Canada CPPA

Consumer Privacy Protection Act (Bill C-27) - replaces PIPEDA, data mobility, AIDA AI provisions.


Short name	CPPA
Region	Americas
Country or scope	Canada
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CPPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for CPPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for CPPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CA-CPPA-57` Security Safeguards	Organisations must protect personal information through physical, organisational and technological safeguards proportionate to its sensitivity, which for processing software includes verifiable integrity of components (CPPA s. 57, Bill C-27)	Scan
`CA-CPPA-58` Breach of Security Safeguards Reporting	Breaches of security safeguards creating a real risk of significant harm must be reported to the Privacy Commissioner and affected individuals, requiring the ability to identify exactly which components were compromised (CPPA s. 58, Bill C-27)	Scan
`CA-CPPA-9` Privacy Management Program	Organisations must implement and document a privacy management program covering the protection of personal information, supported by identifiable, timestamped documentation of processing systems (CPPA s. 9, Bill C-27)	Scan
`CA-CPPA-11` Service Provider Protection Equivalence	When transferring personal information to a service provider, the organisation must ensure substantially equivalent protection, which extends to knowing who supplies the software components in the processing chain (CPPA s. 11, Bill C-27)	Scan
`CA-CPPA-OPEN` Openness and Transparency	Organisations must make information about their policies and practices readily available in plain language, a transparency posture served by machine-readable, standardised documentation of processing systems (CPPA openness and transparency provisions, Bill C-27)	Scan
`CA-CPPA-KNOW` Accountability for Information Under Control	An organisation is accountable for personal information under its control, which presumes maintained knowledge of the systems and components that store and process it (CPPA accountability provisions, Bill C-27)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`CPPA-6`	Transparency & Privacy Notice
`CPPA-12`	Valid Consent
`CPPA-22`	Collection, Use & Disclosure Limitation
`CPPA-40`	Privacy Management Programme
`CPPA-50`	Individual Rights Fulfilment
`CPPA-66`	Breach of Security Safeguards
`CPPA-84`	AIDA: AI System Accountability
`CPPA-85`	AIDA: AI Risk Mitigation Measures
`CPPA-86`	AIDA: Anomalous Impact Monitoring
`CPPA-87`	AIDA: Publication of AI System Information

Policy templates

Written for CPPA:

Canada CPPA Privacy Management Programme
Canada AIDA AI Impact Assessment Procedure

And 22 from the standard set, adapted to CPPA.