01 · 13 artifacts

Governance and accountability

Who owns privacy and how decisions get made.

M
GDPRTUK GDPRTPIPEDAMLaw 25MPOPIAMCCPAONote
GDPR · T
Art 37 public authority; large-scale regular and systematic monitoring; or large-scale special category / criminal data
UK GDPR · T
Art 37 public authority; large-scale regular and systematic monitoring; or large-scale special category / criminal data
PIPEDA · M
Principle 4.1 designate an individual accountable for compliance
Law 25 · M
s. 3.1 the person with the highest authority is the person in charge by default, and can delegate in writing
POPIA · M
s. 55 the head of the organisation is the Information Officer by default; s. 56 deputies designated in writing
CCPA · O
No statutory role; someone still has to own request handling and §7100 training
POPIA makes the head of the organisation, usually the CEO, the Information Officer by default, and Law 25 does the same with its person in charge. A GDPR or UK GDPR DPO can't hold a role that decides why and how personal data is processed (Art 38(6); CJEU X-FAB, C-453/21), so your CEO can't be your DPO. If you need both, keep the CEO as Information Officer, designate the DPO as a Deputy Information Officer (POPIA s. 56), and delegate the Law 25 role to them in writing (s. 3.1).
M
GDPRMUK GDPRMPIPEDAALaw 25MPOPIAM
GDPR · M
Art 37(7), once a DPO is appointed publish contact details and notify the SA
UK GDPR · M
Art 37(7), once a DPO is appointed publish contact details and tell the ICO
PIPEDA · A
Principle 4.1.2 identity made known on request; put the contact in the privacy policy
Law 25 · M
s. 3.1 publish the title and contact details on the website
POPIA · M
s. 55(2) register the Information Officer with the Information Regulator before they take up duties
A
GDPRAUK GDPRA
GDPR · A
Art 5(2) record the decision even when no DPO is required
UK GDPR · A
Art 5(2) record the decision even when no DPO is required
T
GDPRTUK GDPRT
GDPR · T
Art 27 no EU establishment, but targeting or monitoring people in the EU; exemption for occasional, low-risk processing
UK GDPR · T
Art 27 no UK establishment, but targeting or monitoring people in the UK; exemption for occasional, low-risk processing
T
GDPR onlyT
GDPR · T
Art 56 establishments in more than one member state (one-stop shop)
M
UK GDPR onlyM
UK GDPR · M
Data Protection (Charges and Information) Regulations 2018, unless exempt
M
GDPRAUK GDPRAPIPEDAMLaw 25MPOPIAACCPAA
GDPR · A
Art 24(2) "where proportionate", which in practice means always
UK GDPR · A
Art 24(2) "where proportionate", which in practice means always
PIPEDA · M
Principle 4.1.4(a) implement policies and practices to protect personal information
Law 25 · M
s. 3.2 governance policies and practices, approved by the person in charge
POPIA · A
s. 8 accountability; Reg 4(1)(a) compliance framework
CCPA · A
Needed to evidence request handling, contracts and reasonable security (§1798.100(e))
M
GDPRAUK GDPRAPIPEDAALaw 25APOPIAMCCPAO
GDPR · A
Art 24, Art 5(2) scope, ownership, reporting lines, review cycle
UK GDPR · A
Art 24, Art 5(2) scope, ownership, reporting lines, review cycle
PIPEDA · A
Principle 4.1; the OPC's accountability guidance expects a documented program
Law 25 · A
s. 3.2
POPIA · M
Reg 4(1)(a) develop, implement, monitor and continuously improve a compliance framework
CCPA · O
Good practice
M
GDPRAUK GDPRAPIPEDAALaw 25MPOPIAACCPAO
GDPR · A
Art 24, Art 5(2)
UK GDPR · A
Art 24, Art 5(2)
PIPEDA · A
Principle 4.1 others can handle day-to-day work, but accountability stays with the designated individual
Law 25 · M
s. 3.2 roles and responsibilities of staff through the information life cycle
POPIA · A
s. 8; ss. 55–56
CCPA · O
Good practice
M
GDPRAUK GDPRAPIPEDAMLaw 25APOPIAMCCPAM
GDPR · A
Art 39(1)(b), Art 32(4)
UK GDPR · A
Art 39(1)(b), Art 32(4)
PIPEDA · M
Principle 4.1.4(c) train staff on policies and practices
Law 25 · A
s. 3.2; the CAI expects staff awareness activities
POPIA · M
Reg 4(1)(e) internal awareness sessions
CCPA · M
§1798.130(a)(6); Regs §7100 staff handling consumer requests must know the rules
T
GDPR onlyT
GDPR · T
AI Act Art 4 (as amended by the AI Omnibus) providers and deployers of AI systems take measures to support staff AI literacy
O
All 6 lawsO
GDPR · O
Supports review evidence under Art 24(1)
UK GDPR · O
Supports review evidence under Art 24(1)
PIPEDA · O
Supports the review cycle
Law 25 · O
Supports the review cycle
POPIA · O
Supports continuous improvement under Reg 4(1)(a)
CCPA · O
Supports the annual privacy policy update
O
All 6 lawsO
GDPR · O
Shows oversight at the top
UK GDPR · O
Shows oversight at the top
PIPEDA · O
Shows oversight at the top
Law 25 · O
Shows oversight at the top
POPIA · O
Shows oversight at the top
CCPA · O
Risk assessments and cybersecurity audits are certified by an executive

02 · 10 artifacts

Inventory, purposes and retention

What you hold, why you hold it, and for how long.

M
GDPRMUK GDPRMPIPEDAALaw 25APOPIAMCCPAA
GDPR · M
Art 30(1) controller; Art 30(2) processor. The Art 30(5) under-250-employee exemption is narrow enough to ignore in practice
UK GDPR · M
Art 30(1) controller; Art 30(2) processor. The under-250-employee exemption is narrow enough to ignore in practice
PIPEDA · A
Principle 4.1; the OPC's accountability guidance expects a personal information inventory
Law 25 · A
s. 3.2; an inventory is the practical basis for PIAs, access requests and retention
POPIA · M
s. 17 keep documentation of all processing operations (as referred to in PAIA ss. 14 and 51)
CCPA · A
The privacy policy must list categories, sources, purposes and recipients (§1798.110, Regs §7011); an inventory is how you get that right
O
All 6 lawsO
GDPR · O
Makes the RoPA and TIAs defensible
UK GDPR · O
Makes the RoPA and TIAs defensible
PIPEDA · O
Makes the inventory and cross-border disclosures defensible
Law 25 · O
Makes PIAs and s. 17 assessments defensible
POPIA · O
Makes the documentation and transfer analysis defensible
CCPA · O
Shows where sale or sharing happens
M
GDPRAUK GDPRAPIPEDAMLaw 25APOPIAACCPAA
GDPR · A
Art 6, per purpose; can sit in the RoPA
UK GDPR · A
Art 6, per purpose; can sit in the RoPA
PIPEDA · M
Principle 4.2.1 document the purposes for which information is collected
Law 25 · A
ss. 4–5 determine purposes before collecting; collect only what's necessary
POPIA · A
s. 11 a justification for every processing operation
CCPA · A
§1798.100(c) collection and use reasonably necessary and proportionate to the disclosed purposes
T
GDPRTUK GDPRTPOPIAT
GDPR · T
Reliance on Art 6(1)(f)
UK GDPR · T
Reliance on Art 6(1)(f); record reliance on a DUAA "recognised legitimate interest" (Annex 1) instead where one applies
POPIA · T
s. 11(1)(f) relying on legitimate interests
A
GDPRTUK GDPRTPIPEDAALaw 25APOPIATCCPAT
GDPR · T
Art 7(1) consent must be demonstrable
UK GDPR · T
Art 7(1) consent must be demonstrable
PIPEDA · A
Principle 4.3; OPC Guidelines for obtaining meaningful consent
Law 25 · A
ss. 12–14 consent must be manifest, free, enlightened and specific, and requested separately
POPIA · T
s. 11(2)(a) you carry the burden of proving consent
CCPA · T
Opt-in consent for financial incentives, selling minors' data, or re-opting in after an opt-out (Regs §7004)
T
All 6 lawsT
GDPR · T
Art 9 / Art 10 processing
UK GDPR · T
Art 9 / Art 10 processing
PIPEDA · T
Principle 4.3.6 sensitive information generally needs express consent
Law 25 · T
s. 12 sensitive information needs express consent
POPIA · T
ss. 26–33 special personal information needs a listed authorisation
CCPA · T
§1798.121 sensitive personal information used beyond permitted purposes triggers the right to limit
T
UK GDPR onlyT
UK GDPR · T
DPA 2018 Sch 1 Pt 4, when relying on most Sch 1 conditions such as employment or substantial public interest
T
All 6 lawsT
GDPR · T
Art 6(4)
UK GDPR · T
Art 6(4) and the DUAA's Annex 2 list of compatible purposes
PIPEDA · T
Principle 4.2.4 identify a new purpose before use, and get consent unless an exception applies
Law 25 · T
s. 12 a new purpose needs consent unless a listed exception applies
POPIA · T
s. 15 further processing must be compatible with the original purpose
CCPA · T
§1798.100(c), Regs §7002 new purposes must be compatible with the context of collection
M
GDPRAUK GDPRAPIPEDAALaw 25MPOPIAACCPAA
GDPR · A
Art 5(1)(e); Art 13(2)(a) puts periods in notices, so effectively mandatory
UK GDPR · A
Art 5(1)(e); Art 13(2)(a) puts periods in notices, so effectively mandatory
PIPEDA · A
Principles 4.5.2–4.5.3 retention guidelines with minimum and maximum periods; destroy or anonymise when no longer needed
Law 25 · M
s. 3.2 governance policies must cover retention and destruction; s. 23 destroy or anonymise
POPIA · A
s. 14 keep no longer than necessary; destroy, delete or de-identify
CCPA · A
§1798.100(a)(3) notices must state how long you keep each category, so you need the schedule behind them
T
Law 25 onlyT
Law 25 · T
s. 23 and the Regulation respecting the anonymization of personal information: when anonymising instead of destroying

03 · 12 artifacts

Transparency

Several notices, one per audience.

M
All 6 lawsM
GDPR · M
Art 13 / 14
UK GDPR · M
Art 13 / 14
PIPEDA · M
Principle 4.8 make policies and practices readily available, in practice a website privacy policy
Law 25 · M
ss. 7–8.2 inform at collection; publish a privacy policy when collecting by technological means
POPIA · M
s. 18 tell people what you collect, why, and their rights
CCPA · M
§1798.130(a)(5), Regs §7011 privacy policy updated every 12 months; CalOPPA for any commercial website
M
GDPROUK GDPROPIPEDAALaw 25OPOPIAOCCPAM
GDPR · O
Improves clarity at the point of collection
UK GDPR · O
Improves clarity at the point of collection
PIPEDA · A
OPC meaningful consent guidelines emphasise key elements at the point of collection
Law 25 · O
s. 8 clear and simple terms at the point of collection
POPIA · O
Improves clarity at the point of collection
CCPA · M
§1798.100(a), Regs §7012 notice at collection, at or before the point of collection
M
GDPRMUK GDPRMPIPEDATLaw 25MPOPIAMCCPAM
GDPR · M
Art 13 any staff or recruitment
UK GDPR · M
Art 13 any staff or recruitment
PIPEDA · T
Federally regulated employers only (s. 4(1)(b)); other employers follow provincial law
Law 25 · M
s. 8 applies to employee and candidate information
POPIA · M
s. 18 any staff or recruitment
CCPA · M
Regs §7012 employees, applicants and contractors are consumers (since 1 January 2023)
M
GDPRMUK GDPRMPOPIAMCCPAM
GDPR · M
Art 13 / 14 processing business contact data
UK GDPR · M
Art 13 / 14 processing business contact data
POPIA · M
s. 18 companies and their staff are data subjects under POPIA too
CCPA · M
B2B contacts are consumers (since 1 January 2023)
T
GDPRTUK GDPRTPOPIAT
GDPR · T
Art 14 data obtained from third parties or public sources
UK GDPR · T
Art 14 data obtained from third parties or public sources
POPIA · T
s. 18(1)–(2) information collected from other sources
M
Law 25 onlyM
Law 25 · M
s. 3.2 publish detailed information about the governance policies in clear and simple terms
M
POPIA onlyM
POPIA · M
PAIA s. 51 compile, publish and update a manual (all private bodies since 1 January 2022)
T
CCPA onlyT
CCPA · T
§1798.125(b), Regs §7016 loyalty programs, discounts or other incentives tied to personal information
T
All 6 lawsTNote
GDPR · T
ePrivacy Art 5(3) and national implementations consent for non-essential storage and access
UK GDPR · T
PECR reg 6 consent for non-essential cookies; the DUAA added exemptions for some analytics and functionality cookies
PIPEDA · T
Online tracking and behavioural advertising OPC guidance expects clear notice and an easy opt-out, and express consent for sensitive tracking
Law 25 · T
s. 8.1 technology that identifies, locates or profiles people must be off by default and disclosed
POPIA · T
Online tracking needs a s. 11 justification and s. 18 notice; there's no cookie-specific rule
CCPA · T
Ad and cross-site tracking can be "sharing" (§1798.140(ah)); disclose it and honour opt-outs
Covering more than one jurisdiction? Use a consent management platform (CMP) that applies each region's rules automatically: opt-in where the law requires it, opt-out links and Global Privacy Control in California.
T
GDPR onlyT
GDPR · T
AI Act Art 50 tell people they're interacting with AI and label deepfakes (from 2 August 2026); machine-readable marking of generated content from 2 December 2026
T
GDPRTUK GDPRTPIPEDATLaw 25TPOPIAT
GDPR · T
Video surveillance; EDPB Guidelines 3/2019
UK GDPR · T
Video surveillance; ICO video surveillance guidance
PIPEDA · T
Video surveillance; OPC guidance on overt video surveillance
Law 25 · T
Video surveillance; CAI guidance
POPIA · T
Video surveillance s. 18 notice
T
GDPRTUK GDPRT
GDPR · T
Art 26(2)
UK GDPR · T
Art 26(2)

04 · 9 artifacts

Individual rights

Requests answered on time and on the record.

M
GDPRAUK GDPRAPIPEDAALaw 25APOPIAMCCPAM
GDPR · A
Art 12(3) facilitate rights, respond within one month
UK GDPR · A
Art 12(3) respond within one month; the DUAA limits searches to what's reasonable and proportionate
PIPEDA · A
s. 8 respond to access requests within 30 days; Principle 4.9
Law 25 · A
ss. 27–32 respond within 30 days; includes portability (s. 27) and de-indexing (s. 28.1)
POPIA · M
Reg 4(1)(d) internal measures and systems to process requests; ss. 23–25
CCPA · M
§1798.130(a)(1)–(2) two or more request methods; respond within 45 days
M
GDPRAUK GDPRAPIPEDAALaw 25APOPIAACCPAM
GDPR · A
Art 5(2) evidence of timeliness and outcomes
UK GDPR · A
Art 5(2) evidence of timeliness and outcomes
PIPEDA · A
Evidence of timeliness and outcomes
Law 25 · A
Evidence of timeliness and outcomes
POPIA · A
Evidence of timeliness and outcomes
CCPA · M
Regs §7101 keep request records for 24 months
M
GDPRAUK GDPRAPIPEDAALaw 25APOPIAACCPAM
GDPR · A
Art 12(6)
UK GDPR · A
Art 12(6)
PIPEDA · A
Principle 4.9 confirm identity before giving access
Law 25 · A
ss. 30–32 confirm the requester is entitled to the information
POPIA · A
s. 23(1) adequate proof of identity
CCPA · M
Regs §§7060–7062 a documented, reasonable verification method
O
All 6 lawsO
GDPR · O
Consistency; supports defensible refusals
UK GDPR · O
Consistency; supports defensible refusals
PIPEDA · O
Consistency; supports defensible refusals
Law 25 · O
Consistency; supports defensible refusals
POPIA · O
Consistency; supports defensible refusals
CCPA · O
Consistency; supports defensible refusals
A
POPIA onlyA
POPIA · A
PAIA ss. 53–56 requests on the prescribed form, decided within 30 days
M
UK GDPRMPIPEDAMLaw 25MPOPIAO
UK GDPR · M
DPA 2018 s. 164A (DUAA, from 19 June 2026) make it easy to complain, acknowledge within 30 days, respond without undue delay
PIPEDA · M
Principle 4.10.2 procedures to receive and respond to complaints and inquiries
Law 25 · M
s. 3.2 governance policies must include a complaints process
POPIA · O
Complaints go to the Regulator under s. 74; resolving them internally first is good practice
T
CCPA onlyT
CCPA · T
§§1798.120, 1798.121, 1798.135 selling or sharing personal information, or using sensitive information beyond permitted purposes
T
CCPA onlyT
CCPA · T
Regs §7025 honour opt-out preference signals such as Global Privacy Control where you sell or share
T
GDPRTUK GDPRTLaw 25TPOPIATCCPAT
GDPR · T
Art 22 decisions based solely on automated processing with legal or similarly significant effects
UK GDPR · T
Arts 22A–22D (DUAA) significant decisions based solely on automated processing need information, human intervention and a way to contest
Law 25 · T
s. 12.1 tell the person about decisions based exclusively on automated processing, and let them submit observations
POPIA · T
s. 71 decisions based solely on automated processing with legal or substantial effects
CCPA · T
Regs §§7200–7222 pre-use notice, opt-out and access for ADMT used in significant decisions, from 1 January 2027

05 · 10 artifacts

Privacy by design and risk

Assess new processing before it goes live.

A
GDPRAUK GDPRAPIPEDAOLaw 25APOPIAACCPAA
GDPR · A
Art 35
UK GDPR · A
Art 35
PIPEDA · O
The OPC recommends privacy impact assessments; not a statutory duty for the private sector
Law 25 · A
s. 3.3
POPIA · A
Reg 4(1)(b)
CCPA · A
Regs §7150 you need a way to spot processing that triggers a risk assessment
M
GDPRTUK GDPRTPIPEDAOLaw 25TPOPIAMCCPAT
GDPR · T
Art 35 likely high risk; check the relevant SA's mandatory list
UK GDPR · T
Art 35 likely high risk; check the ICO's mandatory list
PIPEDA · O
The OPC recommends PIAs for new or high-risk initiatives; not a statutory duty for the private sector
Law 25 · T
s. 3.3 acquiring, developing or overhauling an information system or electronic service delivery involving personal information
POPIA · M
Reg 4(1)(b) a personal information impact assessment to confirm the conditions for lawful processing are met
CCPA · T
Regs §§7150–7157 risk assessment before selling or sharing, processing sensitive information, ADMT for significant decisions, and certain profiling or AI training. Processing ongoing at 1 January 2026 must be assessed by 31 December 2027
T
GDPRTUK GDPRT
GDPR · T
Art 36 residual risk remains high after mitigation
UK GDPR · T
Art 36 residual risk remains high after mitigation
T
POPIA onlyT
POPIA · T
ss. 57–58 unique identifiers used for new purposes, criminal or credit information processed for third parties, special or children's information sent to countries without adequate protection. Apply before processing
T
CCPA onlyT
CCPA · T
Regs §7157 annual submission of risk assessment information to the CPPA; first due 1 April 2028
A
GDPRAUK GDPRAPIPEDAOLaw 25APOPIAOCCPAO
GDPR · A
Art 25
UK GDPR · A
Art 25
PIPEDA · O
Good practice; supports Principles 4.4 (limiting collection) and 4.7
Law 25 · A
s. 3.3 privacy built into system projects from the start
POPIA · O
Good practice; supports s. 19
CCPA · O
Good practice
T
Law 25 onlyT
Law 25 · T
s. 9.1 technology products and services offered to the public default to the highest level of confidentiality (cookies excluded)
A
All 6 lawsA
GDPR · A
Art 24, Art 32
UK GDPR · A
Art 24, Art 32
PIPEDA · A
Principles 4.1 and 4.7
Law 25 · A
s. 10 measures reasonable given sensitivity, purpose, quantity, distribution and medium
POPIA · A
s. 19(2)(a)
CCPA · A
Supports risk assessments and reasonable security
O
All 6 lawsO
GDPR · O
Prerequisite for AI Act risk classification
UK GDPR · O
Supports DPIAs and ADM safeguards for AI tools
PIPEDA · O
Supports consent, transparency and safeguards for AI tools
Law 25 · O
Supports s. 12.1 automated decision notices
POPIA · O
Supports s. 71 automated decision safeguards
CCPA · O
Prerequisite for identifying ADMT in significant decisions
T
GDPR onlyT
GDPR · T
AI Act Art 27 certain deployers of high-risk AI (public services, credit scoring, life and health insurance); Annex III obligations apply from 2 December 2027

06 · 7 artifacts

Vendors and third parties

Every vendor gets a contract and a check.

M
All 6 lawsM
GDPR · M
Art 28(3), whenever a processor is used
UK GDPR · M
Art 28(3), whenever a processor is used
PIPEDA · M
Principle 4.1.3 contractual or other means to give comparable protection when a third party processes information for you
Law 25 · M
s. 18.3 written contract with anyone receiving information to perform a mandate or service
POPIA · M
s. 21(1) written contract requiring operators to maintain security measures
CCPA · M
§1798.100(d), Regs §§7051, 7053 contracts with service providers, contractors and third parties
A
All 6 lawsA
GDPR · A
Art 28(1) "sufficient guarantees"
UK GDPR · A
Art 28(1) "sufficient guarantees"
PIPEDA · A
Principle 4.1.3
Law 25 · A
s. 18.3
POPIA · A
s. 21
CCPA · A
Regs §7051(e) due diligence affects whether you can rely on the contract
A
All 6 lawsA
GDPR · A
Supports RoPA recipients and transfer mapping
UK GDPR · A
Supports RoPA recipients and transfer mapping
PIPEDA · A
Supports Principle 4.1.3 and cross-border transparency
Law 25 · A
Supports s. 18.3 contracts and s. 17 transfer assessments
POPIA · A
Supports s. 21 contracts and s. 72 transfer analysis
CCPA · A
Supports the privacy policy's recipient categories
T
GDPRTUK GDPRT
GDPR · T
Art 26 two or more controllers jointly determine purposes and means
UK GDPR · T
Art 26 two or more controllers jointly determine purposes and means
A
GDPROUK GDPRA
GDPR · O
Good practice
UK GDPR · A
The ICO Data Sharing Code is a statutory code
T
All 6 lawsT
GDPR · T
Organisation acts as a processor
UK GDPR · T
Organisation acts as a processor
PIPEDA · T
Organisation processes information on behalf of clients
Law 25 · T
Organisation performs mandates or services for clients
POPIA · T
Organisation acts as an operator (s. 20)
CCPA · T
Organisation acts as a service provider or contractor
T
GDPRTUK GDPRTPIPEDAOLaw 25OPOPIAOCCPAO
GDPR · T
Organisation acts as a processor; Art 28(2)
UK GDPR · T
Organisation acts as a processor; Art 28(2)
PIPEDA · O
Customers will ask; no statutory duty
Law 25 · O
Customers will ask; no statutory duty
POPIA · O
Customers will ask; no statutory duty
CCPA · O
Customers will ask; CCPA contracts restrict onward engagement

07 · 9 artifacts

International transfers

A mechanism and an assessment for each route.

M
GDPRMUK GDPRMPIPEDAALaw 25APOPIAA
GDPR · M
Art 30(1)(e) transfers must be recorded in the RoPA
UK GDPR · M
Art 30(1)(e) transfers must be recorded in the RoPA
PIPEDA · A
OPC cross-border processing guidelines tell people their information may be processed outside Canada
Law 25 · A
s. 17
POPIA · A
s. 72
T
GDPRTUK GDPRT
GDPR · T
Art 45; check EU-US DPF certification per recipient. The UK (renewed to 2031) and Canada (PIPEDA-covered data) hold adequacy
UK GDPR · T
UK adequacy regulations; check UK Extension to the EU-US DPF certification per recipient
T
GDPR onlyT
GDPR · T
Art 46(2)(c), no adequacy
T
UK GDPR onlyT
UK GDPR · T
Art 46, no UK adequacy regulations
T
Law 25TPOPIAT
Law 25 · T
s. 17 written agreement taking the assessment's results into account
POPIA · T
s. 72(1)(a) binding agreement with adequate protection
T
GDPRTUK GDPRTLaw 25TPOPIAT
GDPR · T
Reliance on an Art 46 tool
UK GDPR · T
Reliance on an Art 46 tool; applies the DUAA "data protection test" (not materially lower)
Law 25 · T
s. 17 assess privacy before communicating information outside Quebec; the information must be adequately protected
POPIA · T
s. 72(1)(a) the recipient must be bound by law, binding corporate rules or an agreement giving adequate protection
T
GDPRTUK GDPRT
GDPR · T
Groups transferring between entities; contractual wrapper for SCCs, can carry Art 28 / 26 terms
UK GDPR · T
Groups transferring between entities; contractual wrapper for the IDTA or Addendum, can carry Art 28 / 26 terms
O
GDPROUK GDPROPOPIAO
GDPR · O
Art 47 large groups with high intragroup transfer volume
UK GDPR · O
Art 47 large groups with high intragroup transfer volume
POPIA · O
s. 72(1)(a) binding corporate rules
T
GDPRTUK GDPRTPOPIAT
GDPR · T
Art 49 occasional transfers with no Art 45 / 46 basis
UK GDPR · T
Art 49 occasional transfers with no Art 45 / 46 basis
POPIA · T
s. 72(1)(b)–(e) consent, contract necessity or the data subject's benefit

08 · 7 artifacts

Security

Appropriate to the risk, with testing evidence.

A
All 6 lawsA
GDPR · A
Art 32
UK GDPR · A
Art 32
PIPEDA · A
Principle 4.7
Law 25 · A
s. 10
POPIA · A
s. 19
CCPA · A
§1798.100(e); Civ. Code §1798.81.5 reasonable security procedures
M
GDPRMUK GDPRM
GDPR · M
Art 30(1)(g) general description in the RoPA
UK GDPR · M
Art 30(1)(g) general description in the RoPA
A
All 6 lawsA
GDPR · A
Art 32(1)
UK GDPR · A
Art 32(1)
PIPEDA · A
Principle 4.7.3 physical, organisational and technological measures
Law 25 · A
s. 10
POPIA · A
s. 19(1)
CCPA · A
§1798.81.5
M
GDPRAUK GDPRAPIPEDAALaw 25APOPIAMCCPAA
GDPR · A
Art 32(2)
UK GDPR · A
Art 32(2)
PIPEDA · A
Principle 4.7 safeguards appropriate to sensitivity
Law 25 · A
s. 10
POPIA · M
s. 19(2)(a) identify all reasonably foreseeable internal and external risks
CCPA · A
§1798.81.5
A
All 6 lawsA
GDPR · A
Art 32(1)(a)–(b)
UK GDPR · A
Art 32(1)(a)–(b)
PIPEDA · A
Principle 4.7.3
Law 25 · A
s. 10
POPIA · A
s. 19(2)(b)
CCPA · A
§1798.81.5
A
GDPRAUK GDPRAPIPEDAOLaw 25OPOPIAOCCPAO
GDPR · A
Art 32(1)(c) ability to restore availability
UK GDPR · A
Art 32(1)(c) ability to restore availability
PIPEDA · O
Good practice
Law 25 · O
Good practice
POPIA · O
Good practice
CCPA · O
Good practice
M
GDPRAUK GDPRAPIPEDAALaw 25APOPIAMCCPAA
GDPR · A
Art 32(1)(d) regularly test and evaluate
UK GDPR · A
Art 32(1)(d) regularly test and evaluate
PIPEDA · A
Principle 4.7
Law 25 · A
s. 10
POPIA · M
s. 19(2)(c) regularly verify that safeguards are effectively implemented
CCPA · A
§1798.81.5; also evidence for a cybersecurity audit

09 · 7 artifacts

Breach management

Log every incident and know each regulator's clock.

A
All 6 lawsA
GDPR · A
Arts 33–34
UK GDPR · A
Arts 33–34
PIPEDA · A
ss. 10.1–10.3
Law 25 · A
ss. 3.5–3.8
POPIA · A
s. 22
CCPA · A
§1798.82
M
GDPRMUK GDPRMPIPEDAMLaw 25MPOPIAA
GDPR · M
Art 33(5) all breaches, facts, effects and remedial action
UK GDPR · M
Art 33(5) all breaches, facts, effects and remedial action
PIPEDA · M
s. 10.3 record every breach of security safeguards; keep records 24 months (Breach of Security Safeguards Regulations s. 6)
Law 25 · M
s. 3.8 register every confidentiality incident; keep entries five years (Regulation respecting confidentiality incidents)
POPIA · A
Supports s. 22 notifications and Regulator queries
T
All 6 lawsTNote
GDPR · T
Art 33 within 72 hours, unless unlikely to result in risk
UK GDPR · T
Art 33 within 72 hours, unless unlikely to result in risk
PIPEDA · T
s. 10.1(1) real risk of significant harm; report to the OPC as soon as feasible
Law 25 · T
s. 3.5 risk of serious injury; notify the CAI promptly
POPIA · T
s. 22 notify the Regulator as soon as reasonably possible, through the eServices portalCybercrimes Act 19 of 2020, s. 54: once in force, electronic communications service providers and financial institutions must report certain cyber offences to SAPS within 72 hours and preserve evidence. Not yet proclaimed as at October 2026; build the reporting route now if you're in those sectors.
CCPA · T
§1798.82(f) sample notice to the Attorney General within 15 days of notifying residents, when more than 500 are affected
T
All 6 lawsT
GDPR · T
Art 34 high risk to individuals
UK GDPR · T
Art 34 high risk to individuals
PIPEDA · T
s. 10.1(3) real risk of significant harm
Law 25 · T
s. 3.5 risk of serious injury
POPIA · T
s. 22 notify affected data subjects unless their identity can't be established
CCPA · T
§1798.82 notify affected residents within 30 calendar days of discovery (since 1 January 2026)
T
PIPEDATLaw 25O
PIPEDA · T
s. 10.2 notify organisations that can reduce the risk of harm
Law 25 · O
s. 3.5 allows notifying anyone able to reduce the risk
M
GDPRMUK GDPRMPIPEDAALaw 25MPOPIAMCCPAM
GDPR · M
Art 28(3)(f) / Art 33(2), inside the DPA
UK GDPR · M
Art 28(3)(f) / Art 33(2), inside the DPA
PIPEDA · A
Principle 4.1.3 contracts should require processors to report breaches
Law 25 · M
s. 18.3 the contract must require notice of any confidentiality breach without delay
POPIA · M
s. 21(2) operators must notify you immediately of a compromise
CCPA · M
§1798.82(b) anyone maintaining data for you must notify you immediately
T
UK GDPR onlyT
UK GDPR · T
PECR reg 5A telecom and internet service providers notify the ICO within 24 hours

10 · 5 artifacts

Monitoring and assurance

Review on a cycle and keep the evidence.

A
GDPRAUK GDPRAPIPEDAALaw 25APOPIAACCPAO
GDPR · A
Art 24(1) review and update measures
UK GDPR · A
Art 24(1) review and update measures
PIPEDA · A
Principle 4.1; the OPC's accountability guidance expects ongoing assessment
Law 25 · A
s. 3.2
POPIA · A
Reg 4(1)(a) monitor and continuously improve
CCPA · O
Good practice
A
GDPRAUK GDPRAPIPEDAOLaw 25OPOPIAO
GDPR · A
Art 38(3), where a DPO exists
UK GDPR · A
Art 38(3), where a DPO exists
PIPEDA · O
Shows the accountable individual is informed
Law 25 · O
Shows the person in charge is informed
POPIA · O
Shows the Information Officer is informed
T
CCPA onlyT
CCPA · T
Regs §§7120–7124 annual independent audit where processing presents significant security risk; first certifications due 1 April 2028, 2029 or 2030 by revenue
O
All 6 lawsO
GDPR · O
Tracks regulator interactions and commitments
UK GDPR · O
Tracks regulator interactions and commitments
PIPEDA · O
Tracks regulator interactions and commitments
Law 25 · O
Tracks regulator interactions and commitments
POPIA · O
Tracks regulator interactions and commitments
CCPA · O
Tracks regulator interactions and commitments
O
All 6 lawsO
GDPR · O
Art 40 / 42
UK GDPR · O
Art 40 / 42
PIPEDA · O
Voluntary
Law 25 · O
Voluntary
POPIA · O
Chapter 7 codes of conduct
CCPA · O
Voluntary

11 · 9 artifacts

Situational triggers

Scope each one in or out, in writing.

T
All 6 lawsT
GDPR · T
ePrivacy Art 13 opt-in for electronic marketing, with a soft opt-in for existing customers in most member states
UK GDPR · T
PECR regs 22–23 consent for electronic marketing, soft opt-in for existing customers (extended to charities by the DUAA)
PIPEDA · T
CASL ss. 6 and 11 consent before sending commercial electronic messages; unsubscribe honoured within 10 business days; s. 13 puts the onus of proving consent on you
Law 25 · T
s. 22 when using information for commercial prospecting, identify yourself and offer withdrawal; CASL also applies to electronic messages
POPIA · T
s. 69 electronic direct marketing needs opt-in consent (asked once) or the existing-customer exception; every message carries an opt-out
CCPA · T
15 U.S.C. §7704 working unsubscribe honoured within 10 business days, a postal address, no deceptive headers
O
PIPEDAOLaw 25O
PIPEDA · O
CASL s. 33 due diligence defence; CRTC Compliance and Enforcement Bulletin 2014-326
Law 25 · O
CASL s. 33 due diligence defence; CRTC Compliance and Enforcement Bulletin 2014-326
T
PIPEDATLaw 25T
PIPEDA · T
CASL s. 8 installing software on someone else's device in the course of commercial activity
Law 25 · T
CASL s. 8 installing software on someone else's device in the course of commercial activity
T
All 6 lawsTNote
GDPR · T
Art 8 information society services offered to children; age 13 to 16 depending on the member stateArt 8(1) lets each member state lower the age of digital consent from 16 to as low as 13. Check the national derogation for every country you serve.
UK GDPR · T
Art 8 information society services offered to children under 13
PIPEDA · T
Services directed at children the OPC's position is parental consent under 13
Law 25 · T
s. 4.1 under-14s need consent from a parent or tutor
POPIA · T
s. 35 children under 18 need a competent person's consent
CCPA · T
§1798.120(c) opt-in before selling or sharing data of under-16s, with a parent's consent for under-13s
T
CCPA onlyT
CCPA · T
16 CFR Part 312 verifiable parental consent for under-13s on child-directed services or with actual knowledge
T
UK GDPR onlyT
UK GDPR · T
DPA 2018 s. 123 online services likely to be accessed by children
T
All 6 lawsT
GDPR · T
Monitoring staff DPIA, notice, proportionality; Art 88 national rules
UK GDPR · T
Monitoring staff DPIA, notice, proportionality; ICO monitoring workers guidance
PIPEDA · T
Federally regulated employers only; otherwise provincial law
Law 25 · T
Monitoring staff s. 3.3 assessment for new systems; s. 8.1 for tracking tools
POPIA · T
Monitoring staff s. 18 notice, s. 11 justification, proportionality
CCPA · T
Employee data is fully covered; monitoring may need a risk assessment (Regs §7150)
T
GDPRTUK GDPRTLaw 25TPOPIAT
GDPR · T
Art 89
UK GDPR · T
Art 89; the DUAA clarified scientific research purposes
Law 25 · T
ss. 21–21.0.2 research use without consent needs an assessment and a written agreement
POPIA · T
s. 27(1)(d) and s. 15(3)(e) research safeguards
T
CCPA onlyT
CCPA · T
Civ. Code §1798.99.80 and following register annually with the CPPA; from 1 August 2026, process DROP deletion requests at least every 45 days

Privacy BOM