To help navigate these developments, we spoke to these leading experts in the field: Constantine Karbaliotis, Counsel for nNovation LLP and Sylvia Klasovec, Principal Advisor at Trusteva Consulting

Together, they provide perspective on the challenges and opportunities facing businesses in 2025, offering insights on how businesses can stay ahead in this evolving landscape.  

What does 2025 hold for data privacy in Canada?

The Office of the Privacy Commissioner of Canada (OPC) has set the tone for 2025, pledging this Data Privacy Week to ‘put privacy first’. But with the delay in federal legislation due to the prorogation of Parliament, how will privacy evolve in Canada this year? 

Sylvia believes, “It will be a defining year for our country and our privacy landscape. There will be a fragmented approach to privacy, where the provinces may drive their own privacy laws, just as we saw with Quebec’s Law 25, creating dual compliance regimes and more operational complexity.

“The good news is that our privacy regulators are ahead of the curve, collaborating with international organisations like the Future of Privacy Forum to address emerging challenges, such as children’s privacy, biometrics, and data anonymization. 

“I predict a heavy focus on data and metadata management for AI readiness, emphasizing data quality, integrity, and transparency to support secure and reliable AI governance.” 

How do Canadian privacy practices compare to the EU?

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and the EU’s General Data Protection Regulation (GDPR) share foundational similarities but there are key differences in enforcement, scope, and approach.  Both adopt a principles-based approach, although the GDPR has stricter requirements, extra-territorial scope and fines tied to global revenue. PIPEDA generally only applies to companies operating in Canada and fines are capped at $100,000 per violation.

Constantine acknowledges the influence of EU practices on Canadian privacy regulation, especially in a principles-based legal environment: “We can look to jurisdictions like the EU and UK to interpret and take guidance on new situations, and our commissioner looks to Europe to understand how to apply our legislation.” 

What are the key aspects businesses should focus on for complying with PIPEDA?

Constantine suggests organizations focus on two key areas: safeguarding data and third-party developments. 

“First and foremost, always be conscious of the risks and implement the appropriate controls to protect individuals’ data. Secondly, watch what your vendors are doing. As they introduce new features to their services, ask yourself: What does this mean for my business? Are they selling the data, and if so, to whom? And most importantly, is my current risk assessment still valid?”

To help you comply with PIPEDA, it is advisable to take these essential steps: 

• Understand what information your organization collects and processes 
• Implement appropriate technical and organizational measures 
• Ensure appropriate consent is obtained and documented for all data collections 
• Conduct regular training and awareness programmes for employees 
• Establish comprehensive policies and procedures that include: 
  • Purpose specificity, data minimisation, and accuracy 
  • Transparency on how information is collected, used, disclosed, retained, and destroyed 
  • Processes for individual access, challenging compliance, and privacy incident management 

What does pausing Bill C-27 mean for data privacy in Canada?

After nearly three years of review, Bill-C27 was halted when Parliament was suspended on 6 January 2025. 

Key aspects of Bill C-27:

• Consumer Privacy Protection Act (CPPA), which would provide updated privacy protections for individuals 
• Artificial Intelligence and Data Act (AIDA), to establish a risk-based framework to regulate AI 

Privacy experts raise concerns about the impact of the delay

Constantine notes that the EU’s renewal of Canada’s adequacy status in 2024 was a missed opportunity to push meaningful reform forward. 

“When the EU renewed our adequacy finding, they took away the one thing that would have put a fire under our parliamentarians’ butts to actually make them pass a law.” 

Sylvia highlights the gaps in critical areas like children’s privacy, cross-border data transfers, and AI governance. She cautions that, “Without the regulatory guardrails AIDA provides, it could stifle innovation and lead to risky AI projects.
“Consent management will be particularly challenging as global counterparts rely on Legitimate Interests for AI data processing, while Canada follows implied consent rules. This will impact multinational AI companies and market dynamics. Whereas, in the EU, rules require transparency, fairness, and AI risk assessments, to name a few.”

She cautions that, “Without similar regulatory guardrails that AIDA would have offered – though not a perfect solution – innovation may be stifled and AI projects could become more risky.”

How can organizations prepare for future regulations in a rapidly evolving environment?

Constantine thinks that as a trading country, we must consider how our business partners are going to interact with us “Look to laws that exist in other countries to provide a structure and build effective governance around these things.”

Sylvia advises taking cues from international guidelines, calling the EU a “north star” that sets the world stage on the protection of human rights and freedoms. “We look to international guidelines because they usually indicate the direction in which any enacted laws will take shape. Mature Canadian enterprises have already codified much of this into their data management practices and some have gone as far as complementing our Canadian laws with ISO standards, ethical codes of practice, and certifications.” 

Summary

As we commemorate Data Privacy Day 2025, Canada is at a pivotal juncture. With federal legislation on hold and provinces stepping in to fill regulatory gaps, businesses face both challenges and opportunities. 

Insights from Constantine and Sylvia underscore the importance of proactive compliance and alignment with global privacy standards. Organizations should prioritize data governance, stay informed on emerging regulations, and implement robust privacy practices.  

____________________________________________________________________________________________________________

In case you missed it… 

• Privacy in Canada and USA: 2024 highlights and 2025 expectations 
• Canadian privacy laws: PIPEDA and beyond 
• Quebec’s Law 25: A guide to support privacy compliance 

____________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn

The post Data Privacy Day 2025: Navigating privacy in Canada appeared first on DPO Centre.

In this blog, we highlight some of the key 2024 highlights for privacy in Canada and USA and cast an eye to what we can expect in 2025. 

Privacy in Canada: Challenges and progress

2024 has brought notable advancements to privacy in Canada, including the final phase of Quebec’s Law 25 coming into effect and the European Commission’s decision to uphold Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) as adequate under GDPR. This means data can keep moving easily between the EU and Canada, helping to support both trade and data safety. 

Key areas of focus in 2024 include Ontario’s Bill 194, Quebec’s Law 25, the awaited updates to PIPEDA under the proposed Bill C-27, and the privacy implications of Bill C-65. 

Let’s take a closer look at each: 

Quebec’s Law 25 

In September 2024, Quebec completed an overhaul of its privacy regime with Law 25’s final stage implementation. It requires organizations covered by Law 25 to, among other things, accommodate stricter consent rules, extended privacy rights, and data breach notifications.  

Quebec’s Law 25: A guide to support privacy compliance 

Updating PIPEDA: Bill C-27

At the Federal level, the Consumer Privacy Protection Act (Bill C-27) is still under review. A change in government might also mean changes to when the Bill is implemented and in what form.  

While there’s currently no comprehensive legislation in Canada that specifically governs AI systems, Bill C-27 does include within it the Artificial Intelligence and Data Act (AIDA) to establish a risk-based framework to regulate AI. As such, privacy professionals are expecting closer alignment with international frameworks like GDPR that aim to boost both data protection standards and economic competitiveness. 

Ontario’s Bill 194 

Ontario’s Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, has been a major development in Canadian privacy legislation this year. The Bill now obligates public sector organizations to: 

• Develop comprehensive cybersecurity programs 
• Establish clear accountability frameworks for AI systems 
• Be open and transparent about how digital technology is used 
• Carry out privacy impact assessments 
• Notify people quickly if their data is breached 

These obligations may also affect private sector companies working with provincial or municipal governments, as the requirements could extend to them through contractual or operational responsibilities. 

Bill C-65 

The Electoral Participation Act (Bill C-65) has sparked considerable debate, with Canadian Privacy Commissioner, Philippe Dufresne highlighting critical gaps in its approach to data protection and that it lacked “basic elements”. He has urged lawmakers to address these shortcomings and recommended the Bill should: 

• Require political parties to get consent to use data and limit how they collect and use it 
• Provide a way for people to access and correct their data 
• Contain broader obligations about privacy breach notifications to include mandatory reporting 
• Encourage more formal collaboration between the Office of the Privacy Commissioner, Elections Canada, and the Commissioner of Canada Elections 

The Bill has yet to reach the third reading in the House of Commons. 

United States: State-level innovation leads the way

The USA has seen much state-level activity, with 19 states now having comprehensive privacy laws. California, New York, and Florida have led the way in AI governance, with each taking a distinctive approach. 

Key developments in AI regulations include: 

California – the Artificial Intelligence Accountability Act proposes to make state-level assessments of generative AI risks mandatory and enforce safety and privacy standards in AI services. California is also planning to establish a centralized AI research hub to collaborate across sectors. 

New York – its focus on algorithm accountability and transparency requires companies to disclose how their AI systems handle customers’ personal data. This fits with consumer protection efforts to maintain human oversight of decisions around AI algorithms. 

Florida – introduced measures on AI transparency in public and educational settings. The state’s also considering regulations that require human oversight of autonomous vehicles. 

Global impact: EU data protection regulations affecting Canada and U.S.

The EU’s adequacy decision for Canada under the General Date Protection Regulation (GDPR) has been particularly important for maintaining uninterrupted data flows between the EU and Canada. This decision ensures that Canada’s data protection laws meet the EU’s stringent standards, allowing businesses to transfer personal data across borders without additional safeguards. 

For the United States, the situation remains more complex. In July 2023, the EU-US Data Privacy Framework (DPF) was established, with the UK’s ‘Data Bridge’ extension to the DPF Framework effective from October 2023. The DPF allows data transfers to organizations participating in the DPF program without the need for further transfer mechanisms. However, the DPF is not accessible for all, and many companies still rely on Standard Contractual Clauses (SCCs) and supplementary measures.  

Looking ahead to 2025

Looking to next year, several key trends are emerging that could shape the legislation landscape across North America. In Canada we could see:

• Updates to privacy laws in Alberta and British Columbia 
• Introduction of privacy legislation in Ontario 
• Implementation and enforcement of Bill C-27 (if passed) 
• More provinces aligning with Quebec’s Law 25 

In the U.S. we will see: 

• More states beyond the current 19 adopting privacy legislation 
• More focus on AI regulation and transparency set by California, New York, and Florida 
• More focus on AI accountability and initiatives regarding how algorithms work 

What it means for businesses

Organizations across Canada and the United States should prepare for evolving privacy regulations in 2025, with an emphasis on strengthening consent processes and implementing effective data minimization strategies.  

It is essential for businesses to conduct Privacy Impact Assessments (PIAs) on a regular basis and ensure robust data breach plans and policies are in place. As artificial intelligence (AI) continues to shape business operations, organizations must also develop and establish clear guidelines for its responsible use, treating privacy as a key part of building and maintaining customer trust.  

Success will ultimately depend on integrating these measures not individually, but as interconnected elements of a comprehensive data protection and privacy management strategy. 

Privacy support and advice for 2025

The world of data protection and privacy management is changing fast. And no matter the sector, businesses need to stay updated and flexible, adapting privacy practices to meet new requirements – all while ensuring compliance with current laws.  

Effective privacy management in 2025 will require a proactive approach, viewing privacy not just as a compliance obligation but a fundamental element of business strategy. This shift will place even more pressure on Privacy Officers to find trusted, experienced, and reliable sources of professional advice and expert guidance as the year unfolds. 

If your organization would benefit from additional Privacy Office Support, The DPO Centre offers a range of services, including Privacy Consulting, UK and EU GDPR Representation, and Outsourced Privacy Officers. 

____________________________________________________________________________________________________________

In case you missed it… 

• International data transfers: Explaining EU SCCs, UK Addendum and UK ITDA 
• Canadian privacy laws: PIPEDA and beyond 
• GDPR Representative: Do you need one? 

____________________________________________________________________________________________________________

For more news and insights about data protection follow The DPO Centre on LinkedIn

The post Privacy in Canada & USA: 2024 highlights and 2025 expectations appeared first on DPO Centre.

The Personal Information Protection and Electronics Act (PIPEDA) was enacted in April 2000. Since then, there have been significant changes in global data protection and technological advancements, necessitating amendments to Canadian federal legislation. 

The Digital Charter Implementation Act, 2022 (also known as Bill C-27) is the proposed update to PIPEDA. It is currently under consideration in the Senate. If enacted, the new law will require organizations to prepare for stricter regulations and increased enforcements. 

Here, we talk to Ray Pathak, a former Privacy Officer with over 15 years of Canada privacy experience and MD of The DPO Centre Canada. He sheds light on some of the current challenges faced by Canadian organizations, keeping in mind the potential law changes and the evolving role of privacy professionals. 

Ray, can you tell us a little bit about your background?

I’ve been in the privacy space for almost 20 years. From 2005-2015, I was a Privacy Officer, leading a wide variety of privacy programs. For the last 8 years, I have been leading and developing privacy solutions in the Privacy Tech sector. 

I’m privileged to now lead The DPO Centre’s Canadian office, where I work with organizations to help guide them through the increasing complexities of local and international privacy regulations.

What are the key privacy challenges currently faced by organizations in Canada?

With so many evolving global privacy laws, organizations operating across multiple jurisdictions face ongoing challenges to keep up with the changes.  

Canadian organizations must adapt to new legislation such as Quebec’s Law 25 and the potential federal changes, as and when Bill 27 passes. 

In addition, emerging technologies like AI have introduced new privacy challenges, including the risk of breach threats with sophisticated attacks, and an increase in state sponsored attacks. 

With the upcoming changes in Quebec’s privacy legislation, what should businesses do to prepare for compliance with Law 25? 

Law 25 is being implemented in stages.

Stage 1 came into effect on September 22, 2022, and covered the mandatory designation of a Privacy Officer and Privacy Impact Assessments (PIAs).

Stage 2 came into effect on September 22, 2023, focussing on Accountability, Consent, Transparency, Individual Rights, and other key principals of privacy management.

Stage 3 will come into effect on September 22, 2024, and deals with data portability rights. 

Businesses should complete a gap assessment of their current programs and adapt their policies, procedures, and data handling practices to ensure they comply with the stricter obligations under Law 25. Key areas to address will be Consent, PIAs, and cross-border transfers. 

Do you think there will be changes to other provincial laws?

With changes already in place in Quebec, and proposed changes to the Federal privacy law, I think it will only be a matter of time before the Alberta and British Columbia laws are amended. 

Also, the province of Ontario has been talking about introducing their own privacy legislation for some time, and I believe the introduction of this is inevitable in the next two to five years. 

How do Canadian laws regulate the use of AI systems?  

There is currently no single comprehensive law that deals specifically with AI in Canada. 

The Artificial Intelligence and Data Act (AIDA) was introduced in June 2022 as part of Bill C-27, which advocates a risk-based approach to AI systems. 

There are other sector laws that touch on AI within their domains, such as healthcare and finance, and PIPEDA can be applied to cover AI systems that collect, use, or disclose personal information. However, none of these laws are tailored to AI, and they fail to address the unique privacy challenges that come with these technologies. 

How do provincial laws like those in Alberta and British Columbia interact with PIPEDA? 

PIPEDA is the overarching privacy law for private sector companies that collect, use, or disclose personal information in Canada. 

However, when processing data in a province with its own privacy law, such as Alberta, British Columbia, or Quebec, the provincial law applies over the federal PIPEDA law. 

Most organizations operate across multiple provinces and may need to comply with up to four privacy laws – three provincial laws and the federal regulation. 

The good news is that provincial privacy laws have to be substantially similar to the federal privacy law, which ensures a certain amount of consistency for compliance. Although, there are still some significant differences, such as employee privacy, which is covered under provincial privacy laws for most private organizations, but not the current federal PIPEDA law.  

What would you say the greatest challenge is for the privacy industry at the moment?

The limited number of knowledgeable privacy professionals is a big challenge for organizations, especially if they only require part-time support. This can often lead to privacy being managed reactively, and as a secondary priority, by someone fulfilling another role within the company. 

That’s one of the key reasons why I joined The DPO Centre. We have an incredible pool of talent and a commitment to excellence. We’ve worked with over 900 organizations globally since 2017, and we can offer unparalleled support to organizations, providing in-depth privacy knowledge and expertise.  

What are some common misconceptions about the data protection industry? How do you deal with them?

The biggest misconception is that you can “complete” your privacy program, tick the box, and be done with it. 

However, if an organisation processes and stores personal data, there is a continual need for ongoing data management. It is one thing to adhere to a set of policies and another to truly safeguard data and ensure practices and processes are monitored and optimised.  

Organizations with strong privacy governance and embedded privacy by design practices are better equipped to mitigate risks and build customer trust, loyalty and engagement.  

What range of privacy services does The DPO Centre Canada offer?

Our Canadian team offer the same full-service privacy support that our clients benefit from the UK and EU offices, with the appropriate changes to accommodate Canadian privacy standards. 

Canadian Data Privacy Officers are available to assess, remediate, and operate your privacy program on an ongoing ‘fractional’ basis, provide ad hoc consulting support as required, and complete mandatory documentation such as Privacy Impact Assessments (PIAs). 

We also provide EU and UK GDPR representation for Canadian companies operating in the European Economic Area (EEA) and/or the UK. A GDPR Representative is a requirement for organizations that process the personal data of EEA or UK individuals but do not have a physical office in those jurisdictions.   

With the rise of global data protection laws, how does The DPO Centre Canada ensure multinational compliance?

Many Canadian businesses are aiming for international growth, and privacy can be a significant roadblock as they expand.  

The DPO Centre, has one of the largest teams of privacy experts available. Our DPOs are highly experienced privacy professionals, each with specialist industry sector knowledge and a deep understanding of global privacy laws. 

Therefore, we help organizations ensure that privacy isn’t a barrier as they grow globally.  

How do you foresee the future of privacy services evolving over the next five years?

I think we’ll see a continuing shift towards regarding privacy, not merely as a legal obligation but also as a key aspect of customer service and relationship management.  

We already work with organizations that understand privacy compliance is only a baseline requirement, especially in business-to-business industries. They recognize the potential for accelerated growth by leveraging excellent privacy practices that build trust, loyalty and engagement with their customers. It is therefore a crucial differentiator, helping them stand out from their competitors.  

As Canada’s privacy regulations evolve, our commitment to delivering top-tier privacy services continues. Supporting and empowering organizations to navigate complex legislation with confidence and integrity. 

The DPO Centre Canada

If you would like to discuss how our outsourced privacy services can help support your organization’s privacy governance, please contact The DPO Centre Canada team

For EU and UK data protection support, please see our range of EU/UK services

See also our recent blog, offering advice and guidance to support compliance with Quebec’s Law 25

The post Canadian privacy laws: PIPEDA and beyond appeared first on DPO Centre.

Law 25 represents a milestone for provincial privacy legislation. It marks a complete overhaul of Quebec’s privacy regime, strengthening privacy rights for individuals and updating organisational requirements. 

In this guide, we provide essential information to help support your journey towards achieving and maintaining compliance. We explain which organizations Law 25 affects and detail what each stage of its provisions include. 

What is Quebec’s Law 25?

Law 25 introduces several key concepts to modernize data protection practices in Quebec and strengthen privacy rights for individuals.

The legislation has been brought into effect in stages, over a three-year period, which has allowed organizations to adapt gradually to the new privacy requirements. By September 2024 organizations should ensure all provisions are fully implemented. 

Fines for non-compliance can range between CA$15,000 and CA$25,000,000 or 4% of worldwide turnover for the previous year, whichever is greater. 

Who does Law 25 apply to?

Law 25 applies to all businesses, including non-profits, operating in Quebec that collect, process, use or disclose the data of Quebec residents, regardless of size, revenue or location of the business. 

Quebec’s Law 25: A guide to support privacy compliance

Law 25 imposes a range of obligations on businesses, with the aim of striking a balance between privacy protection, individual rights, and business accountability. 

To ensure compliance with the new regulations, you should complete a gap analysis of your current privacy programs. This will identify any required updates that need to be made to policies, procedures and data handling practices. 

If you are operating within the province of Quebec and process personal data, these are the important aspects you should already have in place or need to address by September 22, 2024: 

Appoint a Data Privacy Officer 

The Data Privacy Officer role shares a similarity with the EU’s requirement for a Data Protection Officer (DPO). However, unlike the GDPR, the Privacy Officer role defaults to the highest-ranking individual in an organization, if one is not otherwise appointed. 

Many organizations may not be aware of the defaulting nature of the Privacy Officer role. Where a Privacy Officer is not explicitly appointed, the responsibility falls to the CEO or MD.  

What you need to do: It is crucial for organizations of any size or industry sector to recognize the importance of this role. A Privacy Officer should have the expertise and specialist knowledge to ensure compliance with privacy laws and understand the complexities of global data protection legislation. 

• Appoint an in-house Privacy Officer or outsource to an external professional 

For a comparison between in-house and outsourced options, see this link to download our infographic:

The infographic covers these important considerations for choosing between an in-house or outsourced Privacy Officer:

• Speed to hire,
• Scalability
• Experience and expertise
• Risk management
• Annual investment

Breach reporting  

Organizations must ensure that breach management processes are in place. Data breaches must be reported to the Commission d’accès à l’information (CAI) and all affected individuals as soon as possible. 

What you need to do: Create and test a data breach response protocol. When identifying a potential data breach, you must assess whether an incident poses a “risk of serious injury” based on information sensitivity, anticipated consequences and likelihood of harmful use. 

Your data breach response protocol should include: 

• Employee roles and responsibilities 
• Workflows 
• Template breach reporting document 

Biometrics disclosure 

Biometric data collection includes physical features such as fingerprints, facial features and iris patterns. 

What you need to do:  

• Express consent requirements – Obtain express consent from individuals and ensure it is specific to the purpose of collecting and using biometrics 
• Disclosure requirements – Inform the Commission d’acc`es ““““`a l’information du Québec (CAI) of your intention to use biometric processes at least 60 days before implementing the biometric system 
• Privacy by Design – Implement privacy-enhancing measures when handling biometric data and consider Privacy Impact Assessments (PIAs) to mitigate any potential harms 

Privacy Policy 

All organizations operating in Quebec must have a comprehensive Privacy Policy that outlines data handling practices. 

What you need to do: Create a Privacy Policy to include these important details: 

• Purpose – Clearly state the purpose of your privacy policy and outline how your organization collects, uses, discloses and protects personal information 
• Scope – Specify that the policy applies to all individuals whose data you process 
• Type of information – For example names, addresses, credit card numbers 
• Security measures – For example, encryption, access controls, regular audits, and employee training 
• Third parties and sharing – Explain the purpose of any such sharing and ensure transparency 
• Individual rights – Inform individuals of their rights and provide instructions on how they can exercise these rights 
• Contact information – For inquiries, requests and complaints related to privacy, include details of the designated Data Privacy Officer 
• Updates and accessibility – Commit to keeping the Privacy Policy up to date and ensure it is easily accessible and in a prominent place on your website 

Privacy Impact Assessment (PIA) 

A PIA is a systematic process to evaluate the impact of data processing activities on individuals’ privacy rights 

What you need to do: 

Under Law 25, organizations must conduct a Privacy Impact Assessment (PIA) for: 

• High risk data processing activities (e.g., large-scale data collection, profiling, biometrics) 
• Data transfers to other provinces, third countries, or international organizations 
• Implementation of new technologies (e.g., AI, IoT, facial recognition) 

Cross-border transfers 

These are transfers that involve moving personal data from Quebec to another jurisdiction outside Canada (or to another province). 

What you need to do: 

• Inform individuals about cross-border transfers in your Privacy Policy 
• Undertake a PIA (see details in the section above) 
• Enact contractual safeguards to ensure adequate protection in the jurisdiction of transfer 

Enhanced Consent 

Law 25 sets stricter rules for acquiring permission before using people’s personal information. Organizations must obtain explicit opt-in consent before collecting, storing, processing, and sharing personal information. Additionally, for children under 14, you will need the parent’s permission first. 

What you need to do:  

• Provide comprehensive information about why and how their data will be used 
• Ensure the consent request is prominant and stands out from general terms and conditions 
• Use clear and concise language with an opt-in requirement 
• Inform individuals of their right to withdraw consent at any time 
• List any non-Quebec third parties that you are sharing the personal information with 
• Maintain documentation of how and when consent was given 

Data minimization 

Law 25 emphasises the importance of collecting only the essential data for the intended purpose. Organizations must avoid excessive data collection and retain only relevant information. 

What you need to do: 

• Clearly define the purpose for which the data will be used in your privacy policy 
• Then only collect the minimum amount of data required to achieve that purpose  
• Define clear retention periods for different types of data 

Subject rights 

These rights came into effect September 2023, with the right to data portability effective in September 2024 (see below section). 

Subject rights include: 

• Right to be informed 
• Right to access 
• Right to rectification 
• Right to erasure 
• Right to withdraw consent 
• Right to restrict processing 
• Right to data portability 

What you need to do: 

• Ensure individuals are informed about your data practices 
• Privacy Officers should respond promptly to any access requests, within 30 days, and provide the relevant details (with redactions, as necessary) 

Data portability rights – comes into effect September 2024 

With this specific area of Law 25, individuals have the right to have their personal data seamlessly transitioned between service providers. 

What this means is that you are obliged to provide the requested information in a specified format. 

What you need to do: 

• You must provide the individual’s personal data in a structured, commonly used, and machine-readable format 
• Share the requested information with any authorized person or organization 

Summary 

The final stage of Quebec’s Law 25 comes into effect on September 22, 2024. 

Organizations operating within the province of Quebec must implement the necessary operational and procedural changes by that date to ensure compliance with the new regulations. 

We covered the key aspects of Law 25 in the above sections, but these are the main elements to consider: 

• All organizations must have a Privacy Officer in place 
• If you don’t specify a Privacy Officer, the CEO/MD will be automatically assigned 
• Complete a Privacy Impact Assessment (PIA) for all data transfers and new technologies 
• Implement a robust breach notification protocol with workflows and reporting documents 

The DPO Centre Canada 

From our offices in Toronto, Ontario, The DPO Centre Canada provides outsourced Canadian Privacy Officers to organizations operating across Quebec and other provinces.  

If you would like to discuss how our range of specialist services can support your organization’s privacy governance, please contact The DPO Centre Canada. 

The post Quebec’s Law 25: A guide to support privacy compliance appeared first on DPO Centre.

With the increasing complexity of global privacy legislation, it is vital for organisations to have the appropriate safeguards in place for these transfers. This ensures compliance with data protection laws, mitigates the risk of a data breach, and helps to maintain the trust of customers, stakeholders, and employees. 

There are several safeguarding options, depending on the nature of the data, where the individuals are located, and where the data is being sent. 

In this blog, we take a look at the EU Standard Contractual Clauses (EU SCCs), the UK Addendum, and the UK International Data Transfer Agreement (IDTA), explaining the suitability of each mechanism for EU and UK personal data transfers and the factors to consider. 

EU Standard Contractual Clauses (EU SCCs) 

EU SCCs are one of the most commonly used data transfer mechanisms. They are popular because they have pre-approval by the European Commission and a level of assurance for compliance with the General Data Protection Regulation (GDPR). 

The European Commission published new EU SCCs on 4 June 2021, allowing organisations to use these for data transfers from the European Economic Area (EEA) to third countries from 27 June 2021. 

UK Addendum

As the UK is no longer part of the EEA, UK organisations cannot rely on the new EU SCCs. Only the old EU SCCs were valid in the UK until the Information Commissioner’s Office (ICO) introduced their own solution in the form of an Addendum, which came into force on 21 March 2022. 

The UK Addendum allows organisations to use the new EU SCCs for UK personal data transfers, ensuring compliance with both EU and UK data protection laws. A helpful solution for organisations with locations across the EU and the UK. 

The old EU SCCs expired on 27 December 2022. Any existing UK contracts have until 21 March 2024 to transition to the new EU SCCs with UK Addendum or the IDTA. 

UK International Data Transfer Agreement (IDTA) 

The International Data Transfer Agreement (IDTA) was developed by the UK’s Information Commissioner’s Office (ICO) and has been in force since 21 March 2022. It is a legal framework for transferring personal data from the UK to countries outside the European Economic Area (EEA) not covered by adequacy decisions (these are known as UK Restricted Transfers). 

The IDTA is an alternative to the EU SCCs with the UK Addendum but is only suitable for transferring personal data from the UK. 

The IDTA sets out contractual obligations for both the data exporter (in the UK) and the data importer (in the third country) to protect the privacy and rights of individuals whose data is being transferred. It includes clauses on data handling, processing, security measures, and the rights of individuals. 

Should you use EU SCCs, UK IDTA or UK Addendum? 

There are fundamental questions you should ask when choosing the most appropriate data transfer mechanism for your organisation. These include understanding the type of data being transferred, the frequency and volumes, and the countries involved. 

Here’s a helpful list of questions to consider and an overview of which mechanism to use for EU or UK data:  

• Where do the individuals reside? EU, UK or both? 
• Are there any inter-company binding rules in place? If so, further mechanisms may not be required 
• Are you transferring data to an adequate country? If yes, the transfer can proceed, following the specific adequacy decision frameworks 
• Are you making a regular transfer to a non-adequate country? If yes, see EU SCCs or UK Addendum or IDTA  

The DPO Centre can help with your international data transfer queries 

• One of the largest teams of outsourced Data Protection Officers (DPOs) available 
• GDPR EU and UK Representatives 
• Specialist Advice Line offering a rapid response to important data protection queries 
• Highly cost-effective solutions 

We have worked with over 800 clients globally across the spectrum of industry sectors, supporting their data protection compliance and bringing peace of mind. 

The post International Data Transfers: Explaining EU SCCs, UK Addendum and UK IDTA appeared first on DPO Centre.