A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Alberta's Personal Information Protection Act (PIPA) is the province's private-sector privacy law, governing how organizations in Alberta collect, use, and disclose personal information. It is recognized as substantially similar to the federal PIPEDA, so for most private-sector activity within the province it applies in PIPEDA's place. The Office of the Information and Privacy Commissioner of Alberta oversees it and it carries mandatory breach reporting.
For a company operating across provinces, the practical approach is to build to the common core of the Fair Information Principles once, then handle the provincial specifics on top. PIPA, PIPEDA, and Quebec Law 25 share most of their foundations.
The provincial differences that actually bite are in breach thresholds and timing, so those are worth pinning down for each jurisdiction you operate in rather than assuming one process covers them all.
traztech delivers privacy readiness across Canadian jurisdictions for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Alberta PIPA surfaces for companies operating in the province when a customer, a complaint, or a breach raises which privacy law actually governs. Because it is deemed substantially similar to PIPEDA, local private-sector activity falls under it rather than the federal law. We handle it within privacy readiness.
The obligation that catches people is breach reporting. Alberta PIPA requires reporting to the Commissioner where there is a real risk of significant harm, and the Commissioner can direct the organization to notify affected individuals. Our Alberta PIPA for tech companies guide covers the specifics.
They cover similar ground, and PIPA applies to most private-sector activity within Alberta because it is substantially similar to PIPEDA. The core principles align, so a programme built around the Fair Information Principles generally serves both.
Yes. Organizations must report to the Commissioner where a breach poses a real risk of significant harm, and the Commissioner can require notification to affected individuals.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.