Privacy Policy Review Service for Canadian Businesses: Does Your Privacy Policy Tell the Truth?

TORONTO, ON – Your privacy policy may be perfectly written. It may also be completely wrong.
The Office of the Privacy Commissioner of Canada’s latest research found that only 40% of Canadians believe businesses generally respect their privacy rights, while 71% find privacy policies difficult to understand. Seventy-eight per cent have refused to provide personal information because of privacy concerns and 41% report having stopped doing business with a company that experienced a privacy breach.

Privacy complaints are also increasing. The OPC reported 3,044 PIPEDA complaints in 2025-2026, up 109% from the previous fiscal year. Businesses reported 696 privacy breaches affecting more than 20.3 million Canadian accounts.

Yet 84% of surveyed Canadian businesses already report having a privacy policy.
“When someone lands on a website, data collection may begin before they ever click the Privacy Policy,” said Claudiu Popa, Privacy Risk Advisor and Certified Information Privacy Professional with Managed Privacy Canada. “That makes the policy the foundation of the organization’s public privacy promise. Having it independently reviewed by a qualified, accountable privacy professional turns that promise into something more valuable: evidence that someone competent has actually checked it.”

What does our professional Privacy Policy Review actually examine?

Managed Privacy Canada uses a structured 75-point professional review to examine your privacy policy against key areas including personal information collection, consent, sharing, retention, cookies and tracking, security, accountability, higher-risk uses, clarity and consistency. You receive clear findings showing what meets the criteria, what needs correction, what could not be verified and what is not applicable, along with specific recommendations on where the problems are, why they matter and what to do next.

This is not just for large companies

You do not need a large legal department or dedicated privacy officer to need a Privacy Policy Review: this is for any decision-maker responsible for a business or nonprofit with a public-facing website or online service. A review is especially worthwhile when the policy was copied from another organization, has not been updated, or no longer reflects changes to your website, vendors, analytics, cloud services, forms, customer portals, markets or AI tools.

What we provide

Through Verify™, you get three ways to turn your assessment into visible proof: a live Verify™ indicator on your website, a Trust & Assurance Centre where customers and partners can review your trust documentation, and a Statement of Trust attestation you can share with stakeholders. In short: verify it, show it, attest to it.

Who is behind the review?

Managed Privacy Canada is part of the Informatica Group, tracing back to 1989. The group’s capabilities span privacy management, cybersecurity, risk assessment, AI governance, OT security, education and public cybersafety.

Claudiu Popa, founder of the Informatica Group, is identified in the supplied professional materials as a certified professional with credentials including CISSP, CISA, CIPP, CRISC and PMP, as well as a computer science background and extensive experience in privacy, information risk, security and compliance. His public work has also included books, teaching, standards work and media commentary, including CTV National News and CBC Marketplace. Privacy review is judgment work. A checklist can organize the questions. Experience helps determine which answers deserve another question.

The executive question

You do not need to become a privacy lawyer to ask one very useful question: Does our privacy policy accurately describe what we actually do? If the answer is “I think so,” that may be enough to justify a review. If the answer is “We copied it from another website,” the case is stronger. And if the answer is “I have no idea when it was last reviewed,” it is probably time to find out. A privacy policy is supposed to explain your organization to the people whose information you collect. Because the most important thing about a privacy policy is not how professional it sounds. It is whether it tells the truth.