Category: Compliance
-
Paying a ransom is a hard decision, and law is increasingly part of it. General information, not legal advice. Laws are evolving. Consult counsel and your insurer before any payment decision. Approaches taken – Reporting requirements: Australia introduced the world’s first mandatory ransomware payment reporting regime for certain businesses, effective May 30, 2025. Reports are…
-
On June 15, 2026, Bill C-8, An Act respecting cyber security, received Royal Assent. It amends the Telecommunications Act and creates the Critical Cyber Systems Protection Act (CCSPA). What the law does – Telecommunications Act changes took effect immediately, making the security of Canada’s telecommunications system an explicit policy objective. – The CCSPA sets mandatory…
-
Privacy regulation isn’t standing still. Businesses that sell across borders must keep up. This article is for general information purposes only, not legal advice. Canada – Quebec has Law 25, with its major provisions now in force, including stricter consent, privacy officer duties, incident reporting, privacy impact assessments, and rules about automated decisions. – Federal…
-
AI rules are developing at different speeds around the world. If you sell to, or process data from, several regions, you may face more than one regime. General information only, not legal advice. European Union The EU AI Act sorts AI systems by risk and sets strict duties for “high-risk” uses such as hiring, credit…
-
Data residency refers to the physical or geographic location where data is stored and processed. Why it matters – Legal exposure: data stored in another country may be subject to that country’s laws and government access powers – Privacy obligations: Quebec’s Law 25 requires assessing risks before communicating personal information outside Quebec – Customer and…
-
Customers increasingly ask suppliers to prove their security. Three frameworks come up often. SOC 2 A report from an independent auditor on how a service organization manages data security and related criteria (security, availability, confidentiality, processing integrity, and privacy). – Common for: software, cloud, and managed service providers selling to North American customers – Output:…
-
Businesses in Canada may face both PIPEDA (the federal Personal Information Protection and Electronic Documents Act) and Quebec’s Law 25. The two share principles but differ in strictness. This is general information, not legal advice. Confirm which laws apply with legal counsel. Who each applies to – PIPEDA applies to private-sector organizations in provinces without…
-
Privacy and security obligations grow every year. Compliance as a service (CaaS) turns one-time projects into steady, managed practice. What drives compliance for Canadian businesses – Quebec’s Law 25 for personal information of people in Quebec – PIPEDA at the federal level, and similar provincial laws – Contractual obligations from customers who require security standards…
-
Video surveillance deters theft, documents incidents, and helps with insurance and safety. Today’s systems run on your network. IP cameras Digital cameras connected over Ethernet (often PoE). They offer higher resolution than older analog systems and flexible placement. Choosing cameras – Resolution: 4 MP to 8 MP suits most uses – Lens and field of…
-
Quebec’s Law 25 (formerly Bill 64) modernized the province’s private-sector privacy rules. It was phased in between 2022 and 2024, and it applies to most businesses that collect or use personal information about people in Quebec, including businesses located elsewhere. This article is general information, not legal advice. Consult a lawyer for your specific situation.…