CIPP/C case studies
CIPP/C · Put your knowledge to work in context.
The Certified Information Privacy Professional/Canada (CIPP/C) is a professional credential in the CIPP family of privacy certifications. IAPP describes itself as "a policy neutral, not-for-profit association founded in 2000 with a mission to define, promote and improve the professions of privacy, AI governance and digital responsibility globally." The CIPP/C designation is aimed at professionals whose work touches Canadian privacy obligations: privacy officers and counsel, compliance and risk staff, HR and marketing teams handling personal information, and consultants or vendors serving Canadian organizations. The CIPP/C case studies are 5 cases and about 4,108 words.
1The Montreal Fintech and the Ohio Verification Vendor
LumenPay is a Montreal-based payments fintech with 90 employees and 45,000 active users, 80% of them in Quebec. To speed up onboarding, it signed a three-year contract in January 2025 with VerifyCorp, an Ohio identity-verification vendor that will receive scans of driver's licences, social insurance numbers, income statements and selfie videos for every applicant.
837 words, about 4 min2The Overnight Laptop and the Curious Analyst
Northline Freight is a federally regulated courier with 3,000 employees and operations in Ontario, Manitoba and Nova Scotia. On a Friday, a regional sales manager's laptop was stolen from a locked car in Toronto.
830 words, about 4 min3The Merger Without a Privacy Officer
In 2025, Briarwood Outdoor (BC-based, 210 employees, 300,000 customers, subject to BC PIPA) acquired Kiln Software (Ontario-based, 60 employees, 8,000 business customers, PIPEDA). The combined company now has 15,000 Quebec customers, 90 third-party vendors (12 critical), a 90-day backlog of 40 access requests, and no designated privacy officer.
790 words, about 4 min4The Performance File and the 30-Day Clock
Priya is a senior account manager at a federally regulated bank in Toronto. After being placed on a performance improvement plan, she emails the privacy office requesting 'my complete employee file, including every email my manager sent about me, investigation notes, and the restructuring spreadsheet that shows my role is being eliminated.' The bank has 400 pages of responsive records: performance reviews, attendance notes, 60 pages of manager emails (some discussing other employees), 12 pages of legal advice from outside counsel about Priya's human-rights complaint, and a confidential commercial spreadsheet with client revenue projections.
841 words, about 4 min5The Pharmacy Vendor's Slow Breach
Calder Pharmacy Group operates 22 pharmacies in Alberta and one in BC. Its US-based billing vendor, MedBill, processes claims and stores patient records, including medication profiles, prescriber details and diagnosis codes, on servers in Texas.
810 words, about 4 min