GDPR Readiness Assessment: What It Covers for Canadian Companies

A GDPR readiness assessment checks whether the GDPR applies to you, then measures your current practices against the obligations that do. It names the gaps in order of risk. For a Canadian company, it should answer four questions: are you in scope under Article 3(2), do you need an EU representative, can you produce a record of processing, and which projects need a DPIA.

Does the GDPR apply to a Canadian company?

Often, yes, and the trigger is not where you are incorporated. Article 3(2) of the GDPR extends the regulation to a company with no establishment in the EU when it processes personal data of people who are in the EU, and the processing relates to either of two things:

• Offering goods or services to people in the EU, paid or free.
• Monitoring their behaviour as far as that behaviour takes place in the EU. Analytics that profile users, ad targeting and behavioural tracking all count.

A website that people in Europe can merely reach is not enough on its own. The signals that tip a company into scope are practical ones: prices in euros, a German or French version of the product, EU shipping, marketing aimed at EU countries, or EU customers named in your sales deck. A Toronto SaaS company with three customers in the Netherlands and product analytics on their users is very likely in scope. A Calgary services firm whose site happens to get European traffic usually is not.

There is a second, more common route in. Your EU customers are controllers under the GDPR, and when they use your product you are their processor. They are obliged under Article 28 to bind you to a data processing agreement with specific terms. So even where Article 3(2) does not catch you, your contracts will. A readiness assessment should look at both routes, because the work they create is different.

What a GDPR readiness assessment covers

A useful assessment is scoped to what the regulation actually asks of a company your size and shape, not a read-through of all 99 articles. These are the areas we expect to see examined, with the article each one comes from.

Area	GDPR article	What the assessment checks
Territorial scope	Art. 3	Whether you are in scope directly, as a processor only, or not at all
Lawful basis	Art. 6, 9	A documented basis for each purpose, and stricter handling of special category data
Transparency	Art. 13, 14	Whether your privacy notice says what the regulation requires it to say
Data subject rights	Art. 15 to 22	Whether you can answer access, erasure and portability requests within one month
Processors and contracts	Art. 28	DPAs with your vendors, and the DPA you offer customers
Record of processing	Art. 30	Whether a written record of processing activities exists and is current
Security	Art. 32	Controls appropriate to the risk, such as access control, encryption and testing
Breach notification	Art. 33, 34	Whether you could notify a supervisory authority within 72 hours
DPIA	Art. 35	Which processing is likely to be high risk and has been assessed
EU representative	Art. 27	Whether you need one, and whether one is appointed in writing
International transfers	Chapter V	How data moves out of the EU and on to your subprocessors

Do you need an EU representative under Article 27?

If Article 3(2) puts you in scope, Article 27 requires you to designate a representative in writing, located in one of the member states where the people whose data you process are. The representative is a point of contact for supervisory authorities and individuals. Appointing one does not move your legal responsibility onto them.

There is a narrow exemption. You do not need a representative if your processing is occasional, does not include large-scale processing of special category data or criminal offence data, and is unlikely to result in a risk to people's rights and freedoms. A SaaS product that EU customers use every day is not occasional, so most software companies in scope do not qualify. A company that fulfils the odd EU order might.

The representative question is the one Canadian companies most often skip, because it has no equivalent under PIPEDA. It is also cheap to fix, which makes it a poor gap to be caught with.

The record of processing activities (Article 30)

Article 30 requires controllers and processors to keep a written record of their processing activities, available to a supervisory authority on request. For a controller it includes the purposes, the categories of people and data, the recipients, any transfers outside the EU, retention periods where possible, and a general description of security measures.

Companies with fewer than 250 employees are exempt, but only where the processing is not likely to result in a risk, is occasional, and does not include special category or criminal offence data. Ordinary customer and employee processing is rarely occasional, so in practice most small companies in scope still keep one. Treat the exemption as something to test, not something to assume.

The record is also the most useful single artefact a readiness assessment produces. It forces the data inventory that every other obligation depends on. You cannot write a privacy notice, scope a DPIA, or answer an access request properly without knowing what data you hold and where it goes.

When a DPIA is required (Article 35)

A data protection impact assessment is required where processing is likely to result in a high risk to people's rights and freedoms, particularly with new technologies. Article 35(3) names three cases where one is always required:

1. Systematic and extensive evaluation of people based on automated processing, including profiling, that produces legal or similarly significant effects.
2. Large-scale processing of special category data, such as health data, or of criminal offence data.
3. Systematic monitoring of a publicly accessible area on a large scale.

Each supervisory authority also publishes its own list of processing that needs a DPIA. For a Canadian SaaS company, the projects that usually trigger one are AI features that score or rank people, health data products, and anything that combines datasets about the same individuals from several sources. If you already do privacy impact assessments for Quebec Law 25, the structure is similar enough that one template can serve both. Our DPIA builder works from that shared structure.

Is Canada still adequate for GDPR transfers?

Yes, with a scope limit that matters. The European Commission's adequacy decision for Canada dates from 2001 and covers organisations subject to PIPEDA, meaning commercial activity. On 15 January 2024 the Commission published its first review of eleven adequacy decisions and concluded that Canada continues to provide an adequate level of protection. It also recommended that Canada write some protections developed through guidance into legislation.

Adequacy means an EU customer can send personal data to you, as a PIPEDA-regulated business, without extra transfer safeguards such as standard contractual clauses. It does not take you out of the GDPR if Article 3(2) applies, and it does not cover your onward transfers. If you host in Canada but your error tracking, email or support tooling sends data to the United States, that leg needs its own mechanism. A readiness assessment should trace the data to where it actually lands, not stop at your primary region. Our guide to Canadian data residency covers how to map that.

Federal privacy reform is part of the background here. Bill C-27, which would have replaced PIPEDA's privacy provisions, died on the order paper when Parliament was prorogued in January 2025. PIPEDA is still the law the adequacy finding rests on.

What the deliverable from a GDPR readiness service looks like

The output should be something you can act on and hand to a customer's privacy reviewer, not a binder of generic policies. At minimum:

• A scope finding that says, in a paragraph, whether you are in scope under Article 3(2), as a processor only, or both, and why.
• A findings register listing each gap, the article it relates to, its risk, an owner and a suggested fix.
• A first draft of the record of processing built from your real systems.
• A list of processing that needs a DPIA, with the reason for each.
• A transfer map showing where data goes and on what basis.
• A view on the EU representative, including whether the exemption applies.

That is the Phase 1 we run. It sets scope and produces the findings register, and Phase 2 is the remediation scoped from those findings. We work in that order because remediation cannot be priced honestly before anyone knows the gaps. A company that needs a DPA and a privacy notice is a very different job from one that needs DPIAs on three AI features and a rebuilt access request process. Our GDPR readiness Phase 1 starts from $3,000, and the GDPR readiness page sets out what it covers.

Questions to ask before you hire a GDPR readiness service

• Has the firm completed privacy engagements for Canadian companies that it can show you?
• Will the assessment cover PIPEDA and Quebec Law 25 alongside the GDPR, so you build one programme rather than three?
• Is remediation priced before or after the gap assessment? A fixed remediation price before anyone has looked is a guess.
• Who does the work, and what is their background beyond a baseline privacy certification?
• Which entity signs the contract, and under which province's law?
• Where will your data inventory and findings live during and after the engagement?

The overlap with Canadian law is real and worth exploiting. We cover where the two regimes differ in PIPEDA vs GDPR, and the wider picture in GDPR for Canadian companies. If Quebec residents are among your users, how Law 25 compares with PIPEDA explains why Law 25 is the closer match to the GDPR. A PIPEDA readiness gap assessment can often run alongside the GDPR one.

What GDPR non-compliance can cost

Article 83 sets two tiers of administrative fines. Infringements of obligations such as records, security, DPIAs and representatives can reach EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Infringements of the basic principles, lawful basis, data subject rights and transfer rules can reach EUR 20 million or 4%. Those are ceilings, and authorities consider factors such as the nature of the infringement, intent and cooperation.

For most Canadian companies, the likelier cost is commercial. An EU customer's procurement team asks for your DPA, your subprocessor list and your record of processing, and the deal stalls until you can produce them.

Common questions about GDPR readiness assessments

Does the GDPR apply to a Canadian company with no EU office?

It can. Article 3(2) applies the GDPR to companies outside the EU that offer goods or services to people in the EU, or monitor their behaviour there. Pricing in euros, EU language versions, marketing aimed at EU countries and behavioural analytics on EU users are the usual signals. Separately, EU customers will require you to sign a data processing agreement as their processor.

Is Canada adequate under the GDPR?

Yes, for organisations subject to PIPEDA, which covers commercial activity. The European Commission confirmed Canada's adequacy in its review published on 15 January 2024. Adequacy lets EU companies send personal data to you without extra safeguards. It does not exempt you from the GDPR where Article 3(2) applies, and it does not cover your onward transfers to vendors in other countries.

Do small companies need a record of processing activities?

Usually. Article 30 exempts organisations with fewer than 250 employees only when their processing is occasional, unlikely to result in a risk, and excludes special category and criminal offence data. Routine processing of customer or employee data is rarely occasional, so most small companies in scope still need one. It is also the inventory every other GDPR obligation depends on.

What is the difference between a GDPR readiness assessment and a DPIA?

A readiness assessment looks at your whole programme against the regulation and produces a findings register. A DPIA, required by Article 35, looks at one specific processing activity that is likely to be high risk, such as profiling or large-scale health data, and records the risks and the measures that address them. A readiness assessment should tell you which DPIAs you need.

Can GDPR work be combined with PIPEDA and Quebec Law 25?

Yes, and it should be. The data inventory, privacy notice, access request process, vendor contracts and breach procedure overlap heavily across all three. Quebec Law 25's privacy impact assessments are close enough to DPIAs to share a template. Building one programme with regime-specific additions costs less than three separate projects and is easier to keep current.