DataGovernance.ca editorial · 13 October 2026 · Implementation guidance
Find the missing handoff
Choose a routine scenario, such as receiving an information-access request or removing a former employee’s access. Ask staff what they would do today. Which inbox receives it? Who verifies the scope? Which systems are involved? Who has authority to approve the response? A policy may state an intention while leaving each of these decisions unresolved.
Build the smallest usable workflow
With the privacy lead and the relevant specialists, map the trigger, steps, responsibilities and evidence. Separate legal decision points from administrative tasks. Keep time-sensitive obligations tied to an approved requirements register rather than an unreviewed template. Staff need to know when to escalate uncertainty, especially if a request involves more than one system or an external provider.
Keep authority visible
The OPC’s accountability guidance connects a privacy programme to a responsible official and implemented policies and practices. Our consulting approach supports that operational work; it does not replace the designated official or determine which laws apply. Confirm federal, provincial, sectoral and contractual requirements with the appropriate specialists.
Rehearse before relying on it
Run a tabletop exercise with fictional or suitably redacted information. Record missing permissions, unclear responsibilities and systems that do not support the intended action. Update the workflow and schedule another review when people or technology change. Do not call an exercise a compliance certification, and do not use a public inquiry form to transfer the underlying client records.
Test the handoff with a tabletop exercise.
Select one approved requirement with your responsible privacy lead. Use fictional information to walk through intake, validation, system actions, approval and evidence. Stop at unclear authority or capability; record the question rather than pretending the process succeeded.
The record should identify the scope, owner, evidence, unresolved questions and next review. It is a draft exercise—not evidence that your organisation has implemented or passed the control.