it-operations
-
How to Run Your First Tabletop Exercise: An SMB Walkthrough
6 min read
ISO 27001:2022 controls A.5.24 to A.5.27 require planned, practiced incident response. A tabletop exercise is the cheapest way to test it. Here is how a small IT team runs its first one in 90 minutes, with a ready-to-use scenario.
-
CPPA Reform 2025 Readiness: What Canadian SMBs Do While Bill C-27 Finishes
6 min read
Bill C-27 replaces PIPEDA with the Consumer Privacy Protection Act, adds a data-protection tribunal, and introduces the Artificial Intelligence and Data Act. The exact penalty ceilings and final provisions will be set by the enacted bill — but seven readiness actions are PIPEDA-good today and CPPA-ready tomorrow. A grounded getting-started guide for SMB IT.
-
Law 25: SMB Getting-Started Checklist (30-60-90 Days)
6 min read
Law 25 imposes twelve obligations across three phases (2022, 2023, 2024). For an SMB starting out, order matters: appoint the officer, stand up the incident register, then build governance. Here is a 30-60-90-day checklist by phase.
-
Quebec Law 25: Appointing the Personal-Information Officer
6 min read
Law 25 (Article 3.1) requires every private-sector organisation to appoint a personal-information officer and publish their contact details. It is the first obligation, in force since 22 September 2022. Here is the role, the delegation, and how an SMB stands it up.
-
Quebec Law 25: Confidentiality Incidents, Register, and Notice Deadline
6 min read
Law 25 (Articles 3.5–3.8) requires a register of every confidentiality incident and notice to the CAI and affected individuals when there is a risk of serious prejudice. Unlike GDPR, there is no 72-hour clock — notice is ‘as soon as possible.’ Here is what the Law requires.
-
PIPEDA vs Loi 25 vs GDPR: The Cross-Border SMB Compliance Map
6 min read
A Canadian SMB that also serves EU or Quebec customers can trigger all three regimes at once. Side-by-side map of PIPEDA, Loi 25, and GDPR — scope, authority, officer, breach clock, access response, impact assessment, portability, transfers, and enforcement — grounded in the statute and regulation text.
-
Law 25 and GDPR: Parallelism and a Joint Programme for an SMB
6 min read
Law 25 transposes several GDPR elements into Quebec’s private sector: an officer, a PIA, an incident register, portability. An SMB subject to both can fuse the artifacts and run one programme. Here is the correspondence and the divergences.
-
GDPR DPIA Template: A Data Protection Impact Assessment an SMB Can Fill
6 min read
GDPR Article 35 requires a DPIA for high-risk processing — profiling, large-scale special-category data, systematic monitoring, new-technology employee tracking. Here is what the assessment must contain, a fill-in template, and a worked SMB example.
-
GDPR Data Subject Rights and the 72-Hour Breach Clock
6 min read
GDPR gives data subjects eight rights, and it gives you one month to answer them — and 72 hours to report a breach. Here is what each right requires, the response clock, and the breach-notification contents an SMB must assemble in three days.
-
How to Run Your First Tabletop Exercise: An SMB Walkthrough
ISO 27001:2022 controls A.5.24 to A.5.27 require planned, practiced incident response. A tabletop exercise is the cheapest way to test it. Here is how a small IT team runs its first one in 90 minutes, with a ready-to-use scenario.
-
CPPA Reform 2025 Readiness: What Canadian SMBs Do While Bill C-27 Finishes
Bill C-27 replaces PIPEDA with the Consumer Privacy Protection Act, adds a data-protection tribunal, and introduces the Artificial Intelligence and Data Act. The exact penalty ceilings and final provisions will be set by the enacted bill — but seven readiness actions are PIPEDA-good today and CPPA-ready tomorrow. A grounded getting-started guide for SMB IT.
-
Law 25: SMB Getting-Started Checklist (30-60-90 Days)
Law 25 imposes twelve obligations across three phases (2022, 2023, 2024). For an SMB starting out, order matters: appoint the officer, stand up the incident register, then build governance. Here is a 30-60-90-day checklist by phase.
-
Quebec Law 25: Appointing the Personal-Information Officer
Law 25 (Article 3.1) requires every private-sector organisation to appoint a personal-information officer and publish their contact details. It is the first obligation, in force since 22 September 2022. Here is the role, the delegation, and how an SMB stands it up.
-
Quebec Law 25: Confidentiality Incidents, Register, and Notice Deadline
Law 25 (Articles 3.5–3.8) requires a register of every confidentiality incident and notice to the CAI and affected individuals when there is a risk of serious prejudice. Unlike GDPR, there is no 72-hour clock — notice is ‘as soon as possible.’ Here is what the Law requires.
-
PIPEDA vs Loi 25 vs GDPR: The Cross-Border SMB Compliance Map
A Canadian SMB that also serves EU or Quebec customers can trigger all three regimes at once. Side-by-side map of PIPEDA, Loi 25, and GDPR — scope, authority, officer, breach clock, access response, impact assessment, portability, transfers, and enforcement — grounded in the statute and regulation text.
-
Law 25 and GDPR: Parallelism and a Joint Programme for an SMB
Law 25 transposes several GDPR elements into Quebec’s private sector: an officer, a PIA, an incident register, portability. An SMB subject to both can fuse the artifacts and run one programme. Here is the correspondence and the divergences.
-
GDPR DPIA Template: A Data Protection Impact Assessment an SMB Can Fill
GDPR Article 35 requires a DPIA for high-risk processing — profiling, large-scale special-category data, systematic monitoring, new-technology employee tracking. Here is what the assessment must contain, a fill-in template, and a worked SMB example.
-
GDPR Data Subject Rights and the 72-Hour Breach Clock
GDPR gives data subjects eight rights, and it gives you one month to answer them — and 72 hours to report a breach. Here is what each right requires, the response clock, and the breach-notification contents an SMB must assemble in three days.