One Part Cyber, All Parts Security

I hear some version of this from general counsel more often every year: they don't blindly trust their outside firm anymore, they verify it, the same way they verify every other vendor with access to their data. That shift catches a lot of firms off guard. Lawyers see themselves as trusted advisors, but procurement and legal ops teams see a law firm as one more party holding sensitive information. To them, that means proof, not just a handshake.

Canada's privacy regulator has released new draft guidance establishing comprehensive due diligence standards for organizations evaluating third-party service providers under PIPEDA. The framework introduces eleven best practices covering everything from data flow mapping and AI training data sourcing to vendor lock-in risks and ongoing monitoring obligations, signaling heightened expectations for privacy accountability in vendor relationships.

En juin 2026, le gouvernement fédéral a présenté le projet de loi C-36, qui remplacerait la Loi sur la protection des renseignements personnels et les documents électroniques (la LPRPDE) par une nouvelle...

Ce bulletin mensuel a été préparé par le groupe Protection des renseignements confidentiels, vie privée et cybersécurité de Fasken pour vous présenter les actualités et les développements récents qui ont attiré notre attention. Si vous avez des questions sur l’un des sujets abordés dans ce bulletin, communiquez avec l’un des membres de ce groupe, qui se fera un plaisir de vous aider.

The Toronto Regional Real Estate Board’s (TRREB) Q4 2025 Commercial Report records commercial and retail average net lease rates at $29.97 per square foot, up 18.3 per cent year-over-year

This is a monthly bulletin published by the Privacy and Cybersecurity Group at Fasken with noteworthy news and updates. If you have any questions about the items in this bulletin, please contact any member of the Privacy and Cybersecurity Group, and we will be pleased to assist.

Canada's proposed Bill C-36 would fundamentally transform private-sector privacy law by replacing PIPEDA with the Protecting Privacy and Consumer Data Act. Organizations face stricter data collection tests, new consent exceptions, explicit AI governance rules, and penalties reaching $25 million or 5% of global revenue for knowing violations.

In June 2026, the federal government introduced Bill C-36, which would effectively replace the existing Personal Information and Electronic Documents Act (“PIPEDA”) with a new Protecting Privacy...

When does protecting the public justify reaching into an employee's private life?

Canada is often the first international market a US or European company enters, and it is usually the one leadership underestimates. The language is familiar, the legal system outside Quebec is common law, and the commercial culture feels close to home. That familiarity is exactly what makes Canada expensive for companies that treat market entry as an administrative exercise rather than a legal one.