Canada PIPEDA

Safeguards, accountability, supplier verification for personal data processing software.


Short name	PIPEDA
Region	Americas
Country or scope	Canada
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PIPEDA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for PIPEDA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for PIPEDA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CA-PIPEDA-4.7` Safeguards Principle	Personal information must be protected by security safeguards appropriate to its sensitivity, including technological measures that preserve the integrity of processing software (PIPEDA Schedule 1, Principle 4.7)	Scan
`CA-PIPEDA-4.1` Accountability for Processing Systems	An organisation is responsible for personal information under its control, which requires it to know and document the software systems that hold or process that information (PIPEDA Schedule 1, Principle 4.1)	Scan
`CA-PIPEDA-4.1.3` Third-Party Transfer Accountability	Information transferred to third parties for processing must receive a comparable level of protection, requiring the organisation to identify the suppliers behind its processing components (PIPEDA Schedule 1, Principle 4.1.3)	Scan
`CA-PIPEDA-4.8` Openness of Practices	Organisations must make information about their policies and practices for managing personal information readily available, supported by identifiable, timestamped system documentation (PIPEDA Schedule 1, Principle 4.8)	Scan
`CA-PIPEDA-10.1` Breach of Security Safeguards Readiness	Organisations must report breaches of security safeguards that create a real risk of significant harm, which requires the ability to identify affected software components and versions promptly (PIPEDA s. 10.1, Division 1.1)	Scan
`CA-PIPEDA-IDENT` Identifiable Processing Components	Ongoing safeguard review and breach assessment require processing components to be unambiguously identifiable against vulnerability information (PIPEDA Schedule 1, Principle 4.7.3, care of information)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PIPEDA-P1`	Establish Accountability for Personal Information
`PIPEDA-P2`	Identify Purposes Before or at Collection
`PIPEDA-P3`	Obtain Meaningful Consent for Collection and Use
`PIPEDA-P4`	Limit Collection to Identified Purposes
`PIPEDA-P5`	Limit Use, Disclosure, and Retention
`PIPEDA-P6`	Maintain Accuracy of Personal Information
`PIPEDA-P7`	Protect Personal Information with Appropriate Safeguards
`PIPEDA-P8`	Be Open About Privacy Practices and Policies
`PIPEDA-P9`	Give Individuals Access to Their Personal Information
`PIPEDA-P10`	Provide a Process to Challenge Compliance
`PIPEDA-BREACH`	Report Significant Breaches of Security Safeguards

Policy templates

Written for PIPEDA:

Privacy Programme and Accountability Policy (PIPEDA)
Consent, Collection Limits, and Individual Access Policy (PIPEDA)
Security Safeguards and Breach Reporting Policy (PIPEDA)

And 22 from the standard set, adapted to PIPEDA.