A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →PIPEDA, the Personal Information Protection and Electronic Documents Act, is Canada's federal private-sector privacy law. It governs how organizations collect, use, and disclose personal information in the course of commercial activity, and it is built on ten Fair Information Principles set out in its Schedule 1. The Office of the Privacy Commissioner of Canada oversees it, and it requires mandatory reporting of breaches that pose a real risk of significant harm.
PIPEDA is principles-based, so there is no checklist to tick and no certificate to earn. What demonstrates compliance is evidence that you applied the ten principles: a named accountable person, a map of what you collect and why, safeguards proportionate to sensitivity, and a breach process you can actually run.
For most growing companies the practical work is inventory first. You cannot limit collection, honour an access request, or scope a breach if you do not know what personal information you hold and where it flows. Quebec Law 25, Alberta PIPA and the GDPR build on the same foundations, so the work rarely serves one law alone.
traztech delivers PIPEDA readiness and gap assessment for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
PIPEDA usually surfaces when a buyer or partner asks how you handle personal information, or when a breach forces you to work out who you have to notify and how quickly. It is the baseline that applies federally and in every province that has not passed its own substantially similar private-sector law. We run this as a PIPEDA readiness and gap assessment.
The ten Fair Information Principles are the part worth internalising, because they are what an assessment maps against: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. Most gaps we see are in accountability and safeguards rather than in consent wording. Our PIPEDA readiness gap assessment write-up walks through it.
If you handle personal information in the course of commercial activity and operate federally or in a province without its own substantially similar private-sector law, yes. Quebec, British Columbia and Alberta have their own private-sector laws that apply instead for most local activity.
PIPEDA is complaint and ombudsman based rather than fine first. Offences are narrow: only an organization that knowingly breaches the breach-reporting or record-keeping provisions, or obstructs the Commissioner, commits an offence, carrying up to $10,000 on summary conviction and up to $100,000 on indictment.
Twenty-four months from the day you determine a breach of security safeguards occurred, whether or not it was reportable. That record is one of the first things an investigator asks for.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.