What Is Data Privacy?

Data privacy concerns an individual's control over how their personal information is collected, used, retained and shared. It overlaps with security and is not the same thing, and conflating them produces programmes that satisfy neither.

Security asks whether data is protected from unauthorised access. Privacy asks whether the access you authorised was appropriate in the first place. A system can be flawlessly secure and comfortably unlawful.

The principles that recur across regimes

Whatever the jurisdiction, the same ideas appear: collect only what is needed for a stated purpose, use it only for that purpose or a compatible one, keep it only as long as necessary, keep it accurate, be transparent about what you do, give individuals rights over their data, secure it proportionately, and be accountable for all of it.

Purpose limitation and retention are where most organisations are quietly offside. Data collected for one reason gets reused for analytics or product development, and retention schedules either do not exist or are not enforced by anything technical.

Rights create engineering requirements

Access, correction, deletion, portability and objection are not policy commitments — they are product features. An organisation that cannot export a person's data in a structured format, or delete it across every downstream system, cannot honour the rights regardless of what its privacy notice says.

This is the most common gap between a privacy policy and privacy practice: the commitments are written by legal and the capability to fulfil them was never built.

The Canadian position, briefly

PIPEDA applies federally to commercial activity, with Quebec, British Columbia and Alberta operating substantially similar private-sector laws, and health information governed separately by province. An organisation of any size is frequently subject to several at once.

Quebec's Law 25 is now the strictest and therefore the sensible standard to build to on most obligations — with the notable exception of employee information, where the BC and Alberta rules reach further. See operating across provinces.

Privacy and security disagree more often than expected

The two disciplines are usually described as complementary, and they genuinely conflict in places worth anticipating. Extensive logging aids detection and creates a store of personal data with its own retention obligation. Long retention aids investigation and violates minimisation. Behavioural monitoring detects insider risk and processes employee data in ways several regimes constrain.

None of these has a universal answer, and the failure mode is each discipline resolving them unilaterally — security retaining everything indefinitely, or privacy prohibiting the logging an investigation would require.

Resolving them jointly, in writing, with a documented rationale is what a defensible position looks like. It is also what a regulator asks for when the question arises after an incident.

Where the two functions report separately, a standing joint review of these trade-offs is worth more than either team’s policy document.

Where to start

Pick one system and answer three questions: what personal data is in it, why was it collected, and how long is it kept. If any answer is unclear, that is the state of your privacy programme regardless of the policy.

See PIPEDA compliance. GuardsArm supports PIPEDA compliance.