Canadian Privacy Program Operations
What this domain tests
Operations tests day-to-day execution: consent, access and correction requests, breach response, vendor oversight, marketing rules, retention, and employee data. Questions often hinge on timelines and documentation.
Core rules
- Consent: identify purposes at or before collection, use express consent for sensitive information, allow withdrawal, and do not bundle unrelated purposes. Quebec Law 25 requires clear, free, informed, and specific consent.
- Access requests: under PIPEDA and the Privacy Act, respond within 30 days; you may extend with notice in limited cases. Provide access, correct inaccurate information, and advise the requester of the complaint route.
- Breach response: contain, assess RROSH, report and notify where required, record the incident, and remediate. Quebec requires a confidentiality incident register.
- Vendor management: know where data is stored, conduct due diligence, contract for safeguards and breach notification, and monitor.
- Retention: destroy or anonymize personal information when no longer needed; keep breach records for 24 months under PIPEDA.
- CASL: commercial electronic messages need consent, sender identification, and a working unsubscribe mechanism honored within 10 business days.
Worked example
A customer asks for all personal data held about her and correction of an inaccurate address. The organization must respond within 30 days, provide a copy with any permitted redactions (for example, third-party information), correct the address, and if it refuses correction, note the dispute. It should charge only a minimal fee and tell her she may complain to the OPC. The vendor holding the data must assist; the organization remains responsible. Reasoning: access is an individual right, not a favour, and the clock starts when the request is received with sufficient detail.
Traps
Missing the 30-day deadline; charging excessive fees; denying access without a specific exemption; failing to correct or annotate; ignoring unsubscribe requests; treating a vendor as the accountable party; missing Quebec's incident register; sending marketing without a lawful basis.