Data Protection & Cybersecurity

A Privacy Impact Assessment is a structured process for identifying and addressing privacy risks before launching a new program, system, or initiative that involves personal information. In the public sector, PIAs are often legally required or mandated by policy — for example, federal institutions subject to the Treasury Board Secretariat's Directive on Privacy Impact Assessment must complete a PIA for programs involving sensitive data or new technologies. Provincially, requirements vary. In the private sector, PIAs (or their GDPR equivalent, DPIAs) are increasingly expected by enterprise partners and regulators as evidence of a privacy-by-design approach. We conduct PIAs as a formal engagement with clear deliverables — including a written assessment, risk register, and recommendations — and can develop PIA templates and internal capacity so your team can conduct them independently going forward.

For small organizations receiving occasional access requests, an ad hoc approach can work — but it creates risk. Legal response timelines are strict (30 days under PIPEDA and GDPR, with limited extension rights), and inconsistent handling exposes you to complaints and regulatory scrutiny. For any organization receiving more than a handful of requests per year, a structured DSAR program is essential. This means a defined intake process, clear routing to the right teams, documented redaction standards, and a tracking system to ensure deadlines are never missed. A formal program also demonstrates accountability — which regulators weigh favourably when assessing complaints or conducting audits. We build DSAR programs that are practical for your organization's size and volume, and we advise on the complex requests that require legal judgment.

A vendor AI risk review assesses the privacy and legal risks introduced when you procure an AI-enabled SaaS tool or when an existing vendor rolls out new AI features. The review covers: how the vendor uses your organization's data (including whether it is used to train or improve AI models), what the vendor's data processing agreement actually permits, whether automated decision-making or profiling is involved and what that means for your regulatory obligations, the adequacy of the vendor's security posture, and what audit and exit rights you have. You should conduct a review before signing any contract with an AI vendor, before renewing a contract where the vendor has added AI features, and whenever a vendor updates its terms of service to expand how it uses customer data. We have reviewed AI data processing agreements across a wide range of enterprise SaaS categories and know where the hidden risks typically appear.

A Data Subject Access Request (DSAR) is a right available to individuals under private sector privacy legislation — PIPEDA in Canada, GDPR in Europe — to access the personal information an organization holds about them. A Freedom of Information (FOI) request, by contrast, is a right to access government records and applies to public sector bodies under legislation like Ontario's FIPPA, Alberta's FOIP, or the federal Access to Information Act. The rules are meaningfully different: FOI legislation covers records broadly (not just personal information), has specific grounds for refusing disclosure, often includes proactive disclosure obligations, and is subject to oversight by an Information and Privacy Commissioner with adjudicative powers. Public sector organizations may receive both types of requests and must respond under the correct legal framework — with different timelines, exemptions, and procedural rules applying to each. We advise on both and help organizations build programs that handle each type correctly.