The PIPEDA compliance checklist, 32 points you can finish this afternoon

Who is responsible, and can you prove it on a Tuesday afternoon with no notice.

• A named individual is designated as accountable for privacy compliance.P1Required outright. It can be the owner, but it has to be somebody specific.
• That person's name or title and contact details are published, not just held internally.P8Openness requires it be available, not merely decided.
• You have a written list of every third party that processes personal information for you.P1You stay accountable for data in their hands. You cannot protect a list you have never written.
• Each of those third parties is covered by a contract addressing protection of the data.P1Contractual or other means is the mechanism PIPEDA names for transferred data.
• Staff who touch personal information have had privacy training you can evidence.P1Training is the organizational safeguard regulators ask to see first.
• Privacy policies and procedures exist in writing, not only in the owner's head.P1An undocumented practice is indistinguishable from no practice during an investigation.

You cannot limit, secure or delete data you have never inventoried.

• You have a data inventory listing what personal information you collect and where it lives.P2Every other obligation depends on this one existing.
• Every field on every form maps to a written, identified purpose.P2Fields with no purpose are pure liability.
• You have removed form fields that no stated purpose justifies.P4Limiting collection is the cheapest risk reduction available to a small business.
• A written retention schedule sets how long each category is kept.P5PIPEDA expects guidelines with minimum and maximum retention periods.
• Deletion actually happens on that schedule, including in backups and exports.P5A schedule nobody executes is a document, not a control.

The part that gets small businesses caught, because the defaults are wrong.

• Your privacy policy is reachable from every page, before any data is collected.P3Consent given before the terms are visible is not meaningful consent.
• No consent checkbox on your site is pre-ticked.P3A pre-ticked box records an action the person did not take.
• Marketing consent is separate from the consent needed to deliver the service.P3You cannot condition service on consent to collection beyond what is necessary.
• Sensitive information - health, financial, biometric - is collected only on express consent.P3Implied consent does not carry sensitive categories.
• Analytics and advertising scripts do not load until the visitor has agreed.P3A banner that appears after the trackers have fired announces consent rather than recording it.
• Withdrawing consent is as easy as giving it, and the mechanism actually works.P3The right to withdraw is explicit, subject to legal and contractual restriction.

Proportionate to sensitivity - which means a clinic and a landscaper differ.

• Every staff member has their own login. No shared accounts anywhere.P7Without attribution you cannot investigate your own breach.
• Multi-factor authentication is on for email, cloud storage and any admin console.P7Credential theft is the most common route into a small business.
• Access is limited to what each role needs, and reviewed when people change roles.P7Canada's largest insider breach was an access-control failure, not a hacking one.
• Access is revoked the day someone leaves, including on personal devices.P7Dormant credentials are the cheapest thing for an attacker to find.
• Personal information is encrypted in transit, and at rest where it is sensitive.P7Encryption is what turns a lost laptop into a non-event.
• Paper records are locked, and disposal is shredding rather than a recycling bin.P7PIPEDA names physical safeguards explicitly. Regulators do inspect this.
• You know which of your vendors store Canadian data outside Canada.P7Cross-border transfer is permitted, but it must be disclosed and it changes the risk.

Thirty days is shorter than it sounds when nobody is watching the inbox.

• A monitored channel exists for access requests, and staff can recognise one.P9The clock starts on receipt, not on the day somebody notices.
• You can actually produce everything you hold on one person, across every system.P9This is where the data inventory stops being paperwork.
• There is a route to correct inaccurate information, and corrections propagate.P6A correction that does not reach the third party you shared with is not a correction.
• A complaints procedure exists, is easy to find, and complaints get logged.P10You must investigate all complaints received. That implies a record.

The obligations here are the only part of PIPEDA carrying an offence provision.

• A written breach response plan names who decides, who notifies and who calls counsel.P7The decisions are bad ones to make for the first time at 11pm.
• You can assess “real risk of significant harm” against sensitivity and probability of misuse.P7RROSH is the statutory test that triggers reporting.
• You keep a record of every breach - including ones you decide not to report.P7Record-keeping covers all breaches, for 24 months, and failing to keep them is an offence.
• You know how to file with the OPC and what the report must contain.P7“As soon as feasible” does not leave time to learn the form.