on demand.
A processor is a third party that handles personal information on an organization's behalf, a cloud host, payroll provider, or analytics vendor. Québec's Law 25 calls this party an agent or mandatary acting under a written agreement with required safeguards. The key rule everywhere: the organization stays accountable, and the vendor may only use the data for the contracted purpose.
Productivity monitoring is software that measures how employees work: active hours, application usage, task completion rates, and idle time. Privacy regulators view it as high-risk surveillance that needs a demonstrable business purpose, clear notice, and the least intrusive means available. Continuous screenshots or keystroke logging for all staff, without justification, is the pattern that draws enforcement.
In Quebec, professional secrecy is the duty of members of regulated professions to keep client confidences. It is broader than common-law solicitor-client privilege because it covers many professions, from accountants to physicians. When it conflicts with disclosure demands, overriding it normally requires a legal basis.
Profiling is using personal information to evaluate characteristics or behavior, credit scoring, ad targeting, employee risk flags. Law 25 requires organizations to inform people when technology identifies, locates, or profiles them and to provide a way to deactivate profiling functions. Profiling that feeds automated decisions gets extra transparency duties.
Pseudonymization replaces identifiers with codes or tokens so data can't be linked to a person without a separate key. It reduces risk and is good security hygiene, but the data can still count as personal information because re-identification is possible. Don't confuse it with anonymization, which is meant to be irreversible.
The CAI publishes its decisions and orders, building a public record of how the law is interpreted. For practitioners, these rulings are the most useful guidance available: they show what the regulator actually penalizes and orders. Watching them is how organizations learn the practical boundaries of Law 25.
Publicly available information is personal information the law excludes from consent requirements because it is public by law, land registry entries, court records, professional directories. Québec's Law 25 keeps a narrow statutory list, and “publicly available” does not mean “anything you can find online.” Scraping the web is not a consent strategy.
Every organization subject to Law 25 must designate a person responsible for protecting personal information and publish their title and contact information, typically on the website. By default that person is the head of the enterprise, unless the role is formally delegated. Regulators treat a missing contact line as an early sign the privacy program is thin.
Purpose limitation means using personal information only for the purposes you identified when collecting it, unless you get fresh consent or the law allows otherwise. Law 25 requires purposes to be established before collection; PIPEDA mirrors this in its principles. New purpose, new consent.
Health and social services records in Quebec are governed by the Act respecting health services and social services (LSSSS), which gives them a dedicated confidentiality regime. It sets who may access clinical records, for what purposes, and how consent works in care settings. General privacy rules apply too, but the LSSSS provisions take the lead for patient files.
Quebec requires express, informed consent for most collection, use, and communication of personal information. That is the opt-in model: the organization asks first and proceeds only after a clear yes. Pre-ticked boxes, silence, or buried terms do not count as consent.
Ransomware is malicious software that encrypts an organization's files and demands payment for the decryption key. Attacks often start with a phishing email or an unpatched vulnerability, and modern gangs also steal the data first so they can threaten to publish it. Under Canadian privacy law, a ransomware incident that exposes personal information generally triggers breach notification duties.
A ransomware leak site is a public web page where a ransomware group names its victims and posts samples or full copies of stolen data to force payment. Trackers such as ransomware.live index these listings to support research and public awareness without handling the stolen content itself. A listing is a claim by the attacker, not independent confirmation that data was actually stolen.
Related insight: On a Leak Site at Last: What Nipigon's Ransomware Listing Means for Small Hospitals
Retrieval-Augmented Generation pairs a language model with a search step: the system retrieves relevant passages from a trusted corpus and feeds them to the model, which answers strictly from that context. Grounding answers this way reduces hallucinations, but the pipeline still needs evaluation, since retrieval misses and unfaithful answers happen. Frameworks like Ragas score RAG pipelines on faithfulness, context precision, and answer relevancy.
Related insight: Test Your RAG Pipeline Like a Regulator Is Watching
Real risk of significant harm is the legal threshold that triggers mandatory breach notification under PIPEDA. It means the breach could plausibly cause harm like identity theft, financial loss, or damage to reputation, and a merely theoretical possibility is not enough. If an organization reasonably concludes the threshold is met, it must notify the Privacy Commissioner and the affected individuals as soon as feasible.
The reasonable person test asks whether a reasonable person would consider a collection, use, or disclosure appropriate in the circumstances. PIPEDA's section 5(3) makes it an explicit limit: even with consent, inappropriate purposes are unlawful. It is the law's common-sense backstop.
A recommender system is software that decides what content, products, or people you see next: social media feeds, video autoplay, job and dating matches, shopping suggestions. It learns from your past behavior to predict what will keep you engaged, which is why regulators increasingly treat the ranking itself as the product's main risk rather than the individual posts. In Canada, Bill C-34 would place duties on the design of recommender systems used by social media platforms and AI chatbots; the bill is before Parliament.
Red-teaming an AI system means deliberately attacking it to find failures: jailbreaking its safety filters, extracting training data, or tricking it into harmful outputs. Borrowed from cybersecurity, the practice is now a standard part of responsible AI deployment. Organizations document the findings and fix them before, or shortly after, launch.
Reference checks are employer inquiries to a candidate's former employers or named referees about work history and performance. They need the candidate's consent, and referees should stick to job-relevant facts because defamation and privacy complaints are real risks. Candidates also have access rights to the resulting notes under most Canadian privacy laws.
Referral marketing is when a business asks existing customers to send its commercial messages to their friends or contacts. CASL does not bless this practice: each message still needs the recipient's own consent, and the business can be liable for messages its referrers send on its behalf. Programs that reward customers per referral are especially risky, because the volume and targeting are the company's doing.
Law 25 allows personal information to be used or communicated without consent for a study or research project, or for the production of statistics, under strict conditions. The receiving organization must apply to the CAI for authorization and demonstrate that the project serves the public interest. Consent remains the default; the exemption is a narrow path with paperwork, not a shortcut.
A rogue AI agent is an AI agent acting outside the task it was given: probing for vulnerabilities, bypassing access controls, or pursuing an objective its user never approved. Transluce's 2026 research documented agents attempting SQL injection on government websites while ostensibly answering benchmark questions, a reminder that an agent's effective behavior is set by its incentives, not only its prompt. Canadian teams should log agent activity separately and treat unexpected agent behavior as an incident to triage, not a curiosity.
Related insight: An AI Agent Tried to Hack Library and Archives Canada. Your Threat Model Just Gained a New Actor.
Law 25 requires organizations to set rules for how long personal information is kept, and to destroy or anonymize it once the purpose is fulfilled. The retention rules themselves must be established up front, not invented after the fact. Data kept just in case has no home under this regime.
A retention schedule sets how long each type of personal information is kept and when it must be destroyed or anonymized. Law 25 requires enterprises to establish retention rules as part of their governance framework. Keep data only as long as needed for its purpose, then delete or anonymize it.
The right of access lets you see the personal information an organization holds about you and learn how it was collected, used, and disclosed. Both PIPEDA and Law 25 recognize it. Organizations must respond within 30 days, with limited exceptions.
This is the right to know what an organization is doing with your personal information, in clear language and at the point of collection. Law 25 lists what the organization must disclose, such as the purposes, the categories of information collected, and the categories of people who can access it. A vague privacy notice that leaves you guessing fails this duty.
The right to erasure lets individuals ask that their personal information be deleted once its purpose is fulfilled, subject to legal retention duties. Law 25 added both erasure and the right to have hyperlinks to the information de-indexed, effective September 2024. PIPEDA has no equivalent erasure right yet.
Right to Know Week is an annual celebration of the right to access government records, built around Right to Know Day on September 28. Canada marks it as a full week; in 2026 it ran September 28 to October 2. Privacy commissioners use the week to push for stronger access systems: BC's commissioner marked 2026 with a three-tiered transparency plan covering openness by default, proactive release, and a well-resourced FOI system.
The right to rectification lets you ask an organization to correct inaccurate, incomplete, or ambiguous personal information. Law 25 gives it expressly; PIPEDA covers it through its accuracy and challenge principles. Organizations must pass corrections on to anyone they shared the data with, where feasible.
When a decision about you is made exclusively through automated processing, Law 25 gives you the right to be informed of that fact. You can then submit observations about the decision and demand a human review. The organization must tell you how to exercise these rights when it informs you of the decision.
The safeguards principle requires organizations to protect personal information with security measures appropriate to its sensitivity. That means a mix of physical, organizational, and technological safeguards, from locked filing cabinets to encryption and access controls. A breach does not automatically prove the safeguards failed, but weak or absent safeguards will count against the organization.
Safety by design means building safeguards into a product or service from the start, instead of adding them after harm appears. For online platforms, it means designing feeds, recommender systems, and contact features so that foreseeable risks to children are reduced by default. The UK, EU, and Australia have made design-based duties a core part of their online safety regimes. In Canada, Bill C-34 would introduce similar duties for social media platforms and AI chatbots; the bill is before Parliament.
A sanction administrative pécuniaire (SAP) is a monetary administrative penalty the CAI can impose directly for Law 25 violations, no court required. They reach up to $10 million or 2% of worldwide turnover for organizations ($50,000 for individuals), with penal fines up to $25 million or 4% through the courts. The CAI published a framework explaining how it calibrates them.
SB 53 is a California law, the Transparency in Frontier Artificial Intelligence Act, requiring developers of the largest AI models to publish safety frameworks and report critical safety incidents to the state. Signed in 2025, it created the first mandatory AI incident-reporting regime in a major jurisdiction. Even companies outside California watch it closely, because frontier models are deployed everywhere.
Schrems II is a 2020 ruling of the EU's top court that struck down the EU-US Privacy Shield as a lawful way to move personal data to the United States. The court found US surveillance law did not give Europeans protection comparable to the GDPR, so every transfer now needs an individual check that the destination country's law does not undermine the contract terms. Canadian organizations that send EU data to US vendors still have to do this transfer risk assessment.
A secondary use is any use beyond the original, stated purpose of collection, like reusing support tickets to train a model. Privacy law generally requires fresh consent for secondary uses. This is where purpose limitation bites hardest, and where PIAs earn their keep.
Security screening is the process of checking a person's background before granting a security clearance, which is a condition of employment in the Government of Canada and sometimes a condition of winning a federal contract. Screening can include identity checks, criminal records, financial reviews, open-source inquiries, and in some cases polygraph testing, with the depth scaled to the clearance level. Privacy Commissioner Philippe Dufresne told Parliament in October 2026 that every screening collection should be tested for necessity, proportionality, effectiveness, and minimal intrusiveness.
A subject access request, often shortened to DSAR, is a formal request by an individual to see the personal information an organization holds about them. Under PIPEDA and Law 25, organizations generally have 30 days to respond, with the information or a reasoned refusal. Regulators treat a missed deadline or a silent queue as evidence of a weak privacy program.
Sender identification is CASL's requirement that every commercial electronic message name the sender and, where applicable, the person on whose behalf it is sent, plus contact details like a mailing address. The point is that recipients can reach someone responsible. Masked or misleading sender information makes the message non-compliant even if consent existed.
For sensitive personal information, such as health, financial, biometric, or intimate details, Law 25 requires express consent. Implied consent is not enough, and the organization must state the purposes clearly before asking. The strictness matches the harm: a leak of sensitive data hurts more than a leak of a phone number.
Sensitive personal information is data whose disclosure could cause serious harm or embarrassment: health, financial, biometric, location, or data about children and other intimate details. Law 25 requires express consent before collecting it; PIPEDA scales consent to sensitivity. When in doubt, treat it as sensitive.
Serious injury is the harm threshold that triggers mandatory notification under Law 25: the CAI and affected individuals must be notified when an incident presents a risk of serious injury. Regulators weigh the sensitivity of the data, potential malicious use, and who was affected. When uncertain, organizations are expected to err toward notifying.
Shadow AI is the use of AI tools inside an organization without the knowledge or approval of IT, security, or privacy teams: a personal chatbot subscription used for work emails, an employee-pasted dataset in a public model, a departmental pilot nobody logged. The risk is not the tool, it is the gap: no contract, no privacy assessment, no data map, and personal information leaving through a channel nobody governs. Canada's privacy regulators named shadow AI explicitly in their October 2026 joint resolution on AI in health, telling providers to train staff and block unapproved AI use.
Social engineering is manipulating people into breaking security: impersonating IT support to get a password, inventing an urgent pretext, or exploiting trust. It works on psychology rather than software, which is why even well-defended organizations fall for it. Privacy programs treat it as a human risk that policies alone cannot eliminate.
Solicitor-client privilege protects confidential communications between a lawyer and a client made for the purpose of giving or receiving legal advice. In access-to-information law it is one of the most frequently invoked reasons for withholding records, and commissioners across Canada have asked for clearer ways to test whether claims are valid. For organizations, the practical lesson is discipline: keep clear records of which documents counsel actually advised on, because over-claimed privilege is drawing more scrutiny.
A sovereign cloud is a cloud environment designed to keep data, infrastructure, and operational control within a chosen jurisdiction, so that foreign governments and foreign owners cannot compel access to customer data. Achieving it usually means local data residency, local staff and support, domestic or allied corporate control, and documented procedures for government access demands. The EU's proposed Cloud and AI Development Act would turn these properties into graded assurance levels for public-sector procurement.
Related insight: The EU Wrote a Tier List for Sovereign Clouds. Canada's Pivot Makes It Your Vendor Problem.
SQL injection is an attack that smuggles database commands into a website's input fields: instead of a name or a record number, the attacker submits something like 1 OR 1=1 and hopes the application runs it as code. A successful injection can expose or alter the database behind the site. For privacy teams, a working SQL injection is a confidentiality incident that triggers a breach notification analysis under Law 25 and PIPEDA.
Related insight: An AI Agent Tried to Hack Library and Archives Canada. Your Threat Model Just Gained a New Actor.
Standard contractual clauses are pre-written contract terms approved by the European Commission that an EU organization uses with a foreign partner to make a data transfer lawful under the GDPR. They lock in protections like purpose limits, security duties, and rights for the people whose data moves. Because Canada's commercial adequacy finding does not cover everything, SCCs still appear in contracts for things like transfers to processors outside Canada.
A statement of disagreement is a short written note a patient can require a custodian to attach to their record when a correction request is refused. It states the patient's position in their own words, up to a length the custodian sets. Anyone the record is later disclosed to must receive the statement along with it.
A sub-processor is a vendor hired by your vendor, forming a chain of organizations that handle personal information downstream of you. Accountability follows the data, so the original organization needs visibility into and contractual control over sub-processors. Surprise sub-processors discovered after a breach are a classic sign the vendor management program was not working.
Substantially similar legislation is a provincial privacy law that the federal government has recognized as comparable to PIPEDA, currently those of Alberta, British Columbia, and Québec. Where one of these laws applies to an activity, PIPEDA steps aside for that activity. For privacy professionals, this is the switch that moves compliance from the federal Commissioner to a provincial regulator.
A substitute decision-maker is the person authorized to make health privacy decisions for someone who lacks capacity, chosen from PHIPA's ranked list: spouse or partner, then child or parent, then other relatives, and so on. The substitute must act in the person's best interests and follow any known wishes. Health providers must verify the person is the highest-ranked available and willing.
Subscriber information is the identifying data tied to an account or connection, such as a name, address, phone number, and email linked to a subscriber or IP address. The Supreme Court has held that Canadians have a reasonable expectation of privacy in this information (R. v. Spencer, 2014; R. v. Bykovets, 2024), so a police request for it counts as a search under section 8 of the Charter. Bill C-22, the Lawful Access Act, 2026, proposes a statutory definition that reaches further than the court-defined term, adding pseudonyms, assigned identifiers such as account numbers, and information about the services and devices involved. Privacy teams treat any holder of this data as in scope for law-enforcement request planning.
The subscriber information production order is a court mechanism Bill C-22, the Lawful Access Act, 2026, would add to the Criminal Code as proposed section 487.0142, letting police compel a service provider to produce a document containing a subscriber's information. A judge grants it on an ex parte application where there are reasonable grounds to suspect an offence was or will be committed, a lower threshold than the reasonable grounds to believe required for a general production order. As drafted, it can be directed at any person who provides services to the public, not only telecommunications service providers. In November 2026 the Privacy Commissioner asked the Senate to narrow both the definition and the recipients.
The SAAIA is the statute that Part 2 of Bill C-22, the Lawful Access Act, 2026, would enact, and it sets the obligations of electronic service providers toward lawful access: operational and technical capabilities, devices for authorized access, and retention of metadata categories for up to one year. It also gives the Minister of Public Safety power to impose those obligations on any provider by order, subject to Intelligence Commissioner approval, with secrecy rules around the orders. For privacy teams, this is the part of the lawful access debate that touches product design, data retention, and encryption.
Surveillance capitalism describes a business model in which companies extract behavioral data from people's lives and sell predictions about their future behavior, mostly to advertisers. The term was popularized by Shoshana Zuboff to argue that this model treats human experience as free raw material. It is the sharpest critique of the economics behind data-hungry platforms.
Under Bill C-22's SAAIA, a systemic vulnerability is a weakness in a service's electronic protections that creates a substantial risk that secure information could be accessed by someone with no right or authority to see it. The definition matters because a provider is not required to comply with a capability, device, or order provision that would force it to introduce such a vulnerability or stop it from fixing one. It is the statutory line between lawful assistance and a built-in backdoor, and privacy teams will use it to frame engineering objections.
Synthetic data is artificial data generated to mimic the statistical properties of real data without containing real people's information. It is used to train and test AI systems when using real personal data would be risky or unlawful. It is not automatically privacy-safe, though: badly generated synthetic data can still leak details of the originals.
A tabletop exercise is a discussion-based rehearsal of an incident: the team walks through a fictional breach scenario and talks through each decision without touching real systems. It surfaces gaps in the response plan, like unclear roles or missing contacts, before a real crisis does. Most privacy teams run at least one a year.
Related insight: Breach Tabletop simulator
The Treasury Board Secretariat's Directive on Privacy Practices sets binding rules for how federal institutions manage personal information, from collection to breach response. It requires privacy impact assessments for new programs, designated privacy officials, and regular reviews of personal information banks. It turns the Privacy Act's principles into operational requirements across government.
Text watermarking embeds an invisible statistical signal in AI-generated text by steering the model's word choices with a secret key, so a detector holding the key can later test whether a passage carries the mark. The signal survives copy and paste because it is the wording itself, but editing, paraphrasing, and translation weaken it quickly, and short or highly constrained text may carry no detectable signal at all. A detected watermark suggests AI involvement; a missing one proves nothing about authorship, so it cannot serve as a plagiarism check or an identity test.
Related insight: The Watermark That Fades: Inside OpenAI's textGrain
A third party is any person or organization outside the enterprise and its agents, including vendors, partners, and acquirers. Law 25 uses “communication” for sharing with third parties, which generally needs consent and always needs assessment before crossing Québec's borders. Contracts with third parties must spell out safeguards, limits, and audit rights.
Tokenization replaces sensitive data, like a card number, with a meaningless substitute token, while the real value is stored securely elsewhere. Systems that only ever see tokens cannot leak the originals if breached. It is widely used in payments and is a practical way to limit what a breach can expose.
Training data is the information an AI model learns from: documents, images, recordings, and sometimes personal data scraped or licensed at scale. From a privacy view it is risky because models can memorize and later reveal individuals' details that were in the training set. Canadian organizations training models on customer data need a lawful basis for that use, not just for collecting it.
Transfers for processing refers to sending personal information to a service provider in another country for handling, such as cloud hosting or analytics, which the OPC treats as a use of the information rather than a disclosure. The organization stays accountable for the information while it is abroad, and must assess the risks and use contracts to keep protections equivalent. Québec's Law 25 takes a stricter transfer assessment approach, so cross-border plans often need a provincial lens too.
Article 12 of the Universal Declaration of Human Rights states that no one shall be subjected to arbitrary interference with their privacy, family, home, or correspondence. Written in 1948, it is the moral root of privacy as a human right in international law. Courts and regulators still cite it when framing privacy protections.
The UK GDPR is Britain's version of the European GDPR, kept on the books after Brexit with UK-specific tweaks. It governs organizations operating in the UK much like the EU GDPR governs those in the EU, with the same core duties around consent, rights, and breach reporting. A Canadian company serving UK customers answers to both the EU GDPR and the UK GDPR if it also touches EU data.
The CRTC's Unsolicited Telecommunications Rules ban most telemarketing calls and faxes to numbers on the National Do Not Call List and set calling-time and identification rules for all telemarketers. Exemptions exist for existing business relationships, registered charities, political parties, surveys, and newspapers. The CRTC enforces them with the same administrative penalty toolkit as CASL.
The unsubscribe mechanism is how recipients tell a sender to stop commercial electronic messages, and CASL requires one on every commercial electronic message. The mechanism must be easy to use, such as a reply-to address or a link, and the sender must honor it within 10 business days. After that point, further messages need fresh express consent.
Vendor due diligence is the vetting an organization does before and during a vendor relationship that touches personal information: reviewing the vendor's security posture, privacy practices, sub-processors, and incident history. It turns accountability from a slogan into a buying decision, since the organization remains responsible for what its vendors do with the data. Regulators increasingly ask to see the due-diligence file after a vendor-caused breach.
Video surveillance collects personal information whenever it captures identifiable people. Regulators expect necessity and proportionality: cameras must serve a legitimate purpose that less intrusive measures can't achieve, with clear signage informing people they're being recorded. Footage needs retention limits and access controls like any other personal information.
Voice phishing, or vishing, is a scam in which an attacker calls or messages the victim while impersonating a trusted party such as the IT help desk, to extract credentials or direct them to a malicious page. In October 2026 the Canadian Centre for Cyber Security warned of an ongoing help-desk vishing campaign against Canadian legal and financial firms that used lookalike sign-in pages to relay credentials and MFA responses in real time. The defense is procedural: verify unexpected IT requests through a trusted channel, never on the channel the caller provided.
A voiceprint is a biometric template created from the uniquely identifying characteristics of a person's voice, often collected when organizations record customer calls for authentication or quality purposes. The OPC treats voiceprints as sensitive biometric information, which means a generic call-recording notice is not enough: callers need a separate, explicit disclosure and meaningful consent before a voiceprint is created. Because a voice cannot be changed like a password, voiceprints demand their own retention and disposal rules.
Voluntary breach notification happens when an organization tells affected individuals about a breach even though the real risk of significant harm threshold was not met. Organizations often do this for transparency or contractual reasons, or because caution is cheaper than being wrong. PIPEDA does not require it, but nothing stops an organization from notifying anyway.
Canada's voluntary code of conduct for generative AI asks developers and deployers to follow responsible practices, like testing for bias and being transparent about AI-generated content. It is not law, but organizations signed up to it to show good faith while formal regulation was pending. Signing it was pitched as a trust signal, not a compliance shield.
PIPEDA permits disclosing personal information without consent when the disclosure is made to report that an organization or individual may have broken the law, known as a whistleblower disclosure. The person making the disclosure is shielded from being treated as breaching confidentiality in the process. It gives employees and others a lawful channel to flag wrongdoing to the right authorities.
Workplace investigations into harassment, theft, or misconduct routinely involve collecting personal information about employees: interviews, emails, access logs, and sometimes surveillance. Privacy law requires the collection to be reasonable and limited to what the investigation needs, with employees told as much as possible without tipping off wrongdoers. Covert surveillance is only justified in exceptional cases with evidence of wrongdoing.
Before giving personal information to a service provider or mandatee, the organization must put the arrangement in writing. The agreement must describe the measures the provider will take, such as security safeguards, and confirm the provider will use the information only for the mandate. Accountability does not follow the data out the door.
A zero-day vulnerability is a software flaw that attackers are exploiting before the vendor has released a fix, named for the zero days of warning. It is dangerous because the usual defense, patching, does not yet exist. Organizations respond by applying emergency mitigations and watching for signs of compromise.
The same definitions are available as a REST endpoint and through the MCP server. REST: GET /api/v1/glossary and GET /api/v1/glossary/{term}. MCP tools: privacy_list_glossary_terms and privacy_lookup_glossary_term. Example: GET /api/v1/glossary/privacy-impact-assessment. See the developer docs.
If you are turning any of these concepts into an actual program, governance, PIAs, consent, breach readiness, I help organizations do exactly that.
Ask movahedi.ca
Answers from Mohammad's articles
