Choose the VerifyPIA™ Privacy Assessment and Receive the Official Privacy Statement of Trust™
Independent evidence of privacy accountability, safeguards and responsible data handling.
What It Means To Verify™ Your Privacy
Privacy is not proved by a policy. It is proved by what an organization collects, why it collects it, who can access it, where it goes, how long it is kept and what happens when something goes wrong.
VerifyPIA™ is Managed Privacy Canada’s privacy assessment service based on the Verify™ methodology. It can review an existing Privacy Impact Assessment, privacy program, audit or policy set, or create new evidence through data-flow analysis, interviews, safeguard review, vendor assessment and compliance review.
What Are the Stages of a Standardized Privacy Impact Assessment (VerifyPIA™)?
VerifyPIA™ follows three stages.
Qualification
Confidential due diligence considers legitimacy, ethics, history, ownership and influence, Canadian operations, incidents, auditability, verifiability and association risk. The result is Go or No-Go.
Verification
Privacy documentation, data practices, PIAs, safeguards, vendors, key-person interviews and applicable obligations are reviewed. The private outputs are the report, Roadmap for Remediation™ and RMS.
Attestation
When the evidence supports the conclusion, the organization receives a Privacy Statement of Trust™ with three quarterly Checkpoints, professional support and agreed re-verification as data uses, vendors, systems or obligations change.
What Privacy Evidence is Required for a PIA?
- Accountability, designated privacy responsibilities and privacy-management practices.
- Personal-information inventories, records of processing and data-flow maps.
- Collection purposes, consent or other lawful authority, notices and transparency.
- Access, use, disclosure, retention, deletion and individual-rights processes.
- Administrative, technical and physical safeguards for personal information.
- PIAs for new or materially changed programs, technologies, data uses and vendors.
- Service-provider agreements, subprocessors, cross-border transfers and vendor oversight.
- Privacy incidents, breach response, notification practices, training and policy enforcement.
- Evidence relevant to PIPEDA and applicable provincial, sector-specific or international requirements, including Alberta PIPA, British Columbia PIPA, Quebec’s private-sector privacy law as amended by Law 25, health-information laws and the GDPR where applicable.
How is a VerifyPIA™ Better Than a Regular PIA?
A PIA evaluates the privacy effects of a specific initiative or material change. VerifyPIA™ can include that PIA, then assess the wider operating evidence: governance, safeguards, vendors, incidents, training and the privacy-management program. One is an important instrument. The other is the annual assurance process.
The Official MPC Privacy Statement Of Trust™ Attestation
The Privacy Statement of Trust™ is the signed, public-facing attestation available when the evidence supports the conclusion. It states the organization and reviewed scope, the basis of the work, the RMS, material conditions and limitations, the validity period and the authenticity path.
Printed certificate with a unique holographic authenticity seal.
Shareable PDF for customer diligence, procurement, board oversight, financing and compliance records.
LIVE BADGE
Clickable website badge that opens the current Privacy Statement of Trust™ or live verification record.
The attestation is supported for a defined annual period with three quarterly Checkpoints. Material changes to data use, vendors, systems, incidents or legal obligations can be reviewed during the year.
Why You Should Always Insist Upon Independent, Professional Verification of Privacy Practices
Privacy authorities expect organizations to remain accountable for personal information and maintain safeguards appropriate to sensitivity and risk. Independent review gives management a current, defensible basis for explaining what is actually in place.
Independent Verify™ Attestations Are Exclusively Available From
informatica.org
Cybersecurity risk assessment, security testing, control effectiveness, audit evidence and cyber-risk attestation.
datarisk.ca
Cybersecurity risk assessment, security testing, control effectiveness, audit evidence and cyber-risk attestation.
otsec.ca
Industrial and OT cybersecurity, cyber-physical resilience, supplier assurance and standards readiness.
VerifyPIA™ and Privacy Statement of Trust™ FAQ
Have a PIA or privacy program already? We can review the evidence. Need a new baseline? Start a VerifyPIA™ assessment.
Validate Privacy Evidence | Start VerifyPIA™ | Talk to a Privacy Risk Advisor