FKINP Before launching an employee or customer data initiative, a BC private organization should require a privacy-impact package containing an initiative brief, an end-to-end data-flow map, purpose and consent findings, access and retention findings, a risk register, and an owned mitigation plan.[1][3][4]
Require this review package before launch
OIPC BC’s private-sector PIA guidance says organizations are not legally obligated to complete a PIA under BC PIPA, but describes one as a best practice that documents how an initiative meets PIPA and demonstrates due diligence and accountability.[4] Use the list below as a procurement and acceptance standard for the work you commission.
OIPC publishes a private-sector PIA template with a companion guidance document. Its sections cover the initiative description and scope, collecting personal information and consent, the notification statement, a personal-information inventory and data-flow diagram, security measures and compliance monitoring, access, correction, retention and disposal, privacy officer comments and signatures.[4]
- Initiative brief: Identify the system, process or vendor relationship; the affected groups; the personal information involved; where it comes from; and each purpose for collecting it.[1][4]
- End-to-end data-flow map: Show collection points, processing steps, storage environments, third parties and cross-border pathways.[3][4]
- Purpose and consent analysis: Assess whether collection is necessary and proportionate, then compare actual collection, use and disclosure with the scope of consent and what individuals were told.[1][4]
- Access, retention and safeguards findings: Record where and how information is stored, who can access it, how individuals can request access and corrections, how information is retained and disposed of, and whether security measures are sufficient.[4]
- Risk register: For each risk, record its probability, its impact on the individual, the mitigation and the remaining score after mitigation. OIPC’s template uses these columns so decision makers can see the risk the organization still carries if it proceeds.[4]
- Owned mitigation plan: Prioritize risks, assign an owner and set an implementation timeline aligned with the project roadmap. Identify who remains accountable for oversight of the system or vendor.[1][3]
- Final decision record: Require a consolidated document for internal approval. Privacy Horizon describes its output as documentation for legal, board or OIPC review; ClearBreach says its Wizard produces a completed PIA for internal review.[1][3]
Determine whether BC PIPA, PIPEDA or FIPPA is relevant
Classify the organization and its data flows before selecting a PIA process. Privacy Horizon describes BC PIPA as governing most private-sector organizations in British Columbia and as substantially similar to PIPEDA.[3]
- BC PIPA: OIPC says private organizations are legally obligated to follow PIPA when they collect, use and disclose personal information, but are not legally required to complete a PIA.[4]
- PIPEDA: Privacy Horizon says federal applicability should be considered for federally regulated businesses, including banks, airlines and telecommunications companies, and for personal information crossing provincial or national borders.[3] ClearBreach reports that PIPEDA does not generally mandate PIAs for private-sector organizations.[1]
- FIPPA: UBC says that, as a BC public body, it must conduct PIAs for new or substantially modified initiatives under FIPPA. That public-body process should not be assumed to govern an ordinary private company.[2][5]
OIPC’s guidance uses one PIA structure for employee and customer initiatives alike, and notes that personal information under PIPA includes employee personal information.[4] Confirm the jurisdictional conclusion against the applicable legislation and regulator materials.
Compare Privacy Horizon and the ClearBreach PIA Wizard
The main choice is between a consultant-led assessment that maps risks and mitigations and a guided tool that produces a document for internal review.[1][3]
Privacy Horizon
- Coverage: Privacy Horizon markets its service to businesses and organizations across British Columbia and frames it around BC PIPA and OIPC expectations.[3]
- Output: Its process maps collection, processing, storage, third parties and cross-border pathways. The vendor says it prioritizes risks, assigns mitigation owners, builds an implementation timeline and prepares documentation for legal, board or OIPC review.[3]
- Availability and evidence: The page presents the offering as a consulting service and supports it with vendor descriptions of its process and deliverables.[3]
ClearBreach PIA Wizard
- Coverage: ClearBreach presents the Wizard for Canadian organizations assessing initiatives under PIPEDA, Alberta PIPA or BC PIPA; its guide excludes Québec.[1]
- Output: The Wizard provides a jurisdiction-aware guided assessment and, where applicable, an AI module addressing automated decisions, AI vendors processing personal information and new processing technology. ClearBreach says the output is a completed PIA ready for internal review.[1]
- Availability and evidence: The page uses a “Get early access” call to action and says proactive PIAs leave organizations better positioned if an OPC investigation follows.[1]
The Privacy Horizon page does not state a delivery time or provide independent performance evidence. The ClearBreach page says a PIA can be bought one at a time, but does not cite an independent study of its results.[1][3]
Privacy Horizon is more closely aligned with a need for facilitated data-flow mapping and an owned mitigation roadmap.[3] The Wizard is more closely aligned with an internal team prepared to gather the facts and review a guided PIA document itself.[1]
Test the handoff for completeness
Accept the assessment based on traceability rather than the polish of its executive summary. OIPC’s guidance sets the PIA’s contents, not how an organization should accept a consultant’s deliverables, so build these checks into the engagement.[4]
- Reconcile the map and narrative. Trace each information category from collection through its uses, disclosures, storage locations, recipients and disposal.[3][4]
- Test each conclusion. Connect every purpose to the necessity, proportionality and consent findings. Record the support for access, retention and safeguard conclusions.[1][4]
- Test risk ownership. For each recorded risk, require probability and impact findings, a mitigation action, a remaining score, an owner and a target date.[3][4]
Record sign-off, residual risk and change review
OIPC says signing off on a PIA is an acceptance of risk: signatories should have enough authority to judge whether the risks are acceptable, and by approving they indicate that the remaining risks fall within the organization’s risk tolerance.[4] PIPA requires an organization to designate someone responsible for compliance, and the template gives that privacy officer a section for comments on the initiative.[4]
Record:
- the assessed initiative version and decision date;
- approval, conditional approval or deferral, including launch conditions;
- each remaining risk, its score after mitigation and the signatory accepting it;
- each mitigation owner and due date;
- the privacy officer’s comments; and
- the system or vendor owner responsible for ongoing oversight.
OIPC describes an approved PIA as a snapshot at the time of signature and recommends a review cycle to confirm the initiative still operates as documented and that the approving executives have not changed.[4] Also set a reassessment trigger for material changes to processing, including changes involving technology, vendors, use, sharing or retention.[1][4]
Apply the package to a fictional BC initiative
Consider a hypothetical BC retailer adding AI-enabled customer support to its CRM. The data-flow map would follow customer messages and account identifiers through the CRM, the AI vendor, relevant infrastructure and staff interfaces, through to retention or deletion. The assessment would address necessity, notice and consent, staff access, safeguards, retention, human oversight of AI outputs, third parties and cross-border pathways.[1][3][4]
- Illustrative risk: Unnecessary CRM fields reach the AI vendor. The decision record assigns an owner and due date, makes restricting the data feed a launch condition and records the remaining score.
- Illustrative risk: Vendor deletion practices or foreign infrastructure remain unclear. The decision record assigns follow-up work and records whether production launch is deferred, conditional or approved with remaining risk.
These roles and decisions are illustrative internal controls built on OIPC’s sign-off guidance, not a sequence it requires.[4]
What to confirm with each provider
The Privacy Horizon page does not publish its price, fee components, service limits, delivery time, contract length, cancellation terms or refund terms; the ClearBreach page does not publish the PIA Wizard’s price, fee components, usage limits, contract length, cancellation terms, refund terms or firm availability date.[1][3]
Obtain written confirmation of:
- total fees and variable charges;
- included interviews, workshops and revisions;
- who validates the data-flow map;
- whether the deliverable follows the OIPC template’s sections;
- final file formats and post-review support;
- how unresolved issues are documented and escalated;
- confidentiality and information-handling terms;
- service limits, contract length, cancellation and refund terms;
- delivery timing or product availability; and
- whether legal advice, technical security testing or implementation work is included.
Keep the PIA’s role narrow
A completed PIA is not a legal opinion, security certification or guarantee of compliance. OIPC presents the PIA as a tool for documenting an initiative’s privacy risks and their acceptance, while Privacy Horizon describes data-flow, risk and mitigation documentation and ClearBreach describes a completed document for internal review; neither vendor page states that legal advice or independent testing of technical safeguards is included.[1][3][4]
References
- Do You Need a Privacy Impact Assessment? A Guide for Canadian Organizations — ClearBreach (clearbreach.ca)
- PIA & STRA — Privacy Matters @ UBC (ubc.ca)
- Privacy Impact Assessment Services in British Columbia — Privacy Horizon (privacyhorizon.com)
- Guidance Document: Privacy Impact Assessments for the Private Sector (January 2020) — OIPC BC (bc.ca)
- PIA & STRA — Privacy Matters (UBC) (ubc.ca)
