PIPEDA & PHIPA Compliance Checklist

Know your data

You have a written list of the personal information you collect, from customers, donors, staff, and volunteers.
You know where each type of data lives: laptops, phones, cloud apps, email, paper files, and backups.
You have named the systems and vendors that store or process personal information on your behalf.
You can say why you hold each piece of data and drop anything you no longer need.
You know which of your data counts as health information, so you can apply the stricter PHIPA rules to it.

You have a plain-language privacy policy that says what you collect, why, and who you share it with.
You ask for consent at the point of collection, and you do not bury it in fine print.
People can withdraw consent, and you have a way to act on that request.
You only collect what you actually need for the stated purpose.
You have named a person who is accountable for privacy and whose contact details are public.

Accounts use strong passwords and multi-factor authentication on email, cloud apps, and admin tools.
Personal information is encrypted on devices and in transit.
Access is limited so staff and volunteers only see the data their role requires.
Devices and software get security updates on a regular schedule, and old accounts are removed when people leave.
You keep working backups and have tested that you can actually restore from them.
Your security work aligns to recognized guidance such as the CIS Controls and the NIST Cybersecurity Framework.

You can find and provide a person's own information if they ask to see it.
You can correct information that a person shows to be wrong.
You have a retention schedule that says how long each type of record is kept.
You delete or securely destroy personal information once its purpose and retention period are done.
You have a contract with each vendor that handles your data, covering how they protect and return or delete it.

You have a written plan for what to do if personal information is lost, stolen, or exposed.
You know that PIPEDA requires you to keep records of breaches and to notify affected people and the Privacy Commissioner when there is a real risk of significant harm.
You know who to call internally and externally, and in what order, when a breach happens.
You keep a log of security incidents, even the small ones you contained.
You review each incident afterward to fix the gap that let it happen.

You know whether you are a health information custodian or an agent acting for one under PHIPA.
You handle personal health information under stricter access, consent, and safeguard rules than ordinary personal data.
You keep an audit trail of who viewed or changed health records, and you review it.
You can meet PHIPA's breach duties, including notifying affected individuals and the Ontario Information and Privacy Commissioner when required.
If you use vendors for health data, you can keep that data on Canadian infrastructure when your obligations or your clients call for it.