Canadian Privacy Program Development and Management
What this domain tests
Program development and management tests how you build governance, accountability, and risk controls that satisfy PIPEDA's Accountability principle and provincial requirements. The exam favors concrete program elements over security tools alone.
Core rules
- Appoint a privacy officer or person in charge; PIPEDA requires an individual accountable for compliance, and Quebec Law 25 requires a designated person in charge of personal information protection.
- Maintain a personal information inventory and data map: what you collect, why, where it flows, who can access it, and how long you keep it.
- Write policies and procedures covering consent, access, retention and destruction, vendor management, incident response, and employee privacy.
- Conduct privacy impact assessments (PIAs) before new projects, systems, or cross-border transfers; update them when processing changes.
- Apply privacy by design: proactive, default, embedded, full functionality, end-to-end security, visibility, and respect for users.
- Contract with processors: accountability stays with the organization, so use written terms, due diligence, and monitoring.
- Train staff, provide a complaint channel, audit compliance, and report program performance to senior management.
Worked example
A health-tech startup plans a patient portal hosted in the US. The privacy officer should first map the data flows, then complete a PIA covering the cross-border transfer and vendor access. The contract must limit the vendor's use, require safeguards and breach notice, and address return or destruction. The team updates the privacy notice, builds consent and access workflows, trains staff, and adds the vendor to the incident response plan. Reasoning: the program converts legal duties (accountability, consent, safeguards) into documented, repeatable controls; a vendor contract does not transfer accountability.
Traps
Treating the program as an IT security project; skipping the PIA because the project is internal; assuming a vendor contract outsources legal responsibility; leaving policies unoperational; failing to update after Law 25 or a change in data flows; having no senior-management reporting.