PIPEDA

Requirements and controls

• Part 1, Division 1 Protection of personal information

  • s. 5(3) Appropriate purposes

    Personal information is collected, used or disclosed only for purposes a reasonable person would consider appropriate in the circumstances.

    • Data Protection Impact Assessments
    • Personal Data Inventory
    • Data Protection Policy & Procedure

  • s. 6.1 Valid consent

    Consent is valid only if the people an activity is aimed at could reasonably be expected to understand the nature, purpose and consequences of what they are agreeing to.

    • Consent Management
    • Privacy Notices on Data Collection Forms

  • s. 8(3) Deadline for access requests

    Written access requests are answered with due diligence within 30 days, extendable by up to 30 more days with a notice giving the reason and the right to complain; no answer counts as a refusal, and refusals are explained in writing with the available recourse.

    • Data Subject Requests

• 4.1 Principle 1 — Accountability

  • 4.1.1 Designated accountable individual

    One or more designated individuals are accountable for compliance with the principles, even when others handle personal information day to day or act on their behalf.

    • Privacy Officer
    • Assigned Security & Privacy Responsibilities

  • 4.1.2 Identity of the accountable individual on request

    The identity of the person or people overseeing compliance is disclosed on request.

    • Privacy Officer
    • Published Privacy Policy

  • 4.1.3 Information transferred to third parties

    The organization stays responsible for personal information it passes to a third party for processing and uses contracts or other means to secure a comparable level of protection.

    • Processor Data Protection Agreements
    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments

  • 4.1.4 Policies and practices that apply the principles

    Policies and practices give effect to the principles, including procedures to protect personal information, to receive and answer complaints and inquiries, to train staff and to explain the organization's practices.

    • Data Protection Policy & Procedure
    • Privacy Grievance Redressal
    • Periodic Security & Privacy Training
    • Published Privacy Policy

• 4.2 Principle 2 — Identifying Purposes

  • 4.2.1 Documented purposes

    The purposes for which personal information is collected are documented.

    • Personal Data Inventory

  • 4.2.2 Purposes decide what is collected

    Purposes are identified before collection so the organization can work out which information it actually needs.

    • Personal Data Inventory
    • Privacy by Design Policy

  • 4.2.3 Purposes stated at collection

    Purposes should be explained to the individual at or before collection, orally or in writing, for example on an application form.

    • Privacy Notices on Data Collection Forms
    • Published Privacy Policy

  • 4.2.4 New purposes

    A purpose not identified earlier is identified before the information is used for it and, unless the law requires the use, needs the individual's consent.

    • Consent Management
    • Personal Data Inventory

  • 4.2.5 Staff able to explain purposes

    Staff who collect personal information should be able to explain to individuals why it is being collected.

    • Periodic Security & Privacy Training
    • New Hire Security & Privacy Training

• 4.3 Principle 3 — Consent

  • 4.3.1 Consent to collection, use and disclosure

    Consent is needed to collect personal information and for its later use or disclosure, usually sought at collection or, for a new use, before that use.

    • Consent Management
    • Privacy Notices on Data Collection Forms

  • 4.3.2 Meaningful consent

    Reasonable efforts are made to tell individuals the purposes in a way they can reasonably understand, so that their consent is meaningful.

    • Consent Management
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms

  • 4.3.3 No excessive consent as a condition of service

    Individuals are not required to consent to collection, use or disclosure beyond what explicitly stated, legitimate purposes need in order to obtain a product or service.

    • Consent Management
    • Privacy by Design Policy

  • 4.3.4 Form of consent reflects sensitivity

    The form of consent sought takes into account how sensitive the information is in its context.

    • Consent Management
    • Data Classification Labels

  • 4.3.5 Reasonable expectations and no deception

    Consent takes account of the individual's reasonable expectations and is never obtained through deception.

    • Consent Management
    • Privacy by Design Policy

  • 4.3.6 Express or implied consent

    Express consent should generally be sought for sensitive information and implied consent may suit less sensitive information, and an authorised representative can consent for someone.

    • Consent Management

  • 4.3.7 Ways of obtaining consent

    Consent can be obtained through forms, opt-out boxes, orally or through the use of a product or service, depending on the context.

    • Consent Management
    • Privacy Notices on Data Collection Forms

  • 4.3.8 Withdrawal of consent

    Individuals can withdraw consent at any time, subject to legal or contractual limits and reasonable notice, and are told what withdrawing will mean for them.

    • Consent Management
    • Data Subject Requests

• 4.4 Principle 4 — Limiting Collection

  • 4.4.1 Collecting only what is necessary

    Personal information is not collected indiscriminately; the amount and type are limited to what the identified purposes need, and the types collected are described in the organization's policies.

    • Personal Data Inventory
    • Privacy by Design Policy
    • Data Protection Policy & Procedure

  • 4.4.2 Fair and lawful collection

    Information is collected by fair and lawful means, without misleading or deceiving individuals about the purpose.

    • Data Protection Policy & Procedure
    • Privacy Notices on Data Collection Forms

• 4.5 Principle 5 — Limiting Use, Disclosure, and Retention

  • 4.5.1 Documenting new uses

    When personal information is used for a new purpose, that purpose is documented.

    • Personal Data Inventory

  • 4.5.2 Retention guidelines

    Retention guidelines with minimum and maximum periods should be in place, and information used to make a decision about someone is kept long enough for them to access it afterwards.

    • Data Retention Policy
    • Personal Data Inventory

  • 4.5.3 Destruction or anonymisation

    Personal information no longer needed should be destroyed, erased or made anonymous, following documented guidelines and procedures for destruction.

    • Data Retention Policy
    • Media Disposal Policy

• 4.6 Principle 6 — Accuracy

  • 4.6.1 Accuracy suited to the use

    Information is accurate, complete and current enough to minimise the risk of inappropriate information being used to make a decision about the individual.

    • Personal Data Inventory
    • Data Subject Requests

  • 4.6.2 No routine updating without a need

    Personal information is not updated routinely unless the purposes of collection require it.

    • Personal Data Inventory

  • 4.6.3 Information in ongoing use

    Information used on an ongoing basis, including information disclosed to third parties, should generally be kept accurate and up to date.

    • Personal Data Inventory
    • Data Subject Requests

• 4.7 Principle 7 — Safeguards

  • 4.7.1 Protection against loss and misuse

    Safeguards protect personal information in any format against loss, theft and unauthorised access, disclosure, copying, use or modification.

    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Production Database Access Restriction
    • Multi-Factor Authentication
    • Endpoint Encryption

  • 4.7.2 Protection matched to sensitivity

    The level of protection depends on the sensitivity, amount, distribution, format and storage of the information, with more sensitive information protected more strongly.

    • Data Classification Labels
    • Data Classification Policy
    • Risk Assessment

  • 4.7.3 Physical, organisational and technical measures

    Protection should combine physical measures such as restricted office access, organisational measures such as need-to-know access, and technical measures such as passwords and encryption.

    • Physical Protection Policy & Procedure
    • Access Control Policy & Procedure
    • User Privilege Reviews
    • Password Management Guidelines
    • Encryption of Data at Rest

  • 4.7.4 Staff awareness of confidentiality

    Employees are made aware of how important it is to keep personal information confidential.

    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training
    • New Hire Policy Acknowledgement

  • 4.7.5 Care in disposal

    Personal information is disposed of or destroyed with care so that unauthorised people cannot get to it.

    • Media Disposal Policy
    • Data Retention Policy

• 4.8 Principle 8 — Openness

  • 4.8.1 Openness about practices

    Information about how the organization manages personal information can be obtained without unreasonable effort and in a form that is generally understandable.

    • Published Privacy Policy
    • Conspicuous Privacy Notice Link

  • 4.8.2 What the published information covers

    The information includes the name or title and address of the accountable person, how to access personal information, the types held and how they are used, explanatory material on policies, and what is shared with related organizations.

    • Published Privacy Policy
    • Privacy Officer

  • 4.8.3 Ways of making information available

    The information may be offered through brochures, mailings, online access or a toll-free number, depending on the nature of the business.

    • Published Privacy Policy
    • Publishing Security & Privacy Documentation

• 4.9 Principle 9 — Individual Access

  • 4.9.1 Access to one's own information

    On request, individuals are told whether the organization holds personal information about them, given access to it, and given an account of its use and of the third parties it was disclosed to.

    • Data Subject Requests
    • Personal Data Inventory

  • 4.9.2 Information needed to answer a request

    Individuals may be asked for enough information to account for their data, and that information is used only for that purpose.

    • Data Subject Requests

  • 4.9.3 Account of third-party disclosures

    The account of disclosures to third parties is as specific as possible, or otherwise lists the organizations to which the information may have been disclosed.

    • Data Subject Requests
    • Personal Data Inventory

  • 4.9.4 Timely, low-cost and understandable answers

    Requests are answered within a reasonable time at minimal or no cost, in a generally understandable form with any codes or abbreviations explained.

    • Data Subject Requests

  • 4.9.5 Correcting inaccurate information

    When an individual shows that information is inaccurate or incomplete, it is corrected, deleted or completed, and the change is passed to third parties that have the information where appropriate.

    • Data Subject Requests

  • 4.9.6 Recording unresolved challenges

    When a challenge is not resolved to the individual's satisfaction, its substance is recorded and, where appropriate, shared with third parties that have the information.

    • Data Subject Requests
    • Privacy Grievance Redressal

• 4.10 Principle 10 — Challenging Compliance

  • 4.10.2 Complaint and inquiry procedures

    Simple, easily accessible procedures receive and answer complaints and inquiries about the organization's personal information practices.

    • Privacy Grievance Redressal
    • Incident Reporting Assistance
    • Privacy Officer

  • 4.10.3 Informing people of complaint procedures

    People who make inquiries or complaints are told about the relevant complaint procedures, including those of regulators.

    • Privacy Grievance Redressal
    • Published Privacy Policy

  • 4.10.4 Investigating complaints

    Every complaint is investigated, and a justified complaint leads to appropriate measures, including changes to policies and practices where needed.

    • Privacy Grievance Redressal

• Part 1, Division 1.1 Breaches of security safeguards

  • s. 10.1(1) Reporting breaches to the Commissioner

    Any breach of security safeguards that creates a real risk of significant harm is reported to the Privacy Commissioner as soon as feasible, in writing, with the content the Breach of Security Safeguards Regulations require.

    • Breach Risk Assessment & Notification
    • Data Breach Notification Policy
    • PII Breach Notification Guidelines

  • s. 10.1(3) Notifying affected individuals

    Affected individuals are notified directly and conspicuously, as soon as feasible, of a breach creating a real risk of significant harm, with enough information to understand its significance and reduce the harm, and indirect notice is used only in the cases the Regulations allow.

    • Breach Risk Assessment & Notification
    • PII Breach Notification Guidelines
    • Data Breach Notification Policy

  • s. 10.1(8) Assessing real risk of significant harm

    Whether a breach creates a real risk of significant harm is judged on the sensitivity of the information and the likelihood of misuse, covering harms such as humiliation, damage to reputation, financial loss and identity theft.

    • Breach Risk Assessment & Notification
    • Incident Management Policy & Procedure

  • s. 10.2(1) Notifying other organizations

    When individuals are notified, other organizations or government institutions that may be able to reduce or mitigate the harm are notified as soon as feasible.

    • Breach Risk Assessment & Notification
    • Incident Management Policy & Procedure

  • s. 10.3 Records of breaches

    A record of every breach of security safeguards is kept for 24 months after the breach is determined, with enough detail to check reporting decisions, and is provided to the Commissioner on request.

    • Incident Tracking
    • Breach Risk Assessment & Notification