When this service helps
Your SMB wants to structure its personal information protection practices.
Your data and your responsibilities are still poorly documented.
Leadership can involve the business units and have the documents adopted.
What you receive
Deliverables
- Assessment, inventory and action plan.
- Designation of the person in charge and governance of personal information.
- Privacy policy and retention and destruction policy.
- Access, complaint and incident management procedures.
- Incident register, privacy impact assessments planned in the engagement and status report.
- Agreed training and materials.
Scope covered
- Assessment, inventory and governance for the selected processes.
- Policies and procedures adapted to the practices reviewed.
- Projects requiring a privacy impact assessment (PIA) are identified during scoping.
- One training session and a status report.
How it works
- 01
Map
We inventory the data and processes within the agreed scope.
- 02
Assess
We identify the gaps and the decisions to be made.
- 03
Document and train
We adapt the documents, carry out the planned assessments for the selected projects and deliver the agreed training.
- 04
Plan next steps
We deliver the status report, the priorities and the responsibilities for ongoing upkeep.
Your involvement
Leadership, the person in charge of the protection of personal information and the people who know the processes concerned.
Service limits
- Legal advice, representation before the Commission d’accès à l’information (CAI) and technical implementation excluded.
- Updates and additional training are separate engagements.
The scope, responsibilities, recipients of the deliverables and confidentiality terms are agreed before data collection. Any change in scope is accepted in writing.
Frequently asked questions
The assessment of the practices in scope, the inventory of personal information, the governance documents and the agreed action plan. Training and privacy impact assessments are specified in the proposal.
No. The report describes the work performed, the elements reviewed and the remaining gaps. Your organization adopts the documents and implements the selected measures.
A privacy impact assessment examines the risks a project poses to personal information. The projects to cover, the number of assessments and the required approvals are defined during scoping.
Leadership, the person in charge of the protection of personal information and the people who know the processes concerned. The time required depends on the complexity of the data and activities to cover.
No. The service focuses on preparing and improving practices. An ongoing incident requires separate handling. The support does not replace legal advice.