GDPR imposes eight core obligations on any organisation that processes EU personal data. Failure to meet any of these is grounds for enforcement action.
01
Lawful Basis and Consent
Obtain clear, affirmative consent before collecting personal data. For individuals under 16, parental consent is required. Consent must be documented and withdrawable at any time.
02
Right of Access and Portability
Provide individuals with a copy of their personal data upon request, in a machine-readable format. Requests must be fulfilled within 30 days without charge.
03
Right to Erasure
Erase all personally identifiable records when requested by the data subject, when data is no longer necessary, or when consent is withdrawn. Also known as the right to be forgotten.
04
Data Security and Privacy Controls
Implement appropriate technical and organisational measures to protect personal data. Encryption, access controls, and regular security assessments are baseline requirements.
05
72-Hour Breach Notification
Report any personal data breach to the relevant supervisory authority within 72 hours of becoming aware. If the breach is likely to result in high risk to individuals, notify them directly as well.
06
Privacy Impact Assessments
Conduct Data Protection Impact Assessments (DPIAs) before processing activities that are likely to result in high risk to individuals. Required for large-scale processing and new technologies.
07
Data Protection Officer
Appoint a Data Protection Officer (DPO) if your organisation engages in large-scale processing of sensitive data or systematic monitoring of individuals. The DPO can be internal or outsourced.
08
Cross-Border Data Transfer Controls
Transfers of EU personal data outside the EU require an adequacy decision, Standard Contractual Clauses (SCCs), or another approved mechanism. Canada has partial adequacy status for PIPEDA-covered transfers.
Source: EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679
We make GDPR compliance practical, not theoretical. Every engagement follows a structured methodology designed to get Canadian organisations compliant efficiently and maintain that compliance year over year.
01
Identify Key Data Assets
Map all personal data your organisation collects, stores, and processes. Identify where EU personal data flows in and out of your systems, and which third-party processors have access to it.
02
Complete Risk Assessment
Perform a gap assessment against all eight GDPR obligations. Score current controls, identify deficiencies, and prioritise remediation based on risk level and enforcement exposure.
03
Implement Policies and Controls
Develop and deploy GDPR-compliant privacy policies, data processing agreements, consent mechanisms, breach response procedures, and technical controls across your systems and operations.
04
Monitor, Train, and Maintain
Deliver data security awareness training, establish ongoing monitoring processes, conduct regular Privacy Impact Assessments, and provide year-over-year advisory to keep compliance current as your business evolves.
GDPR compliance for most Canadian organisations is achievable in 8 to 16 weeks depending on data scope and current control maturity. View our full compliance consulting services or learn about SOC 2 certification if your organisation serves enterprise clients.
Start Your GDPR AssessmentCommon questions from Canadian businesses navigating GDPR for the first time.
Yes. GDPR applies based on where the data subjects (individuals) are located, not where the organisation is based. If your Canadian business offers goods or services to EU residents, or monitors the behaviour of EU residents (such as through website analytics or cookies), GDPR applies to you even if you have no office, employees, or assets in the EU.
PIPEDA is Canada's federal privacy law governing how private-sector organisations collect, use, and disclose personal information in the course of commercial activity. GDPR is the European Union's regulation protecting the personal data of EU residents globally. The two frameworks share similar principles but differ significantly in scope, enforcement mechanisms, and penalty structures. GDPR carries far higher penalties and more prescriptive requirements. Many Canadian businesses subject to both must comply with each independently. Canada has partial adequacy status under GDPR for PIPEDA-covered data transfers, which simplifies cross-border data flow requirements.
GDPR penalties fall into two tiers. Tier 1 violations (less severe, such as improper record-keeping or failure to conduct a Privacy Impact Assessment) carry fines up to €10 million or 2% of global annual turnover, whichever is higher. Tier 2 violations (more serious, such as processing without a lawful basis, violating data subject rights, or transferring data without adequate safeguards) carry fines up to €20 million or 4% of global annual turnover, whichever is higher. EU regulators have actively pursued non-EU organisations. A Canadian business is not protected from enforcement by geography alone.
If your website is accessible to EU users and you collect any personal data from them (including via cookies, analytics, contact forms, or marketing pixels), GDPR likely applies. At minimum, you need a GDPR-compliant privacy policy, a cookie consent mechanism that meets the lawful basis requirements, and a clear process for handling data subject requests. The mere fact that EU residents can visit your site is not automatically sufficient to trigger GDPR if you do not actively target the EU market, but collecting any identifiable data from EU visitors changes the picture.
For most Canadian small and mid-size businesses with a defined data scope, initial GDPR compliance can be achieved in 8 to 16 weeks. The timeline depends on how much EU personal data you process, how mature your existing privacy and security controls are, and how quickly your team can implement policy and technical changes. Organisations with complex data flows, legacy systems, or large-scale EU processing will take longer. The Driz Group provides a structured 4-step process that has delivered compliance on schedule for every engagement to date.
A Data Protection Officer is mandatory under GDPR only if your organisation is a public authority, carries out large-scale systematic monitoring of individuals, or processes special categories of data (such as health, biometric, or criminal data) at large scale. Many Canadian SMBs will not meet these thresholds. However, even if a DPO is not mandatory, appointing one (internally or as an outsourced function) demonstrates accountability and significantly reduces enforcement risk. The Driz Group can serve as your outsourced DPO function as part of our ongoing compliance advisory service.
The Driz Group has delivered compliance programmes for Canadian organisations across healthcare, financial services, technology, and professional services. We make GDPR practical, achievable, and sustainable. Call us today or book a free assessment to understand your current exposure.
Free
Initial GDPR applicability review
8-16 weeks
Typical compliance timeline
Ongoing
Year-over-year advisory available
