Privacy and Data Processing
We help businesses understand how they collect, use, store and share personal information, and put practical privacy policies and data processing agreements in place. Our work supports technology companies, startups and established organizations reviewing their data practices, negotiating customer or vendor terms, or entering new markets.
Oziel Law is ranked Tier 1 for Technology Law in Toronto in Best Law Firms™ – Canada (2025 and 2026). Allan Oziel has been recognized in The Best Lawyers in Canada™ for Technology Law since 2022.
Our Privacy and Data Processing Services
Privacy advice and documents that reflect the way your business actually handles personal information.
Privacy Compliance and Data Protection Programs
Review data flows, privacy responsibilities, policies and operational practices.
Privacy Policies and Notices
Explain your data practices in language customers and users can understand.
Data Processing Addenda
Negotiate customer and vendor terms covering processing instructions, security, subprocessors and incident cooperation.
Cross-Border Data Processing
Review hosting, vendor and transfer arrangements alongside the jurisdictions in which your business operates.
Privacy Reviews for Products and Vendors
Identify privacy questions early in a product launch, procurement or change to the way information is used.
Why Clients Choose Us
A privacy policy should reflect what your product and suppliers actually do. We connect the public-facing explanation with your contracts and internal practices, including where data is hosted, who can access it and how a vendor handles deletion or an incident.
Our advice focuses on decisions your team needs to make and documents your business can use. AI governance, responsible AI and AI-specific contracting are addressed through our separate Artificial Intelligence and AI Governance service.
Our Privacy Lawyers
Lawyers helping businesses review personal information practices and negotiate data processing arrangements.
Privacy and Data Processing News and Insights
Articles and selected transactions involving privacy and data processing.
Frequently Asked Questions about Privacy and Data Processing
Which privacy laws apply to my business in Canada?
Most private-sector businesses are governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) for their commercial activities. Quebec, Alberta and British Columbia have their own private-sector privacy laws, and Quebec's Law 25 adds stricter requirements. Health information can be subject to provincial health privacy laws such as Ontario's PHIPA. If you serve customers abroad, laws such as the EU GDPR may also apply.
Do we need a privacy policy and a privacy officer?
Yes. Canadian privacy law requires organizations to be accountable for the personal information they handle: designate an individual responsible for privacy, have written policies and practices, and explain them in plain language to customers in a privacy policy.
What must we do after a data breach?
Under PIPEDA, if a breach of security safeguards creates a real risk of significant harm, you must report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. You must also keep a record of every breach for 24 months. Quebec and other provinces have their own rules.
Can we store or process personal data outside Canada?
Generally yes, if you protect the data with contracts and security measures and tell people their information may be processed outside Canada. Quebec's Law 25 also requires a privacy impact assessment before personal information is transferred outside Quebec.
What should a data processing addendum address?
A data processing addendum should fit the service and the information involved. We review the processing activities, permitted instructions, security commitments, use of subprocessors, incident cooperation, assistance with requests and what happens to the information when the relationship ends. We help align these terms with the underlying technology service agreement.
Can you review the privacy implications of a new product or vendor?
Yes. We can work with your team to map what information the product or vendor will receive, why it is needed, where it will be processed and who can access it. That review informs your notices, internal practices and contractual requirements. Broader questions about AI governance, responsible use and AI-specific agreements are addressed by our Artificial Intelligence and AI Governance service.
Discuss Your Privacy and Data Processing Needs
Tell us about your product, data practices or proposed agreement, and the privacy questions you need to resolve. Please do not include confidential information.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Connect With Us
Follow us on social media to stay updated with our latest news and insights.
Office Hours
Monday – Friday: 9:00 AM – 5:00 PM
Saturday – Sunday: Closed