Privacy
Handling and Protecting Sensitive Personal Information
PRIVACY | GLOBAL
The Boardroom Discussion on Consumer Privacy
Consumer privacy, also known as customer privacy, involves the handling and protecting of sensitive personal information during everyday transactions. Privacy can be a complicated amalgam of international, federal, state, and local privacy regulations. Privacy laws and regulations make it clear that organizations must be able to demonstrate information and data security best practices and effective implementation across all aspects of their business. In the past several years efficient data privacy and cybersecurity are now fundamental to business success.
Forward-thinking organizations need to adopt a privacy-first strategy placing customers’ privacy ahead of their needs, creating a favorable environment for building trust, improving customer satisfaction, meeting regulatory requirements, and supporting long-term relationships to develop a mutually beneficial exchange with customers.
Regulatory Requirements and Principles Under the Privacy Laws in Canada
PRIVACY | CANADA
Main Federal Laws for the Collection, Use and Disclosure of Personal Information in Canada
There are a number of laws covering privacy rights in Canada, depending on the type and location of an organization, as well as the type and the reach of information. However, there are two (2) main federal privacy laws in Canada dealing with personal information, the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), both enforced by the Office of the Privacy Commissioner of Canada.
The goal of the Privacy Act R.S.C, 1985 (the Act) is to safeguard and defend an individual’s privacy and personal information at the disposal by a government institution. It is the law that sets out privacy rights of Canadians in relation to how personal information is collected, used and disclosed through federal government interactions and also allows them the right to have access to that information. PIPEDA governs how private sector organizations collect, use and disclose personal information during the course of commercial activity. Moreover, PIPEDA is also applicable to federally regulated organizations when it comes to their employees’ personal information.
Knowing Your Customer Data Journey
PRIVACY | GLOBAL
Data Standards for Know Your Customer (KYC) Framework and Procedures
Know Your Customer (KYC) is a significant element in today’s fight against financial crime and money laundering. KYC is a regulatory obligation for almost any institution that interacts with money. Standard KYC procedures generally apply when a business onboards a new client or a current client acquires a regulated product. KYC is an ongoing process, consisting of multiple steps throughout a customer’s lifecycle.
Bank’s must gather both proof of identity (“POI”) and proof of address (“POA”) for each customer, at minimum, prior to establishing an account. The minimum requirements for customer identification include the following: Full Name, Date of Birth, Address, Identification Number and Tax Number. Non-bank customer identification requirements are primarily risk-based. Unlike a bank, they generally do not have specific regulations for collecting information.
Other Relevant Spotlights
SANCTIONS | US
Geolocation is More Than Just a Postcode
A Spotlight on Geolocation and IP Address Screening to Maintain Compliance with the Office of Foreign Assets Control (OFAC)
CYBERSECURITY
The Understanding and Defending Against Social Engineering Attacks
A Spotlight on How You Can Protect Your Organization From Social Engineering Attacks
CYBERSECURITY
The Rise of Advanced Passwordless Authentication
A Spotlight on the Transition from Traditional Authentication to Passwordless Authentication Methods
415.352.1060 2193 Fillmore Street, Suite 1
San Francisco, CA 94115

RISK | STRATEGY | CYBER COMPLIANCE MANAGEMENT
© 2026 Stratis Advisory LLC. All Rights Reserved.
Terms of Use | Privacy Policy














